**Data Controller:** InMyLocus Ltd, a private limited liability company incorporated under the laws of the Republic of Rwanda, registered office at KN 80 St, Kigali, Rwanda, Rwanda Development Board registration number **REG-2023-2073229**, Taxpayer Identification Number (TIN) **121632599** ("**InMyLocus**," "**we**," "**us**," or "**the Company**").
**Document status:** Version 1.0 | Drafted: 28 August 2026 | Effective Date: **[TO BE INSERTED UPON PUBLICATION]**
**Important preliminary notice:** This Privacy Policy has been drafted to give effect to InMyLocus's obligations under Law N° 058/2021 of 13/10/2021 Relating to the Protection of Personal Data and Privacy (the "**Data Protection Law**"), which is supervised in Rwanda by the National Cyber Security Authority (**NCSA**) through its Data Protection and Privacy Office. **This document should be reviewed and certified by a licensed Rwandan advocate, and InMyLocus's own registration as a data controller with the NCSA should be confirmed and its registration number inserted at Article 3, before publication.** Registration of data controllers and processors with the NCSA is mandatory under the Data Protection Law.
---
## KEY POINTS (PLAIN-LANGUAGE SUMMARY)
*This summary is provided for accessibility and does not replace the full Policy below, which governs in the event of any inconsistency.*
- We collect the data needed to run a trust-based marketplace: your identity and verification details, your listings and transaction history, your messages with other Users, your location when relevant to a Service, and technical data about how you use the app.
- We do not sell your personal data to third parties for their own marketing purposes.
- Your payment details are handled by our licensed Payment Partners (Flutterwave Rwanda Limited, Paystack Rwanda Limited, MTN Rwandacell Limited, and Equity Bank Rwanda Limited) under their own security standards — InMyLocus does not store your full card number.
- Your personal data is stored in Rwanda by default. It is only stored or transferred outside Rwanda where the Data Protection Law permits this, including where the NCSA has authorised us to do so.
- You have rights over your data, including the right to access, correct, delete, and export it, and the right to complain to the NCSA if you believe we have mishandled it.
- We keep your data only as long as we have a genuine reason to, and we tell you how to reach our Data Protection Officer if you have any concern.
---
## TABLE OF CONTENTS
1. Introduction and Scope
2. Definitions
3. Who We Are — The Data Controller
4. The Personal Data We Collect
5. Special Category (Sensitive) Personal Data
6. Sources From Which We Collect Personal Data
7. The Lawful Purposes for Which We Process Personal Data
8. How We Use Your Personal Data
9. Automated Decision-Making, Profiling, and Artificial Intelligence
10. Who We Share Your Personal Data With
11. International and Cross-Border Data Transfers
12. Data Localisation
13. Data Retention
14. Data Security
15. Your Rights as a Data Subject
16. How to Exercise Your Rights
17. Children and Minors
18. Cookies and Similar Technologies
19. Marketing Communications
20. Data Breach Notification
21. The Data Protection Officer
22. Complaints to the Supervisory Authority
23. Changes to This Policy
24. Contact Information
---
## ARTICLE 1 — INTRODUCTION AND SCOPE
**1.1** This Privacy Policy explains how InMyLocus Ltd collects, uses, discloses, retains, and protects personal data in connection with the InMyLocus website, mobile applications, and related services (the "**Platform**"), and describes the rights available to individuals whose personal data we process (each a "**data subject**").
**1.2** This Policy applies to all Users of the Platform, including Buyers, Service Providers, Product Vendors, Job Seekers, Employers, and Freelancers, as those terms are defined in the InMyLocus Terms of Use, and to any other individual whose personal data InMyLocus processes in connection with operating the Platform, including individuals referred to within Content posted by a User.
**1.3** This Policy should be read together with the InMyLocus Terms of Use, Cookie Policy, and Data Protection Policy. Where a conflict arises between this Policy and any of those documents on a matter specifically addressed by this Policy, this Policy shall prevail in respect of that matter.
