Privacy Policy — Gishwati Farms
Last updated: 1 September 2026
Gishwati Farms ("we," "us," "our") respects your privacy. This Privacy Policy explains what personal data we collect when you use gishwatifarms.rw (the "Site"), why we collect it, how we protect it, and the rights you have over it, in accordance with Rwanda's Law No. 058/2021 Relating to the Protection of Personal Data and Privacy.
This Policy should be read alongside our Terms and Conditions.
1. Who We Are
Gishwati Farms, operating in Rwanda, with address Ngoma, Northern Province, Rwanda, is the data controller responsible for your personal data.
Contact for privacy matters:
- Email: gishwatifarms10@gmail.com
- Phone: +250 788 465 258
2. Personal Data We Collect
| Category | Examples | When collected |
|---|---|---|
| Identity & contact data | Name, email address, phone number | Account creation, checkout |
| Delivery data | Delivery address, delivery notes | Checkout |
| Order data | Products purchased, order history, order notes | Every order |
| Payment-related data | Mobile Money phone number, provider (MTN or Airtel), transaction reference | Checkout, via our payment partner PawaPay |
| Account data | Login credentials, account preferences | Account registration |
| Technical data | IP address, browser/device information, pages visited | Automatically, via normal use of the Site |
| Support communications | Anything you tell us when contacting customer support | When you contact us |
We do not collect or store your Mobile Money PIN or full financial account details. Payment approval happens directly between you, your Mobile Money provider, and our payment processor, PawaPay — we only receive confirmation of payment status and a transaction reference.
3. How We Use Your Personal Data
| Purpose | Legal basis |
|---|---|
| Processing and fulfilling your order, arranging delivery | Performance of a contract with you |
| Payment processing via PawaPay | Performance of a contract with you |
| Sending order confirmations and delivery updates | Performance of a contract with you |
| Responding to customer support requests | Performance of a contract with you / our legitimate interest in resolving your query |
| Maintaining accounting and tax records | Compliance with a legal obligation |
| Preventing fraud and securing the Site | Our legitimate interest in protecting the business and our customers |
| Sending marketing communications (only if you opt in) | Your consent — you can withdraw it at any time |
We do not use your personal data for any purpose incompatible with the reasons it was collected, and we do not sell your personal data.
4. Who We Share Your Personal Data With
We share personal data with service providers who help us operate the Site and fulfil your orders, strictly for those purposes:
- PawaPay — to process Mobile Money payments and refunds.
- Supabase — to store order, account, and product data.
- Vercel — to host and serve the Site.
- Resend — to send order confirmations and account-related emails.
- Cloudinary — to store and serve product images.
- Our delivery team or a delivery partner we appoint — to deliver your order.
We require these providers to protect your data and use it only for the services they provide us. We may also disclose personal data where required by Rwandan law or to a competent authority.
5. Where Your Data Is Stored — International Transfers
Some of our service providers may process or store personal data outside Rwanda as part of providing their services to us. Where this occurs, we rely on it being necessary for the performance of our contract with you (for example, processing your payment or hosting the systems needed to deliver your order), or on your consent, consistent with Rwandan data protection law. We take steps to ensure any provider handling your data outside Rwanda maintains an appropriate level of protection.
6. Data Retention
We keep personal data only for as long as necessary for the purposes described in this Policy, including:
- Order and payment records, for as long as required for accounting, tax, and audit purposes under Rwandan law.
- Account data, for as long as your account remains active, plus a reasonable period afterward to resolve any outstanding issues.
When personal data is no longer needed, we delete or anonymise it.
7. Data Security
We take reasonable technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, and disclosure, including access controls and encryption of data in transit. No system is completely secure, and we continually review our safeguards as required under Rwandan data protection law.
8. Your Rights
Under Rwandan data protection law, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete personal data.
- Delete your personal data, where applicable.
- Withdraw your consent at any time, where processing is based on consent (for example, marketing emails), without affecting the lawfulness of processing carried out before withdrawal.
- Lodge a complaint with Rwanda's Data Protection and Privacy Office (operating under the National Cyber Security Authority, the law's designated supervisory authority) if you believe your data has been mishandled.
To exercise any of these rights, contact us using the details in Section 1. We will respond in accordance with the timeframes required under Rwandan law.
9. Cookies and Similar Technologies
The Site uses essential cookies only — for example to keep you signed in, remember your theme, and remember items in your cart. We do not currently use non-essential tracking or advertising cookies.
10. Children's Privacy
The Site is not directed at, and we do not knowingly collect personal data from, individuals under 18 years of age.
11. Data Breach Notification
In the event of a personal data breach that affects you, we will notify Rwanda's Data Protection and Privacy Office within the timeframe required by law and, where the breach is likely to result in a high risk to your rights, notify you directly without undue delay.
12. Changes to This Policy
We may update this Privacy Policy from time to time, including to reflect changes in the law or in how we operate. We will update the "Last updated" date above when changes are made. Material changes will be communicated in a way that gives you a reasonable opportunity to review them.
13. Contact Us
For any questions about this Privacy Policy or how we handle your personal data, contact us at gishwatifarms10@gmail.com.
You may also contact Rwanda's Data Protection and Privacy Office directly at dpo.gov.rw.