Rwanda Privacy Centre

Introduction

This privacy notice provides information about how we use and share personal data relating to consumers who contact us with an enquiry, request or complaint. You can find more detailed information at the TransUnion Privacy Centre or in other privacy information you may have received.

In Brief

When you contact us with a request, complaint or enquiry, we will use your personal data in order to help us respond to you.

Sometimes this will mean sharing personal data with third parties. For example, if you dispute the accuracy of information in your credit report, we may need to contact the organisation who provided us with that information to check whether it is correct.

This notice covers the following topics:

1. Who we are and how to contact us
2. How we use personal data
3. The kinds of personal data we use and where we get personal data
4. How long we keep personal data
5. Our legal basis for handling personal data
6. Who we share personal data with
7. How we protect personal data
8. Where we store and send personal data
9. Your rights concerning your personal data
10. Where to lodge a complaint
11. Changes to this privacy notice

1.  Who we are and how to contact us

Information for Good^®

We are in an era of rapid digital transformation where consumers demand more access to seamless, personalised products and services online. But the currency of personal data that fuels this platform economic boom poses threats to individuals and endangers corporate security.

Now more than ever — and likely more so in the future — consumers and corporates need new levels of trust and transparency.

As a global information and insights company, TransUnion seeks to make trust possible. We do this by curating an accurate and comprehensive picture of each consumer, so they are safely and reliably represented in the marketplace. This enables businesses and consumers to transact with confidence and achieve great things. We call this Information for Good.

We're a group of companies with registered offices at TransUnion, Plot 6 Junction of KN 67 & KN 30 3rd Floor BPR House-PCD Tower.  Although we are part of a larger group, this notice covers only the activities of TransUnion companies within the Republic of Rwanda.

Contact details

Contact us about personal data issues, including the contents of this notice via:

• Post: P.O Box 5733 Kigali
• Telephone:   +250 7889 33094
• Email: DPORwanda@transunion.com

2.  How we use personal data

Enquiries

We use your personal data to deal with any issue or complaint you have raised (which we refer to as an “enquiry”). This might include contacting you for more information or telling you the outcome of your enquiry. Typical enquiries include:

• Requests for access to personal data, to challenge the accuracy of personal data, or to request the erasure of personal data
• Support requests for our consumer products
• Complaints of any nature
• General enquiries

Identity verification

When you contact us, we may need to verify your identity to ensure we do not provide personal data to unauthorised parties.

Example: identity verification

If someone contacts us and asks us for a copy of your credit report, we’ll check that it’s you (or someone authorised by you) asking for it. We may ask for evidence of identity such as copies of your driving license or a bank statement.

Itis important to do this because the information in your credit report is valuable and could be used to impersonate you if it were to fall into the wrong hands.

Feedback

We may ask you to provide us with feedback or to leave a review about the service you received. Your feedback helps us improve our services.

Products and services

We use aggregated statistics about enquiries, requests and complaints to help manage our services and identify potential problems. Some enquiries lead to changes to the personal data we use in our products and services.

Constant improvement

We use information from complaints and requests to help understand what went wrong, fix any problems, and improve how we deal with similar issues.

Legal and regulatory purposes

We may use personal data for legal and regulatory purposes. This might include responding to complaints or enquiries from you or a regulator about how we have handled your enquiry or used your personal data.

3.  The kinds of personal data we use and where we get personal data

We obtain and use information from various sources summarised in the following table:

You are free to choose whether you give us your personal data. However, if you do not provide the information we need, this may limit our ability to help.

4.  How long we keep personal data

We keep your personal data during the enquiry and for an additional period after completion. That period depends on purposes, such as:

• Showing we have processes to deal with enquiries and are doing so fairly under our regulatory requirements
• Responding to you or a regulator to show we dealt with an enquiry properly
• Defending legal claims or regulatory action that might arise because of the enquiry

5.  Our legal basis for handling personal data

Legitimate interests

The Law relating to the protection of personal data and privacy allows personal data usage where necessary for legitimate purposes without undue adverse impact. We base most of our processing activities on the 'legitimate interests' condition. For more details, refer to the relevant privacy notices in the links above.