**1.4** This Policy is prepared with reference to Law N° 058/2021 of 13/10/2021 Relating to the Protection of Personal Data and Privacy, the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), ratified by Rwanda by Presidential Order N° 104/01 of 18/09/2019, and guidance issued by the NCSA's Data Protection and Privacy Office from time to time.
---
## ARTICLE 2 — DEFINITIONS
**"Consent"** means any freely given, specific, informed, and unambiguous indication of a data subject's wishes by which the data subject, by a statement or by clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
**"Data Controller"** means InMyLocus, being the entity that determines the purposes and means of the processing of personal data described in this Policy.
**"Data Processor"** means a natural or legal person, public authority, or other body that processes personal data on behalf of InMyLocus, including certain third parties described in Article 10.
**"Data Subject"** means the identified or identifiable natural person to whom personal data relates.
**"Personal Data"** means any information relating to an identified or identifiable natural person, including a name, an identification number, location data, an online identifier, or one or more factors specific to that person's physical, physiological, genetic, mental, economic, cultural, or social identity.
**"Processing"** means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, disclosure, combination, restriction, erasure, or destruction.
**"Sensitive Personal Data"** means personal data revealing racial or ethnic origin, political opinion, religious or philosophical belief, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, health data, or data concerning a natural person's sex life or sexual orientation.
**"Supervisory Authority"** means the National Cyber Security Authority (NCSA), acting through its Data Protection and Privacy Office, being the authority designated under the Data Protection Law to supervise the application of that Law in Rwanda.
Terms defined in the InMyLocus Terms of Use and not otherwise defined in this Article carry the same meaning in this Policy.
---
## ARTICLE 3 — WHO WE ARE — THE DATA CONTROLLER
**3.1** InMyLocus Ltd is the data controller responsible for the personal data described in this Policy, for the purpose of the Data Protection Law.
**3.2** InMyLocus is registered with the Rwanda Development Board under registration number REG-2023-2073229 and holds Taxpayer Identification Number 121632599. InMyLocus's registration as a data controller with the NCSA is recorded under registration number **[NCSA DATA CONTROLLER REGISTRATION NUMBER — TO BE INSERTED]**.
**3.3** Where InMyLocus expands its operations to jurisdictions beyond Rwanda, InMyLocus may act as data controller under the equivalent data protection legislation of that jurisdiction, and will identify itself accordingly within any jurisdiction-specific version of this Policy.
---
## ARTICLE 4 — THE PERSONAL DATA WE COLLECT
We collect the following categories of personal data, depending on how you use the Platform:
**4.1 Identity and account data.** Full name, date of birth, gender (where voluntarily provided), national identity document or passport number and a copy of that document, phone number, email address, physical or business address, profile photograph, and preferred language.
**4.2 Verification and credential data.** Documentation submitted for the tiered Verification system described in the Terms of Use, including professional licences, certifications, business registration documents, and, for regulated categories, confirmation of registration with the relevant professional body.
**4.3 Transaction and payment-related data.** Booking, order, and job application history; amounts paid or received; commission and fee records; Wallet balance and transaction ledger entries; and, to the limited extent InMyLocus itself processes it, payment method type and the last four digits of a payment card or mobile money number for the purpose of transaction confirmation. **Full payment card numbers, mobile money PINs, and full bank account credentials are collected and held by our Payment Partners under their own security standards, not by InMyLocus.**
**4.4 Location data.** Approximate or precise geolocation data, where you enable location services on your device or provide an address, used to show you relevant nearby Listings and to enable Service delivery.
**4.5 Communications and content data.** Messages exchanged with other Users through the Platform's messaging tools; Listings, reviews, ratings, and other Content you post; customer support correspondence; and voice or text input submitted to the AI needs-assessment feature.
**4.6 Technical and device data.** IP address, device identifiers, device type and operating system, browser type, mobile network information, app version, crash logs, and diagnostic data.
**4.7 Usage and analytics data.** Pages and screens viewed, search queries, categories browsed, features used, time spent on the Platform, click and interaction data, and referral source.
