Privacy Policy

1. Introduction & scope.

Welcome to the Rwanda Remote Jobs ("RRJ", "we", "us", or "our"). This Privacy Policy explains what personal information we collect from users of the RRJ platform (the "Service"), why we collect it, how we use it, how long we keep it, and the rights and choices you have regarding your personal data.

This policy applies to all users of the RRJ platform — including talent, employers, training partners, visitors, newsletter subscribers, and anyone contacting us through forms or email. By registering an account, using the RRJ platform, or submitting information through our website, you agree to the collection and use of information in accordance with this policy. Where we need consent, we will ask for it explicitly at the point of collection.

2. Information we collect.

We collect information in three ways: information you provide directly, information generated automatically as you use the Service, and information we receive from partners and verification sources.

2.1 Information you provide.

Depending on your relationship with RRJ, you may provide the following categories of personal data:

Category	Examples	Provided by
Account & identity	Name, email, phone, national ID, profile photo	Talent, employers, partners
Professional profile	CV, skills, work history, education, portfolio, references	Talent
Employer details	Company registration, billing address, tax ID, authorized signatory	Employers
Communications	Contact form messages, support tickets, in-platform messages	All users
Training & exam data	Course progress, assessment scores, certification records	Talent in training programs
Payments & billing	Invoice details, payment method, billing history	Paid plan employers, partners

2.2 Information generated automatically.

When you access the Service, we automatically collect certain data to operate, secure, and improve the platform:

• Log data — IP address, browser type, device, operating system, referring/exit pages, timestamps
• Usage data — pages viewed, searches, jobs clicked, applications submitted, files downloaded
• Session data — device identifiers, authentication tokens, session duration
• Performance data — page load times, errors, feature usage to inform product improvements

2.3 Information from other sources.

We may also receive personal information from:

• Training partners & academic institutions — confirming enrollment, grades, or completion
• Identity and employer verification providers — confirming identity documents, company registrations
• Public or professional profiles — with your explicit consent when applying for verified roles
• Referrers — when an existing RRJ user invites you to join

3. How we use your information.

We use personal information only for specific, documented purposes. The principal uses are:

• Service delivery — creating accounts, enabling job search and applications, matching talent to jobs, facilitating training and certification, and delivering RRJ's core platform features.
• Matching & recommendations — using skills, certification scores, location, and job preferences to recommend opportunities or candidates to verified employers and talent.
• Verification & trust & safety — verifying employer and talent identity, screening jobs, investigating reports, and preventing fraud and platform misuse.
• Communication — responding to support queries, sending service notifications, application updates, new job matches, training reminders, and account/policy changes.
• Product improvement — understanding how users interact with RRJ to prioritize features, fix issues, and improve matching algorithms.
• Reporting & impact measurement — aggregated, de-identified reporting for RRJ board, partners, and public reports on employment outcomes, salary data, and training impact.
• Compliance & legal — meeting Rwandan law, regulation, audit, tax, and contractual obligations; responding to lawful requests from authorities; protecting RRJ's and our users' rights.
• Marketing — only with explicit consent: sending newsletters, new program announcements, and event invitations. You can opt out at any time.

4. Legal basis for processing.

Under applicable Rwandan and international data protection frameworks (including GDPR for users in covered jurisdictions), RRJ relies on one or more of the following lawful bases when processing personal data:

• Contract — processing necessary to deliver the RRJ service you have registered for (e.g., creating a profile, posting a job, issuing a certificate).
• Consent — for optional processing such as marketing newsletters, optional profile enhancements, or certification data shared externally.
• Legal obligation — to comply with tax, employment, accounting, anti-fraud, and regulatory requirements in Rwanda and relevant jurisdictions.
• Legitimate interests — for platform security, trust & safety, matching improvement, aggregated impact reporting, and direct recruitment communications where permitted.
• Vital interest & public task — in limited cases, for health/safety emergencies or where RRJ performs a public-interest task.

5. Sharing & disclosures.

We do not sell personal information — ever. We share personal data only in the circumstances described below, and only the minimum data necessary for the stated purpose.

• Talent ↔ Employers (platform use). When a talent member applies for a job or appears in a matched shortlist for a verified employer, their RRJ profile (name, skills, certifications, experience, location) is shared with that employer for hiring purposes. Any sharing beyond this is opt-in.
• Training partners & certifiers. Your training progress, scores, and certification results are shared with the institution delivering the program you enrolled in, and — only upon successful certification — displayed on your public RRJ profile.
• Service providers. We engage trusted subprocessors for hosting, analytics, payment processing, email delivery, fraud prevention, and customer support tools. All are bound by written confidentiality and data processing agreements.
• Governments, regulators & law enforcement. We will disclose personal data when compelled to do so by valid Rwandan legal process, in response to a lawful court order, regulatory inquiry, or to protect the vital interests of any person.
• Corporate transactions. If RRJ undergoes a merger, acquisition, or asset sale (or discussions leading to one), your data may be transferred subject to the same confidentiality and security commitments.
• Aggregated & de-identified data. We may publish or share aggregated, de-identified data for research, policy, marketing, or reporting purposes — no individual can be re-identified from this data.