6.  Who we share personal data with

Clients

Our clients have privacy notices that provide more information about how they use the data we supply. These clients typically operate in the following sectors:

• Banks, Microfinance institutions and SACCOs
• Traders
• Insurance
• Retail
• Telecommunications
• Collections
• Employment agencies
• Financial services
• Public sector
• Startup

If our clients appoint an intermediary to act on their behalf, they too will receive the data.

Service providers

We may provide information to third parties who help us use it for purposes described for example:

• Cloud-based services, such as Salesforce, help host, manage and analyse our databases.
• Cloud-based technologies, such as Microsoft Office 365, support our ordinary business operations.
• Printing companies to produce and send direct mail or other correspondence.
• Payment service providers to help with payments made by individuals.
• Market research companies to help us better understand our customers.
• A specialist sub-contractor operates our CCTV system.
• Services Providers that assist us with providing our services to you.
• Regulators like the National Cyber Security Authority or the National Bank of Rwanda.

Data suppliers and other third parties

If an enquiry or complaint relates to information supplied to us by a third party, we may share relevant personal data with that data supplier or third party to investigate and resolve the matter. For example, where a consumer disputes the accuracy of information on their credit report, we may contact the organisation that supplied that information to verify its accuracy. 

Such third parties may not use personal data for their own purposes or on behalf of other organisations unless the consumer has agreed otherwise or the law permits it. 

7.  How we protect personal data

We implement appropriate and reasonable technical and organisational measures to safeguard the personal data of individuals who contact us with enquiries, requests, or complaints. These measures are designed to protect personal data against loss, unauthorised access, misuse, disclosure, alteration, or destruction.

Access to personal data is restricted to authorised personnel who require such information to respond to the enquiry or resolve the matter. We regularly review and update our security safeguards to ensure the continued confidentiality, integrity, and availability of personal data, and to maintain compliance with Law No. 058/2021 of 13/10/2021 relating to the Protection of Personal Data and Privacy in Rwanda, as well as any applicable regulations and guidance issued by the competent supervisory.

8.  Where we store and send personal data

We may, from time to time, make use of trusted service providers that are located outside the Republic of Rwanda, including in Kenya, South Africa, the United Kingdom, and the United States. Although our operations are based in Rwanda, your personal data may be accessed or processed from these jurisdictions where necessary to provide our services.

We will not transfer personal data to a country that does not ensure an adequate level of protection for personal data, unless appropriate safeguards are in place. These safeguards include contractual agreements with the recipient that require the implementation of measures providing a level of protection comparable to that required under Law No. 058/2021 of 13/10/2021 relating to the Protection of Personal Data and Privacy in Rwanda, and, where applicable, obtaining the prior authorisation of the competent supervisory authority.

9.  Your rights concerning personal data

We outline your rights regarding the personal data we hold about you below.

Access: You can access all information that we hold about you by contacting us through DPORwanda@transunion.com

Correction/Destruction/Deletion: If the information we hold about you is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, you have a right to ask us to correct it or delete it.

Objection to processing: You may object (on reasonable grounds) to processing your personal data unless legislation provides for such processing.

Objection to direct marketing: You may object to us using your personal data for direct marketing, and if you do, we will stop.

10.   Where to lodge a complaint

We strive to deliver the highest levels of customer service. However, if you’re ever unhappy with us, please contact us so we can investigate.

• Location: 3rd Floor of Alliance Tower, BPR Building, Plot No 6 Junction of KN 67 & KN  30,Nyarugenge District, Kigali – Rwanda
• Postal Address: 5733 Kigali- Rwanda
• Telephone: +250 7889 33094
• Email: DPORwanda@transunion.com

You may complain to the Data Protection and Privacy Office at: -

• Location: Street 21 KG 7 Ave, Kacyiru, A&P Building, Ground Floor, Kigali – Rwanda.
• Toll Free number: 9080
• Website: https://dpo.gov.rw/contact-us/
• E-mail: complaint@dpo.gov.rw and copy dpp@ncsa.gov.rw

11.  Changes to this privacy notice

We may update this Privacy Notice from time to time to reflect changes in our practices, legal requirements, or operational needs. Where material changes are made, we will take reasonable steps to inform individuals, which may include updating this notice on our website or communicating changes through appropriate channels. 

The most current version of this Privacy Notice will always be available, and the effective date at the bottom of the notice indicates when the latest version came into effect. 

Effective date: May 2026