**4.8 Data about you from other Users.** Where another User submits a review about you, mentions you in a message, or includes information about you in a Listing (for example, an Employer describing a role you have been shortlisted for), InMyLocus processes that data as described in this Policy.
---
## ARTICLE 5 — SPECIAL CATEGORY (SENSITIVE) PERSONAL DATA
**5.1** In limited circumstances connected to specific categories on the Platform — including the Health Consulting, Veterinary Services, and certain Jobs categories — InMyLocus may process Sensitive Personal Data, for example health-related information a User voluntarily discloses when booking a Health Consulting session, or trade union or religious affiliation incidentally disclosed within free-text fields.
**5.2** Consistent with the Data Protection Law's requirement that Sensitive Personal Data be processed only with explicit consent or on another legitimate justification recognised by that Law, InMyLocus processes Sensitive Personal Data only where: (a) the data subject has given explicit consent for a specified purpose; (b) processing is necessary to protect the vital interests of the data subject or another natural person where the data subject is physically or legally incapable of giving consent; (c) the data subject has manifestly made the data public themselves; or (d) processing is otherwise necessary on grounds recognised under the Data Protection Law.
**5.3** InMyLocus does not require Users to disclose Sensitive Personal Data as a condition of using the Platform generally, and Users should avoid including Sensitive Personal Data in free-text fields (such as public reviews) where not necessary for the purpose of the transaction.
---
## ARTICLE 6 — SOURCES FROM WHICH WE COLLECT PERSONAL DATA
We collect personal data: (a) directly from you, when you register, complete your profile, submit a Listing, make a Booking or Order, apply for a job, or contact customer support; (b) automatically, through your use of the Platform, via cookies and similar technologies as described in our Cookie Policy; (c) from other Users, as described in Article 4.8; (d) from our Payment Partners, limited to confirmation of transaction status and the data necessary to reconcile payments; (e) from identity verification and credential-checking service providers we engage; and (f) from publicly available sources, where relevant to verifying a business registration or professional credential.
---
## ARTICLE 7 — THE LAWFUL PURPOSES FOR WHICH WE PROCESS PERSONAL DATA
Consistent with the Data Protection Law's requirement that personal data be collected for a lawful purpose connected to InMyLocus's activity, we process personal data on one or more of the following bases:
**7.1 Performance of a contract.** Processing necessary to create and administer your Account, to facilitate a Booking, Order, or job application, and to operate the Escrow and payout mechanisms described in the Terms of Use.
**7.2 Consent.** Processing for which we have obtained your specific consent, including certain marketing communications, use of precise location data, and processing of Sensitive Personal Data as described in Article 5.
**7.3 Legal obligation.** Processing necessary to comply with a legal obligation to which InMyLocus is subject, including tax reporting obligations, anti-money-laundering and counter-terrorist-financing obligations, and obligations to cooperate with the NCSA, the Rwanda Inspectorate, Competition and Consumer Protection Authority, or another competent authority.
**7.4 Legitimate interests.** Processing necessary for InMyLocus's legitimate interests in operating, securing, and improving the Platform, preventing fraud, enforcing the Terms of Use, and understanding how the Platform is used, provided always that such interests are balanced against, and do not override, your fundamental rights and freedoms.
**7.5 Vital interests.** Processing necessary to protect your vital interests or those of another natural person, in exceptional circumstances such as a safety emergency.
**7.6 Public interest.** Processing necessary for a task carried out in the public interest, where applicable.
---
## ARTICLE 8 — HOW WE USE YOUR PERSONAL DATA
We use the personal data described in Article 4 for the following purposes:
**8.1** To create, verify, and administer your Account, including operating the tiered Verification system.
**8.2** To operate the AI-assisted needs-assessment and matching functionality described in the Terms of Use, connecting your stated need to relevant Service Providers, Product Vendors, or job vacancies.
**8.3** To process Bookings, Orders, job applications, and payments, including operating Escrow, calculating commission, and administering the Cashback and Rewards Programme.
