Privacy Notice

KAGOMA PROTECTIONS SERVICES LTD (“Kagoma,” “we,” “our,” or “us”) is committed to protecting personal data and respecting the privacy of individuals who use our website, management dashboard, training services, event operations services, and other business services.

This Privacy Notice explains how we collect, use, store, disclose, retain, and protect personal data.

Kagoma aims to handle personal data in accordance with Rwanda's Law No. 058/2021 of 13 October 2021 relating to the protection of personal data and privacy, together with other applicable laws and regulations.

This Notice applies to individuals who interact with Kagoma through our website, online accounts, training programmes, recruitment and staffing processes, event operations, client engagements, and related services.

Organisation: KAGOMA PROTECTIONS SERVICES LTD
Registered Address: Mushumbamwiza, Rwimbogo, Nyarugunga, Kicukiro, Kigali, Rwanda
General Contact Email: info@kagomaprotection.com

For questions, requests, or complaints concerning personal data, please contact us using the email address above.

Kagoma will assess and respond to privacy requests in accordance with applicable legal requirements.

Depending on the services you use and your relationship with Kagoma, we may collect the following categories of personal data.

3.1 Identity and Contact Information

• Full name.
• Email address.
• Telephone number.
• Date of birth, where necessary.
• Identification details, where legally justified and required.
• Residential or contact address, where necessary.

3.2 Account and Website Information

• Account registration details.
• Login and account management information.
• Language and display preferences.
• Information necessary to maintain website security.
• Relevant technical information generated when using our website or dashboard.

3.3 Training and Certification Information

• Training registrations and enrolments.
• Course progress and completion records.
• Assessment results, where applicable.
• Certificate numbers and issuance dates.
• Information required to verify certificates.
• Training-related communications.

3.4 Employment and Event Operations Information

Where relevant to recruitment, staffing, or event operations, we may collect:

• Professional and employment information.
• Relevant identification and eligibility information.
• Assigned duties and work locations.
• Attendance and working hours.
• Training and qualification records relevant to assigned duties.
• Incident and operational reports where necessary.
• Payment records relating to work performed.

3.5 Payment and Transaction Information

We may collect transaction references, payment confirmations, payment status, and other limited information required to verify transactions and maintain financial records.

Kagoma does not intend to collect or store payment card PINs, mobile money PINs, or comparable payment authentication secrets.

Where payments are processed by an external payment provider, that provider may independently process certain information under its own applicable terms and privacy policy.

3.6 Communications and Requests

We may retain information you provide when contacting us, submitting an enquiry, making a complaint, requesting a service, or exercising your data protection rights.

Data minimisation: Kagoma aims to collect only personal data that is reasonably necessary for a specified and legitimate purpose.

Kagoma may use personal data for the following purposes:

1. Creating and managing user accounts.
2. Providing training programmes and related services.
3. Managing registrations, assessments, and certificates.
4. Verifying certificate authenticity.
5. Managing recruitment, staffing, and event assignments.
6. Conducting identity or eligibility checks where legally justified.
7. Coordinating access authorisation for events and client locations.
8. Communicating with clients, staff, trainees, and service users.
9. Recording attendance and calculating payments for work performed.
10. Processing or verifying transactions.
11. Maintaining business, accounting, and tax records.
12. Protecting our website, dashboard, personnel, clients, and systems.
13. Investigating operational issues and responding to complaints.
14. Complying with applicable legal and regulatory obligations.
15. Establishing, exercising, or defending legal claims where necessary.

Kagoma does not sell personal data to advertisers.

We do not intend to use personal data for purposes incompatible with the purpose for which it was collected without an appropriate lawful basis.

Kagoma will identify an appropriate legal basis for processing personal data, as required by applicable law.

Depending on the circumstances, processing may be necessary for:

• Service delivery: Providing a service requested by an individual.
• Contractual purposes: Performing obligations under an applicable agreement.
• Legal compliance: Meeting legal or regulatory obligations.
• Consent: Where consent is required and is the applicable basis for processing.
• Legitimate and lawful operational purposes: Where permitted by applicable law and subject to the rights and interests of the individual.
• Legal claims: Establishing, exercising, or defending legal claims where permitted.

The applicable legal basis may differ according to the service, type of data, and circumstances.

Where consent is the basis for processing, individuals may withdraw it as permitted by applicable law. Withdrawal does not automatically invalidate processing that lawfully occurred before withdrawal.

