Privacy Policy

Last updated 10 November 2026

Who we are

The controller of your personal data is Invest Bulgaria Group EOOD, a company registered in Bulgaria that publishes InvestRwanda.com and its business directory. InvestRwanda.com is an independent site. It is not affiliated with the Government of Rwanda or the Rwanda Development Board.

Company number

131238011 (Bulgarian Commercial Register)

Registered address

5 Hristo Kovachev Str., Sofia 1527, Bulgaria

Privacy contact

contact@investrwanda.com

For any question about this policy or your data, write to contact@investrwanda.com or use the contact form. We answer in English or French.

Which laws apply

• Rwanda. Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy applies to anyone who processes personal data of people located in Rwanda, including organisations established abroad (Article 2). Its supervisory authority is the National Cyber Security Authority (NCSA).
• The European Union. Because we are established in Bulgaria, the General Data Protection Regulation (EU) 2016/679 applies to everything we do with personal data. Its supervisory authority for us is the Bulgarian Commission for Personal Data Protection.

Where the two laws differ, we follow the rule that protects you more.

Data we collect

When you send us a message

The contact form asks for your name and email address, optionally your company and country, the topic you choose and your message. Please do not include sensitive information, such as health data or identity documents.

When you create an account

We ask for your name, email address and a password. The password is stored only in scrambled (hashed) form, so nobody at InvestRwanda.com can read it.

When you add or manage a company listing

We keep the company details you enter: its name, description, address, phone number, website, logo, sector and, if you give it, the name of its managing director. To show that you may manage a listing, we record your role at the company and anything you tell us to prove it.

When you contact a company through the directory

The enquiry form asks for your name, email address, optionally your country, and your message. We first email you a link to confirm the address. The message waits on our server for up to 48 hours and is deleted if you do not confirm it.

When you report a listing

We record the reason you choose, your comment and, if you want a reply, your email address.

When you buy a membership or an advertisement

We keep the invoice details you give us (company name, address, country, tax number and the email address for invoices), the plan, the amounts and the payment status. Card and PayPal payments are handled by Stripe and PayPal; we never see or store card numbers.

When you visit the website

Like any website, our server processes technical data needed to deliver pages and keep the site secure: your IP address, browser type, the pages requested and the time of the request. We use the IP address to limit repeated form submissions and protect the site against abuse.

We do not use analytics, advertising or social media tracking. Fonts and images are served from our own server, so opening a page does not send your data to other providers.

Why we use it

Each use has a legal basis under Article 46 of the Rwandan law and Article 6 of the GDPR:

• Answering your message, for example about a listing, a membership or advertising: your consent, given when you send the form (Rwanda Article 46, 1°; GDPR Article 6(1)(a)), and, where you ask about our paid services, steps you ask for before a contract (46, 2°; 6(1)(b)).
• Running your account, your listing and your membership, including emails about them, invoices and renewal reminders: the contract with you (46, 2°; 6(1)(b)).
• Keeping invoices and accounting records: our legal obligations (46, 3°; 6(1)(c)).
• Passing your enquiry to a company: your consent, given when you tick the box on the form (46, 1°; 6(1)(a)).
• Publishing the business directory and keeping it accurate, and securing the website against spam and abuse: our legitimate interests (46, 7°; 6(1)(f)).

You can withdraw your consent at any time (Rwanda Article 8; GDPR Article 7(3)). This does not affect what was done before. We do not sell personal data, and we do not use it for automated decisions or profiling that have legal or similar effects on you.

The business directory

The directory shows information about companies: name, description, address, phone number, website, logo and, where the company provides it, the name of its managing director. We do not publish email addresses or the names of contact people.

Our editors gather listings from the companies’ own websites and from public registers and professional associations, and check them before publishing. Business contact details can still relate to a person. We keep them to run an accurate directory, based on our legitimate interests. If you are named in a listing, you can ask us to correct or remove your details at any time.

Enquiries. When you confirm a message sent from a company’s page, we email your name, email address, country and message to that company so it can reply to you directly. We do not keep a copy of the message on the website; we count only how many enquiries each company receives.

The site assistant

The help bubble (Ask InvestRwanda) answers questions about investing, living and doing business in Rwanda and links to the matching pages and listings. Its answers are written by an AI model. They can be wrong and are not legal, tax or financial advice.