**8.4** To communicate with you about your Account, transactions, and matters relevant to your use of the Platform, via push notification, SMS, WhatsApp Business messaging, email, or in-app notification.
**8.5** To provide customer support and to investigate and resolve disputes between Users under the process described in the Terms of Use.
**8.6** To detect, investigate, and prevent fraud, abuse of the Cashback and Rewards Programme, breach of the Acceptable Use Policy, and other harmful or unlawful conduct.
**8.7** To comply with InMyLocus's legal, regulatory, and tax obligations, including obligations owed to the NCSA, the Rwanda Revenue Authority, and other competent authorities.
**8.8** To send you marketing communications, where you have consented to receive them, and to allow you to opt out at any time as described in Article 19.
**8.9** To conduct analytics, research, and product development intended to improve the Platform, generally on the basis of aggregated or de-identified data wherever practicable.
**8.10** To enforce the Terms of Use and to establish, exercise, or defend legal claims.
---
## ARTICLE 9 — AUTOMATED DECISION-MAKING, PROFILING, AND ARTIFICIAL INTELLIGENCE
**9.1** The Platform uses automated processing, including artificial intelligence and machine-learning models, to power the needs-assessment intake, to rank and recommend Service Providers, Product Vendors, and job vacancies to you, and to support fraud and trust-and-safety detection.
**9.2** These automated processes are designed to recommend and rank; **they do not make a final decision with legal or similarly significant effect on you without the possibility of human involvement.** Where InMyLocus's automated processing plays a material role in a decision affecting your Account — for example, an automated fraud flag leading to a proposed suspension under the Terms of Use — you may request human review of that decision by contacting InMyLocus using the details in Article 24.
**9.3** Where the Platform surfaces a recommendation or match to you, it endeavours to show you the general basis for that match (for example, proximity, rating, price fit, or language match), consistent with InMyLocus's commitment that automated recommendations should be explicable rather than an opaque "black box."
**9.4** You have the right, under Article 15, to object to processing based on automated means, including profiling, subject to the exceptions recognised under the Data Protection Law.
---
## ARTICLE 10 — WHO WE SHARE YOUR PERSONAL DATA WITH
We disclose personal data to the following categories of recipient, in each case limited to what is necessary for the purpose described:
**10.1 Other Users.** When you create a Listing, apply for a job, or complete a transaction, relevant profile information (such as your name, profile photo, rating, and, once a Booking or Order is confirmed, contact details necessary to fulfil it) is shared with the counterparty User. Full phone numbers may be masked within in-app calling and messaging tools where technically available.
**10.2 Payment Partners.** Flutterwave Rwanda Limited, Paystack Rwanda Limited, MTN Rwandacell Limited, and Equity Bank Rwanda Limited, each acting as an independent data controller in respect of the payment data they process, to the extent necessary to process a payment, operate Escrow, or make a payout.
**10.3 Identity and credential verification providers.** Third-party services engaged by InMyLocus to confirm the authenticity of identity documents and professional credentials submitted under the Verification system.
**10.4 Cloud hosting and infrastructure providers.** Providers hosting the Platform's infrastructure and databases, acting as data processors under contract with InMyLocus, and subject to the data localisation requirements described in Article 12.
**10.5 Professional advisers.** Lawyers, auditors, and other professional advisers, where necessary for InMyLocus to obtain professional advice or to comply with a legal obligation.
**10.6 Regulators and law enforcement.** The NCSA, the Rwanda Inspectorate, Competition and Consumer Protection Authority, the National Bank of Rwanda, the Rwanda Investigation Bureau, the Rwanda Revenue Authority, and other competent authorities, where InMyLocus is required or permitted by law to make such disclosure, including in response to a lawful request.
**10.7 Corporate transactions.** A prospective or actual acquirer, successor, or other party in connection with a merger, acquisition, financing, reorganisation, or sale of all or substantially all of InMyLocus's assets, subject to appropriate confidentiality safeguards.
