How we handle your data

Qoonta Ltd (“Qoonta,” “we,” “us”) is a technology company registered in Rwanda (Company Code/TIN: 156529331), located at 1 KN 78 St, Inyarurembo, Kiyovu, Nyarugenge, Kigali, Rwanda. We provide AI-powered services delivered over WhatsApp to small businesses and individuals. Our first service is an AI-powered bookkeeping assistant; over time we intend to offer a broader range of AI-powered services.

We are the Data Controller responsible for your personal data and are registered with the Data Protection & Privacy Office under Rwanda’s National Cyber Security Authority (NCSA), in accordance with Law N° 058/2021 relating to the protection of personal data and privacy.

• Identity and contact data: your name, phone number, WhatsApp number, and (where applicable) business name.
• Transaction and service data: the information you share with us to use our services — such as records of sales, expenses, payments, debtors, and receipts — by text, photo, voice note, or forwarded mobile-money message.
• Usage data: information about how you interact with our services.

We collect data directly from you when you register and when you use our services through WhatsApp. We do not collect your data from third parties without your knowledge.

Where processing is based on your consent, you may withdraw it at any time.

We use automated tools, including artificial intelligence, to read, categorise, and respond to the information you send. In the future, we may use automated analysis of your data to assess eligibility for additional services, such as financing. You have the right to information about, and to object to, decisions based solely on automated processing, as provided under the law.

We do not sell your personal data. We may share it with:

• Service providers (our data processors) who help us operate our services — including hosting, AI processing, and messaging providers — under written data-processing agreements;
• Regulators and authorities where required by law;
• Future partners (such as licensed financial institutions), only with your consent, if and when you choose to use services that involve them.

We store your personal data on servers located in Rwanda. Some of our service providers carry out limited processing of data from outside Rwanda (for example, AI processing and messaging). Where any personal data is transferred outside Rwanda, we do so in accordance with Articles 48 and 50 of Law N° 058/2021, with appropriate safeguards and under valid authorisation.

We retain your personal data for as long as you use our services and as long as necessary to provide them, comply with legal obligations, and support any related service relationship. You may request deletion of your data as described below.

We apply technical and organisational safeguards including access controls, authentication, encryption of data in transit and at rest, secure hosting, and restricted staff access.

Under Law N° 058/2021, you have the right to: be informed about how your data is used; access your personal data; request correction of inaccurate data; request deletion; object to or restrict certain processing; request portability; withdraw consent at any time; and lodge a complaint with the supervisory authority. To exercise any of these rights, contact us below.

Email: gatare@qoonta.com · Phone: +250 787 820 842

If you believe your data protection rights have been breached, you may lodge a complaint with the Data Protection & Privacy Office, NCSA — 21 KG Avenue, A&P Building, Kacyiru, Gasabo, Kigali, Rwanda — www.dpo.gov.rw.

We may update this Privacy Notice from time to time. The latest version will always be available at qoonta.com, and we will notify you of significant changes.

Qoonta Ltd

1 KN 78 St, Inyarurembo, Kiyovu, Nyarugenge, Kigali, Rwanda

hello@qoonta.com · gatare@qoonta.com · +250 781 653 156