Privacy Policy

1. Information We Collect

We collect the following categories of personal data when you use the ISHOP platform:

• Account Information: Full name, email address, phone number, and password (encrypted).
• Shop Information: Business name, address, logo, and contact details provided by shop owners.
• Transaction Data: Orders placed, amounts paid, payment methods, and transaction references.
• Device & Log Data: IP address, browser type, operating system, and pages visited.
• Payment Data: Phone numbers used for MTN MoMo payments (we do not store card details).

2. How We Use Your Information

We use the collected information for the following purposes:

• To create and manage user accounts and shop profiles.
• To process orders and facilitate payments through MTN Mobile Money.
• To generate sales reports and financial analytics for shop owners.
• To send transactional notifications related to your orders or payments.
• To improve platform functionality, security, and user experience.
• To comply with applicable Rwandan laws and regulations.

3. Payments & MTN MoMo

ISHOP integrates with the MTN Mobile Money (MoMo) API to facilitate cashless payments. When you make a payment via MoMo:

• Your phone number is shared directly with MTN Rwanda to initiate the USSD push request.
• A unique transaction reference (X-Reference-Id) is generated and stored for tracking purposes.
• ISHOP does not store your MTN PIN or any MoMo wallet credentials.
• Payment processing is governed by MTN Rwanda's Privacy Policy in addition to this policy.

MTN Rwanda is a licensed payment service provider regulated by the National Bank of Rwanda (BNR).

4. Data Sharing

We do not sell your personal data. We may share it only in these limited circumstances:

• MTN Rwanda — for processing MoMo payments.
• Government authorities — when legally required by Rwandan law or court order.
• Service providers — who help operate our platform (hosting, backups) under strict data agreements.

5. Data Security

We implement industry-standard security measures to protect your data, including:

• Encrypted passwords using Django's PBKDF2 hashing algorithm.
• HTTPS/TLS encryption for all data transmitted between your browser and our servers.
• CSRF protection on all forms and API endpoints.
• Role-based access control ensuring only authorized personnel can access sensitive data.
• Regular audit logs tracking all administrative actions within the platform.

6. Your Rights

Under the Rwanda Data Protection and Privacy Act (2021), you have the right to:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Ask us to correct inaccurate or incomplete data.
• Erasure — Request deletion of your personal data (subject to legal retention requirements).
• Objection — Object to how we process your data for certain purposes.
• Portability — Request your data in a structured, machine-readable format.

To exercise any of these rights, contact us at the details below.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Specifically:

• Account data is retained for the duration of your active account.
• Transaction and payment records are retained for 5 years in compliance with Rwandan financial regulations.
• Audit logs are retained for 2 years.
• Upon account deletion, personal data is anonymized within 30 days.

8. Cookies

ISHOP uses essential cookies for:

• Session management — to keep you logged in during your session.
• CSRF protection — to secure form submissions against attacks.

We do not use third-party tracking cookies or advertising cookies.

9. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the platform after changes constitutes acceptance of the updated policy.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact:

• Platform: ISHOP
• Jurisdiction: Republic of Rwanda
• Regulatory reference: NCSA — National Cyber Security Authority Rwanda