**10.8 No sale of personal data.** InMyLocus does not sell personal data to third parties for their own independent marketing purposes.
---
## ARTICLE 11 — INTERNATIONAL AND CROSS-BORDER DATA TRANSFERS
**11.1** In accordance with the Data Protection Law, personal data is transferred outside Rwanda only where one of the following applies: (a) InMyLocus or the relevant recipient holds authorisation from the NCSA following proof of appropriate safeguards for the protection of personal data; (b) the data subject has given consent to the specific transfer; (c) the transfer is necessary for the performance of a contract between InMyLocus and the data subject, or for pre-contractual steps taken at the data subject's request; (d) the transfer is necessary on important public interest grounds; (e) the transfer is necessary for the establishment, exercise, or defence of a legal claim; (f) the transfer is necessary to protect the vital interests of the data subject or another person who is physically or legally incapable of giving consent; or (g) the transfer is necessary for InMyLocus's legitimate interests, subject to appropriate safeguards.
**11.2** Certain of InMyLocus's Payment Partners and infrastructure providers may process data outside Rwanda in the ordinary course of providing their regulated or contracted services. Where this occurs, InMyLocus will only rely on such arrangements where a basis described in Article 11.1 applies, and, where the transfer involves InMyLocus itself storing or causing personal data to be stored abroad on an ongoing basis, InMyLocus will hold or obtain the relevant NCSA registration certificate described in Article 12.
---
## ARTICLE 12 — DATA LOCALISATION
**12.1** In accordance with the Data Protection Law, InMyLocus stores personal data of Users within the Republic of Rwanda by default.
**12.2** Storage of personal data outside Rwanda is undertaken only where InMyLocus holds a valid registration certificate issued by the NCSA specifically authorising storage of personal data outside Rwanda, or where a recognised exception under the Data Protection Law applies.
**12.3** InMyLocus's cloud hosting and infrastructure arrangements are structured with this requirement in mind, and InMyLocus will update this Article to confirm the specific hosting location and, where applicable, the relevant NCSA certificate reference, once its infrastructure arrangements are finalised and confirmed by counsel.
---
## ARTICLE 13 — DATA RETENTION
**13.1** InMyLocus retains personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, tax, or reporting requirement.
**13.2** As a general guide, and subject to confirmation against the specific retention periods prescribed or recommended under Rwandan tax, company, and data protection law:
(a) **Account and profile data** is retained for as long as the Account remains active, and for a limited period thereafter (expected to be in the order of twelve (12) months) to allow for account recovery and to address any dispute, after which it is deleted or irreversibly anonymised, save where a longer period is required by Article 13.2(b) or (c).
(b) **Transaction, payment, and tax-relevant records** are retained for the period required under applicable Rwandan tax and accounting law, which InMyLocus currently expects to be no less than five (5) years from the date of the relevant transaction, subject to confirmation by counsel.
(c) **Verification and credential documentation** is retained for the duration of the relevant Verification Tier's validity and for a reasonable period thereafter for audit and dispute-resolution purposes.
(d) **Communications and support records** are retained for a period sufficient to resolve any related dispute and to comply with Article 13.2(b), typically not exceeding three (3) years from the date of the relevant communication.
(e) **Marketing consent records** are retained until you withdraw consent, and a record of that withdrawal is retained thereafter to evidence compliance with your instruction.
**13.3** Where InMyLocus no longer has a lawful purpose for retaining personal data, it will securely delete or anonymise that data, save where retention is required to comply with a legal obligation, to resolve a dispute, or to enforce InMyLocus's agreements.
---
## ARTICLE 14 — DATA SECURITY
**14.1** InMyLocus implements technical and organisational measures appropriate to the risk presented by its processing activities, consistent with the security obligations set out in the Data Protection Law, including: encryption of personal data in transit and, where appropriate, at rest; role-based access controls limiting internal access to personal data to personnel who require it for their function; secure authentication mechanisms for Accounts; logging and monitoring of access to sensitive systems; regular security testing; and incident response procedures.
