Legal review required. The text below is a working draft. Have a qualified Rwandan attorney verify and finalise every clause before publishing.

Who we are

TAP is an online marketplace operated from Kigali, Rwanda. In this policy, "TAP", "we", "us" and "our" refer to TAP. We are the data controller for the personal data we collect through this website and our pickup counters.

What data we collect

We collect personal data you give us when you place an order, contact us, sign up for marketing, or visit our site:

• Identity and contact data — name, phone number, email, delivery address.
• Order data — products purchased, prices, payment method, delivery preferences.
• Payment data — handled by our payment processors (DPO, Mobile Money providers); we do not store card numbers on our servers.
• Technical data — IP address, browser type, device, pages visited, referrer.
• Marketing preferences — your communication choices.

How we use your data

We process personal data to:

• Fulfil your orders, deliver them, and handle returns or warranty claims.
• Communicate about your orders by SMS, WhatsApp, and email.
• Improve our website, catalog, and customer experience.
• Send marketing messages — only with your consent — that you can opt out of any time.
• Comply with our legal obligations under Rwandan law.

Lawful basis for processing

We process your personal data on one of these lawful bases under Law N° 058/2021: performance of the contract you enter when placing an order; your explicit consent (for marketing and non-essential cookies); our legitimate interests (fraud prevention, service improvement); and compliance with applicable Rwandan laws.

Sharing with third parties

We share data only with parties that help us run the business:

• Couriers — name, phone, and delivery address only.
• Payment processors — DPO Group, MTN MoMo, Airtel Money, and card networks for the transaction itself.
• Hosting and analytics providers — under data-processing agreements that prohibit independent use.
• Authorities — where required by Rwandan law or court order.

We never sell your personal data.

Data retention

We keep order and customer data for as long as needed to fulfil the order, support warranties and returns, and meet our tax and accounting obligations under Rwandan law (typically up to 10 years for financial records). Marketing data is kept only while your consent is active.

Your rights

Under Rwandan data protection law, you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to erase your data, subject to our legal retention duties.
• Object to or restrict certain processing.
• Receive a copy of your data in a portable format.
• Withdraw any consent you previously gave.
• Lodge a complaint with the National Cyber Security Authority (NCSA) of Rwanda.

To exercise any of these rights, email us at . We respond within 30 days.

Security

We use HTTPS across the site, encrypt sensitive data in transit and at rest, and limit internal access on a need-to-know basis. Payment card data is handled exclusively by PCI-DSS compliant processors.

Cookies

For details on the cookies we use and how to control them, see our Cookies Policy.

Cross-border transfers

Some of our service providers (analytics, hosting) may process data outside Rwanda. We use providers that offer recognised safeguards under Rwandan law for any cross-border transfer.

Changes to this policy

We may update this policy from time to time. The "Effective" date at the top of the page reflects the most recent version. Material changes will be notified by email or a prominent notice on this page.

Contact

Questions about this policy or about how we handle your personal data: . Postal address: TAP, .