Kagoma will provide additional information where necessary to explain the purpose and legal basis of a particular processing activity.

Kagoma may conduct identity verification, qualification verification, or background screening where necessary for a legitimate service-related purpose and permitted by applicable law.

Such activities may be relevant to recruitment, staffing, event access authorisation, professional qualifications, or other appropriate operational requirements.

Where applicable, Kagoma will:

• Explain the purpose of the verification.
• Collect only information relevant to that purpose.
• Use appropriate and lawful sources of information.
• Restrict access to authorised personnel.
• Take reasonable steps to address inaccurate or disputed information.
• Apply appropriate retention and security measures.
• Respect applicable legal requirements concerning consent, authorisation, and individual rights.

Information that has not been verified will not automatically be treated as established fact.

Where a screening result may materially affect an individual, Kagoma will consider the applicable legal requirements and appropriate procedures for reviewing disputed information.

Kagoma will not disclose screening records to clients or other third parties merely because those parties request them. Any disclosure must have an appropriate lawful basis.

Kagoma may disclose personal data only where necessary for an identified purpose and permitted by applicable law.

7.1 Authorised Kagoma Personnel

Authorised personnel may access information required to perform their assigned duties.

Access should be limited according to job responsibilities and removed when no longer required.

7.2 Clients and Event Venues

Where an individual is assigned to work at a client location or event, Kagoma may share limited information necessary for assignment coordination, identity verification, or access authorisation.

Depending on the circumstances, this may include a name, identification information, phone number, relevant address information, assignment details, or confirmation of eligibility — the minimum required for that purpose.

Copies of identification documents and other sensitive or confidential records are not routinely shared. Clients and venues do not receive unrelated information such as course results, account information or payment history. Disclosure must be necessary, appropriately justified, and permitted by applicable law.

7.3 Certificate Verification

A certificate verification service may disclose limited information necessary to confirm the authenticity of a certificate, such as:

• Name displayed on the certificate.
• Course or programme title.
• Certificate reference number.
• Date of issue.
• Verification status.

The public verification service should not disclose identification document numbers, residential addresses, private contact details, assessment results, or payment information.

7.4 Service Providers

Kagoma may use third-party service providers for hosting, email, payments, identity verification, communications, and other technical services.

Where a provider processes personal data on Kagoma's behalf, Kagoma will take appropriate steps to establish relevant contractual, confidentiality, security, and data protection safeguards.

7.5 Legal and Regulatory Disclosures

Kagoma may disclose information where required or permitted by applicable law, including in response to valid legal obligations or requests from competent authorities.

Some technology providers used by Kagoma may store or process personal data outside Rwanda.

Where personal data is transferred internationally, Kagoma will assess the applicable legal requirements and implement appropriate safeguards where required.

Depending on the circumstances, this may include reviewing the service provider, contractual protections, security arrangements, and the legal conditions governing the transfer.

Kagoma aims to ensure that international processing does not undermine the protection required by applicable law.

Kagoma may retain limited payment references, transaction confirmations, payment status, and relevant financial records for verification, reconciliation, accounting, taxation, and other legitimate purposes.

Kagoma does not intend to collect or store payment card PINs or mobile money PINs.

Where an external provider processes payments, its own privacy and security practices may also apply to the information it processes.

Users should avoid sending payment authentication credentials to Kagoma through email, messaging services, or other communication channels.

Kagoma aims to implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss, misuse, or destruction.

Depending on the system and the risks involved, these measures may include:

• Access controls based on assigned responsibilities.
• Password protection and secure authentication.
• Secure connections for data transmission.
• Appropriate protection of stored information.
• Security monitoring and activity logging.
• Backup and recovery arrangements, including those provided by our hosting and database providers.
• Staff confidentiality requirements.
• Procedures for removing access when it is no longer required.
• Periodic reviews of security controls.

Access to personal data should be restricted to authorised individuals who need it for an approved purpose.

No website, online service, or electronic storage system can guarantee absolute security. Kagoma will take reasonable and appropriate measures to protect the information entrusted to it.

Kagoma retains personal data only for as long as necessary for the purpose for which it was collected, subject to applicable legal, contractual, accounting, and regulatory requirements.

Retention periods depend on the type of information and the circumstances in which it is used.

Examples include:

Account information: Retained while an account is active and for any additional period reasonably required for legitimate operational or legal purposes.

Training records: Retained as necessary to administer courses, demonstrate completion, resolve disputes, and meet applicable obligations.

