Data Processing Agreement

1. Parties and purpose

This Data Processing Agreement ("DPA") forms part of the CURUZA Terms of Service between you and CURUZA. It applies whenever CURUZA processes personal data on behalf of your shop under Rwanda's Law No 058/2021 relating to the Protection of Personal Data and Privacy (the "DPP Law").

You (the shop owner) are the Data Controller for the personal data your shop collects — for example, the phone numbers of your credit customers or the names of your team members. CURUZA is the Data Processor: we process this data solely to provide the CURUZA Service to you, in line with your instructions and this DPA.

2. Categories of data we process for you

Team member information: names, phone numbers or emails, and role of the staff you add to your shop.

Customer information: names, phone numbers and outstanding balances of any credit customers you record.

Business records: your products, prices, purchases, sales, expenses and reports.

Payment information (if you use Mobile Money): the phone number used and the payment status. We do not receive or store Mobile Money PINs.

3. Our commitments as Data Processor

Purpose limitation: We process your data to operate the CURUZA Service — such as showing you your data, running reports, and sending you notifications — and to produce aggregated, anonymized market insights as described below. We do not use your data for any other purpose without your explicit instruction.

Confidentiality: Our staff and contractors who access your data are bound by confidentiality obligations at least as strict as those in this DPA.

Security: We apply appropriate technical and organisational measures — including hashed credentials, TLS-encrypted connections, role-based access within each shop, tenant isolation, and audit logs — to protect your data against unauthorised access, loss or alteration.

Assistance with your obligations: We help you respond to requests from individuals exercising their rights under the DPP Law (access, correction, deletion) and to meet your own security and breach-notification obligations to the extent this is reasonably within our control.

4. Aggregated, anonymized insights

In addition to processing your data to operate the Service, we combine transaction information across all shops into aggregated, anonymized statistics describing overall retail trends (for example, category demand over time across many shops).

This aggregate processing never identifies your shop, never exposes your individual records, prices, or customers, and is produced only where enough shops are combined that no single shop can be re-identified. We may share or sell these aggregate, anonymized insights to third parties. Because the output is aggregated and anonymized, it no longer constitutes your identifiable personal or business data.

You consent to this aggregated, anonymized use as a condition of the Service. It is limited to aggregate patterns only — never your identifiable, raw, or shop-level data — consistent with our Privacy Policy.

5. Sub-processors

We rely on a small number of trusted providers to run the Service on our behalf. Each is bound by contractual terms comparable to this DPA.

Current sub-processors: Supabase (managed PostgreSQL database), Vercel (application hosting), Upstash (rate-limit storage), Resend (transactional email), Africa's Talking (SMS delivery), Sentry (error and crash reporting), and MTN Mobile Money (mobile-money payments).

We will notify you through the app of any material change to this list at least fourteen (14) days before it takes effect, so you may object if you have a reasonable ground to do so.

6. Cross-border transfers

Some of our sub-processors host data outside Rwanda. Where personal data is transferred out of Rwanda, we rely on lawful transfer mechanisms permitted under the DPP Law — including the sub-processor's certification schemes and standard contractual protections equivalent to those required under the DPP Law.

7. Security incidents

If we become aware of a personal data breach affecting your data, we will notify you without undue delay — typically within seventy-two (72) hours — describing what happened, the categories of data likely affected, and the steps we are taking. You remain responsible for notifying the National Cyber Security Authority (NCSA) and affected individuals as required by the DPP Law.

8. Deletion and retention

We keep your data for as long as your shop's account exists.

You can permanently delete your entire shop and its data at any time from Settings → Profile → Danger zone. This action is irreversible and removes the data from our active systems within thirty (30) days, subject to short-lived encrypted backups that are automatically overwritten within ninety (90) days.

9. Your rights and CURUZA's role

As Data Controller you remain responsible for lawfully collecting the personal data of your team members and customers, and for the choices you make in the Service (for example, whether to record a customer's phone number).

As Data Processor, CURUZA will not sell your identifiable, shop-level data and will not disclose one shop's records to another. The only exception is the aggregated, anonymized insights described above, which no longer identify your shop. We will act only on your documented instructions — which include your use of the Service in the ordinary way and any specific requests you make in writing.

10. Term and precedence

This DPA is effective as long as your account exists. If any provision of this DPA conflicts with the Terms of Service or Privacy Policy on a data-protection matter, this DPA prevails.

11. Contact and complaints

For any data-protection question, request or complaint, contact us at [email protected]. You also have the right to lodge a complaint with the National Cyber Security Authority of Rwanda if you believe your rights under the DPP Law have been infringed.