**14.2** No system is completely secure, and InMyLocus cannot guarantee the absolute security of personal data. You are responsible for maintaining the confidentiality of your own Account credentials as described in the Terms of Use.
**14.3** Further detail on InMyLocus's internal security governance is set out in the companion Data Protection Policy.
---
## ARTICLE 15 — YOUR RIGHTS AS A DATA SUBJECT
Subject to the conditions and exceptions set out in the Data Protection Law, you have the following rights in respect of your personal data:
**15.1 Right to be informed.** The right to be informed, in a concise, transparent, and easily accessible form, of how your personal data is processed, which this Policy is intended to satisfy.
**15.2 Right of access.** The right to obtain confirmation of whether InMyLocus processes personal data concerning you, and, where it does, to obtain a copy of that data and specified information about the processing.
**15.3 Right to rectification.** The right to request that InMyLocus correct inaccurate personal data concerning you, or complete incomplete personal data.
**15.4 Right to erasure.** The right to request that InMyLocus delete personal data concerning you, subject to the exceptions recognised under the Data Protection Law, including where retention is necessary to comply with a legal obligation or to establish, exercise, or defend a legal claim.
**15.5 Right to restrict processing.** The right to request that InMyLocus restrict the processing of your personal data in specified circumstances, including while the accuracy of that data is contested.
**15.6 Right to object.** The right to object, on grounds relating to your particular situation, to processing based on InMyLocus's legitimate interests, and the unconditional right to object to processing for direct marketing purposes at any time.
**15.7 Right to data portability.** The right, where technically feasible and where the processing is based on consent or on the performance of a contract, to receive personal data you have provided to InMyLocus in a structured, commonly used, and machine-readable format, and to have that data transmitted to another controller.
**15.8 Right to withdraw consent.** Where processing is based on your consent, the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
**15.9 Right in relation to automated decision-making.** The rights described in Article 9.
**15.10 Right to lodge a complaint.** The right to lodge a complaint with the NCSA, as described in Article 22.
---
## ARTICLE 16 — HOW TO EXERCISE YOUR RIGHTS
**16.1** You may exercise any of the rights described in Article 15 by contacting InMyLocus using the details in Article 24, or, where the relevant functionality is available, directly within your Account settings.
**16.2** InMyLocus may need to verify your identity before acting on a request, to protect against unauthorised access to personal data.
**16.3** InMyLocus will respond to a request without undue delay and, in any event, within a reasonable period, which InMyLocus aims to keep to no more than thirty (30) days from receipt of a verifiable request, extendable where the request is complex, subject to notifying you of any extension and the reason for it.
**16.4** InMyLocus does not charge a fee for a request under Article 15, save where a request is manifestly unfounded, excessive, or repetitive, in which case InMyLocus may charge a reasonable administrative fee or decline to act on the request, subject to the limits recognised under the Data Protection Law.
---
## ARTICLE 17 — CHILDREN AND MINORS
**17.1** The Platform is not directed at, and Accounts may not be created by, individuals under eighteen (18) years of age, consistent with the eligibility requirement in the Terms of Use. InMyLocus does not knowingly collect personal data from individuals under this age in connection with Account creation.
**17.2** Where InMyLocus becomes aware that it holds personal data collected from an Account holder who did not, at the time of registration, meet the age requirement in the Terms of Use, InMyLocus will take steps to suspend the Account and delete the associated personal data, save where retention is required by law.
**17.3** Certain Product categories on the Platform (for example, within Babies, Kids & Toddlers) concern products intended for use by children, but do not involve InMyLocus collecting personal data about a child as a data subject; the relevant Account holder and data subject in such transactions remains the adult Buyer.
---
## ARTICLE 18 — COOKIES AND SIMILAR TECHNOLOGIES
**18.1** InMyLocus and its service providers use cookies, software development kit (SDK) identifiers, and similar tracking technologies on the website and within the mobile applications, for the purposes and subject to the consent and preference mechanisms described in the separate **InMyLocus Cookie Policy**, which forms part of this Policy by reference.