Certificate records: Limited verification records may be retained after an account is closed to support the verification of certificates previously issued.

Employment and event records: Retained as necessary for operational management, attendance verification, payment administration, and applicable legal obligations.

Financial records: Retained for the periods required by applicable accounting, taxation, and other legal requirements.

Identity verification records: Retained only for the period justified by the relevant verification purpose and applicable legal requirements.

When personal data is no longer required, Kagoma will take appropriate steps to delete it, anonymise it, or otherwise dispose of it securely, subject to applicable legal obligations.

Copies retained in backups may remain until they are removed through the applicable backup retention process.

Subject to applicable law and any lawful limitations, individuals may have the right to:

• Request access to their personal data.
• Request a copy of their personal data.
• Request correction of inaccurate or incomplete information.
• Request deletion of personal data where legally permitted.
• Object to certain processing activities where applicable.
• Request restriction of processing where legally available.
• Withdraw consent where processing is based on consent.
• Raise concerns or submit a complaint regarding the handling of personal data.
• Exercise other rights available under applicable data protection law.

To submit a request, contact:

Email: info@kagomaprotection.com

Kagoma may request reasonable information to verify the identity of the person making the request and protect against unauthorised disclosure.

We will assess and respond to requests within the applicable legal time limits, and in any case within 30 days, subject to lawful extensions or exceptions.

Where a request cannot be fulfilled in full, Kagoma will explain the position where required by law.

Deleting a Kagoma account does not necessarily require the deletion of every record associated with that account.

Kagoma may retain limited records where necessary and legally justified to:

• Verify the authenticity of previously issued certificates.
• Maintain required financial or business records.
• Resolve outstanding disputes.
• Comply with applicable legal obligations.

Retained information should be limited to what is necessary for the relevant purpose.

Individuals may request the removal of their names from publicly accessible directories or professional listings maintained by Kagoma. Such requests will be assessed in accordance with applicable law and legitimate recordkeeping requirements.

Kagoma's website may use cookies or similar technologies to support essential website functions. At present it relies mainly on limited browser storage rather than cookies. These functions include:

• Maintaining login sessions.
• Remembering language preferences.
• Remembering display preferences.
• Supporting website security and functionality.

Kagoma does not intend to use cookies for behavioural advertising through the website under this Notice.

If non-essential analytics, advertising, or tracking technologies are introduced, Kagoma will update this Notice and implement any notices, consent mechanisms, or user choices required by applicable law.

Users may also be able to manage cookies through their browser settings, although disabling essential cookies may affect website functionality.

Kagoma's account-based services and professional training programmes are intended for adults unless a particular programme expressly provides otherwise and appropriate arrangements are established.

Kagoma does not knowingly collect personal data from children in circumstances where doing so would be unlawful.

If you believe that Kagoma has collected a child's personal data without an appropriate legal basis, please contact info@kagomaprotection.com so that the matter can be reviewed.

Kagoma maintains a commitment to assessing and responding appropriately to security incidents involving personal data.

Where an incident is identified, appropriate measures may include:

• Investigating the nature and extent of the incident.
• Containing the incident and limiting further exposure.
• Assessing potential risks to affected individuals.
• Taking corrective measures.
• Documenting relevant findings and actions.
• Notifying competent authorities or affected individuals where required by applicable law.

Kagoma will handle incidents in accordance with the applicable legal requirements and relevant internal procedures.

Kagoma's website may contain links to third-party websites or use external services.

Those third parties may have their own privacy policies, terms, and data handling practices.

Kagoma is not responsible for the privacy practices of independent third-party websites or services that it does not control.

Users should review the applicable policies before providing personal data directly to those third parties.

Kagoma may update this Privacy Notice to reflect changes in its services, technology, business operations, or applicable legal requirements.

The latest version will be published on Kagoma's official website with its effective date and version number.

Where a change materially affects individuals' rights or the handling of their personal data, Kagoma will provide appropriate notice or take other steps required by applicable law.

Continued use of a service does not automatically constitute consent to processing where separate consent is legally required.

For questions, requests, or complaints concerning this Privacy Notice or the handling of personal data, please contact:

KAGOMA PROTECTIONS SERVICES LTD
Mushumbamwiza, Rwimbogo, Nyarugunga, Kicukiro, Kigali, Rwanda.

Email: info@kagomaprotection.com

Please use the subject line “Personal Data Protection Request” when contacting us about your privacy rights.