6. International transfers.

Because RRJ connects Rwandan talent with employers worldwide, some personal data may be transferred and processed outside Rwanda. When this occurs:

• Transfers are limited to what is necessary for the matching, hiring, or contractual purpose.
• We ensure appropriate safeguards are in place — including standard contractual clauses, binding corporate rules, adequacy decisions, or equivalent protections approved by the competent Rwandan authority.
• You may request details of the transfer mechanism used for your data by contacting privacy@rrji.rw.

7. Data security.

Protecting your information is a foundational RRJ commitment. We maintain a comprehensive information security program including:

• Encryption of sensitive data at rest (AES-256) and in transit (TLS 1.2+)
• Role-based access controls and least-privilege principles across all systems
• Annual third-party penetration testing and continuous vulnerability scanning
• Secure software development lifecycle (SSDLC) and code review
• Staff privacy & security training, signed NDAs, and regular audits
• Incident response plan with documented breach notification procedures (per Rwandan law within 72 hours of awareness)

No internet service is 100% secure. While we apply best practices, we cannot guarantee absolute security — but we will respond swiftly and transparently if any incident occurs affecting your data.

8. Retention of your data.

We retain your information only as long as necessary for the purposes for which it was collected and to meet legal, accounting, or audit obligations. Our standard retention periods (unless a longer period is required by law) are:

Data category	Retention period
Active user accounts	Length of relationship + 12 months after last activity
Applications & job post history	5 years (for audit, disputes, and analytics)
Training & certification records	Life of certification (renewable annually)
Invoices & financial records	7 years (per Rwandan tax law)
Support & trust/safety cases	3 years after case closure
Newsletter subscribers	Until unsubscribe or account deletion

Once no longer required, personal data is either permanently and irreversibly anonymized or securely deleted according to RRJ's data retention policy.

9. Your rights & choices.

You have several rights regarding your personal information. RRJ will honor them to the full extent required by Rwandan law and, where applicable, international standards such as the GDPR. Key rights include:

• Access — request a copy of the personal data RRJ holds about you.
• Correction — correct inaccurate or incomplete information (much of which you can update directly in your profile settings).
• Erasure ("right to be forgotten") — request deletion of your data, subject to retention for legal obligations.
• Restriction — ask us to restrict processing of your data in specific circumstances.
• Portability — receive your profile data in a machine-readable format for reuse elsewhere.
• Objection — object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw consent — where processing is based on consent (e.g., newsletters), you can withdraw it at any time.
• Lodge a complaint — with the competent Rwandan data protection authority, or with a local supervisory authority if you are outside Rwanda.

To exercise any of these rights, please email privacy@rrji.rw with the subject line "Data subject request" and include your full name, the email address associated with your account, and a clear description of your request. We will acknowledge within 7 business days and respond within the legally required timeline. We may verify your identity before disclosing or changing any information.

10. Cookies & analytics.

RRJ uses cookies and similar storage technologies for essential platform functionality and, only with consent, for analytics and product improvement.

• Essential cookies — required for login, session persistence, security, and core platform features. These are always set.
• Analytics cookies — with opt-in consent, we use privacy-preserving analytics to understand platform usage patterns and improve RRJ.
• Marketing cookies — rarely used; only set with explicit consent for relevant RRJ announcements.

You can manage your cookie preferences at any time through your browser settings or the RRJ cookie banner. Disabling some essential cookies may prevent certain features from working correctly.

11. Children's privacy.

RRJ services are not directed to, and are not intentionally designed for, children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you become aware that a child has provided us with personal information, please contact privacy@rrji.rw immediately and we will take steps to delete that information.

12. Changes to this policy.

RRJ may update this Privacy Policy from time to time — for legal, regulatory, technical, or product changes. Material changes will be notified at least 30 days before taking effect via email (to registered users) and a prominent notice on the RRJ website. The "Last updated" date at the top of this policy will also be revised. Continuing to use the Service after updates become effective constitutes acceptance of the revised policy.

13. Contact.

Questions, concerns, or requests regarding this Privacy Policy or your personal data? Please contact:

RRJ Data Protection / Privacy Team
Email: privacy@rrji.rw
Postal: RRJ Ltd, Kigali Heights, Kigali, Rwanda
Phone: +250 780 000 000

For general RRJ support and non-privacy inquiries, please see Contact RRJ.