---
## ARTICLE 19 — MARKETING COMMUNICATIONS
**19.1** Where you have opted in, InMyLocus may send you marketing communications about new categories, promotions, Deals, and features by email, SMS, push notification, or WhatsApp Business messaging.
**19.2** You may withdraw your consent to marketing communications at any time by using the unsubscribe or opt-out mechanism included in the relevant communication, or by adjusting your notification preferences within your Account settings, or by contacting InMyLocus using the details in Article 24. Consistent with the ICT Law's provisions on unsolicited commercial communications, every marketing communication InMyLocus sends will identify InMyLocus as the sender and will provide a means to opt out.
**19.3** Withdrawing consent to marketing communications does not affect InMyLocus's ability to send you transactional communications necessary for the operation of your Account, a Booking, or an Order, as described in the Terms of Use.
---
## ARTICLE 20 — DATA BREACH NOTIFICATION
**20.1** InMyLocus maintains an incident response process designed to detect, investigate, and respond to any personal data breach without undue delay.
**20.2** In accordance with the Data Protection Law, where InMyLocus becomes aware of a personal data breach, it will notify the NCSA within forty-eight (48) hours of becoming aware of the breach.
**20.3** Where a personal data breach is likely to result in a high risk to your rights and freedoms, InMyLocus will also notify you directly, without undue delay, describing the nature of the breach, its likely consequences, and the measures taken or proposed to address it, save where an exception recognised under the Data Protection Law applies (for example, where the breach is unlikely to result in a high risk, or where notification would involve disproportionate effort and a public communication is used instead).
---
## ARTICLE 21 — THE DATA PROTECTION OFFICER
**21.1** InMyLocus has designated a Data Protection Officer ("**DPO**") responsible for monitoring compliance with the Data Protection Law, advising on data protection impact assessments, maintaining InMyLocus's record of processing activities, and acting as InMyLocus's point of contact with the NCSA.
**21.2** The DPO's role, including the data protection impact assessment process referred to in Article 21.1, is described further in the companion InMyLocus Data Protection Policy.
**21.3** The DPO can be contacted using the details in Article 24.
---
## ARTICLE 22 — COMPLAINTS TO THE SUPERVISORY AUTHORITY
**22.1** If you believe InMyLocus has processed your personal data in a manner inconsistent with this Policy or the Data Protection Law, you are encouraged to contact InMyLocus's DPO in the first instance so that InMyLocus can investigate and, where appropriate, resolve the matter directly.
**22.2** You also have the right, independently of contacting InMyLocus, to lodge a complaint with the National Cyber Security Authority, acting through its Data Protection and Privacy Office, at:
National Cyber Security Authority — Data Protection and Privacy Office
P.O. Box 6603, Kigali, Rwanda
*(Current contact details should be confirmed against the NCSA's official website prior to publication of this Policy.)*
---
## ARTICLE 23 — CHANGES TO THIS POLICY
**23.1** InMyLocus may update this Policy from time to time to reflect changes in its practices, the Platform, or applicable law. Where a change is material, InMyLocus will provide at least fourteen (14) days' notice via the Platform, push notification, or email before the change takes effect, consistent with the approach taken to amendments of the Terms of Use.
**23.2** The "Document status" line at the top of this Policy indicates the version and date of the most recent update.
---
## ARTICLE 24 — CONTACT INFORMATION
**Data Controller:**
InMyLocus Ltd
KN 80 St, Kigali, Rwanda
RDB Registration No. REG-2023-2073229 | TIN 121632599
**Data Protection Officer:**
Email: dpo@inmylocus.com
**General privacy enquiries:**
Email: privacy@inmylocus.com
**Supervisory Authority:**
National Cyber Security Authority (NCSA) — Data Protection and Privacy Office, P.O. Box 6603, Kigali, Rwanda
---
*End of Privacy Policy. This document should be read together with the InMyLocus Terms of Use, Cookie Policy, and Data Protection Policy.*