What is sent. Our server sends the text of your question, the title of the page you are on, the site language and your previous few questions and answers in the same conversation to DeepSeek, the AI provider that writes the answer. We do not send your name, email address, IP address or account details. Please do not type personal details into the assistant.

Where it is processed. DeepSeek is operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and processes data in the People’s Republic of China. Using the assistant is optional: you can use the site search or write to us instead.

What we keep. A log of the questions, the language and the suggested links for 30 days, without IP addresses, to check the answers and prevent abuse. Your IP address is used only briefly to limit the number of questions per visitor. The conversation itself stays in your browser for the current tab and is deleted when you close it or press Start again.

Who receives it

• Our team, who read and answer messages and review listings.
• Our hosting provider, WHG Hosting Services Ltd, which runs the servers for the website and its email in London, United Kingdom.
• Payment providers: Stripe and PayPal, only when you pay through them.
• Translation: the texts of company listings and offers can be translated between English and French by DeepL SE (Germany). Messages from visitors are not sent.
• The site assistant: DeepSeek, as described above.
• Directory companies, only when you send them an enquiry.
• Public authorities, only where the law requires it.

Hosting, payment and translation providers act under their own data processing terms and receive only what their service needs.

Where it is stored

The website, its database and its email run on servers in London, United Kingdom. The United Kingdom is covered by an adequacy decision of the European Commission. Payments are processed by Stripe and PayPal in their own data centres, translation by DeepL in the European Union, and the assistant’s questions by DeepSeek in China.

Under the Rwandan law, data about people in Rwanda may be shared outside Rwanda with your consent, where it is needed for a contract with you or for steps you ask for before one, or with the authorisation of the supervisory authority (Article 48).

How long we keep it

• Messages to us: they arrive by email and are kept in our mailbox for up to 24 months after our last contact with you, unless they lead to a contract.
• Accounts: until you ask us to close the account.
• Directory enquiries: not stored once sent; an unconfirmed message is deleted after 48 hours.
• Reports about listings: up to 24 months after they are dealt with.
• Requests to manage a listing: while you manage the listing, and up to 24 months after a request is declined.
• Invoices and payment records: for the period Bulgarian accounting and tax law requires.
• Site assistant questions: 30 days, without IP addresses.
• Server and security logs: only as long as needed to run and protect the website.

Security

Pages are served only over an encrypted connection, passwords are hashed and access to the administration area is limited to our team. If a breach puts your data at risk, we will tell the supervisory authorities within the time the law sets (within 48 hours to the NCSA under Article 43 of the Rwandan law) and inform you when the risk to you is high.

Cookies

We set only the cookies the site needs to work, and no analytics or advertising cookies. The cookies page lists each one and how long it lasts.

Your rights

Under the Rwandan law (Articles 18 to 26) and the GDPR you have the right to:

• know what personal data we hold about you, why, where it came from and who received it, and get a copy;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, for example when it is no longer needed or you withdraw your consent;
• restrict how we use your data while a question about it is checked;
• object to processing based on our legitimate interests, and to direct marketing at any time;
• receive the data you gave us in a structured, readable format, or have it sent to another organisation;
• not be subject to a decision based only on automated processing;
• under the Rwandan law, name an heir to your personal data and act through a representative;
• withdraw your consent at any time.

To use any of these rights, write to contact@investrwanda.com. We reply within 30 days, and may ask you to confirm your identity first.

Complaints

If you think we have not handled your data properly, please tell us first so we can put it right. You can also complain to a supervisory authority:

• In Rwanda: the Data Protection and Privacy Office of the National Cyber Security Authority (NCSA), A&P Building, 21 KG 7 Ave, Kacyiru, Kigali, complaint@dpo.gov.rw, dpo.gov.rw. If you are not satisfied with our reply to a request, you can appeal to it within 30 days of receiving the reply.
• In Bulgaria: the Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, kzld@cpdp.bg, or the authority of the EU country where you live or work.

Children

The website is meant for investors and businesses. It is not aimed at children under 16, and we do not knowingly collect their data. If you think a child has sent us personal data, please tell us and we will delete it.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows the latest version. If a change affects how we use data you have already given us, we tell account holders by email first.