Privacy Policy

NPTEX Ltd (TIN 111798628, Kanombe, Kigali) is the controller for personal data of dashboard users, and a processor for the personal data of a Merchant’s customers processed on that Merchant’s behalf. This policy follows Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy.

• Account data: name, email, role, sign-in times, consent records, IP address and browser information.
• Payment data: amounts, phone numbers or card details handled by our providers, provider references and payment status. Full card numbers never reach our systems.
• Business data: Merchant identity and settlement account details.
• Technical data: logs and security events needed to run and protect the Services.

• To provide the Services: process payments, payouts and refunds, keep balances, and reconcile with providers.
• To meet legal duties: record keeping, anti-fraud and anti-money-laundering checks, and requests from authorities.
• To keep accounts secure: authentication, “Remember me” sessions, fraud and abuse detection.
• To communicate with you about your account and changes to our terms.

Payment service providers and financial institutions that process each transaction (for example mobile money operators and card acquirers), hosting and infrastructure providers under contract, and authorities where the law requires it. We do not sell personal data.

Data is hosted in secure data centres. Where data is transferred outside Rwanda, we do so only with the safeguards required by law.

Transaction and ledger records are kept for the period required by financial regulations (at least 10 years). Account and security logs are kept for as long as needed to operate the Services and investigate incidents, then deleted or anonymised.

Encryption in transit and at rest for credentials and secrets, hashed passwords and API keys, role-based access, an append-only audit log, and masking of phone and account numbers in logs.

You may request access to, correction of, or deletion of your personal data, object to processing, and withdraw consent where processing relies on it. Some records cannot be deleted while the law requires us to keep them. You may also complain to the National Cyber Security Authority.

The dashboard uses strictly necessary cookies only: your session, “Remember me” (up to 30 days when you choose it), and your test or live mode preference. We do not use advertising cookies.

privacy@cyrenes.io · NPTEX Ltd, Kanombe, Kigali, Rwanda