Privacy policy
Last updated
Who we are
This website is operated by HEOR Africa, with offices in Kigali, Rwanda, and Addis Ababa, Ethiopia (“we”, “us”). We are the data controller for personal data collected through this website.
For any privacy question or request, contact [email protected].
The laws that apply
We process personal data in accordance with:
- Rwanda: Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy (“the Rwanda data protection law”). We are registering with the National Cyber Security Authority (NCSA), Rwanda’s data protection supervisory authority.
- Ethiopia: the Personal Data Protection Proclamation No. 1321/2024 (“the Ethiopia data protection law”), which is overseen by the Ethiopian Communications Authority.
We also comply with other laws that apply to our work.
What we collect and why
| Data | When | Purpose | Lawful basis |
|---|---|---|---|
| Name, organisation, email, request details | When you submit the contact form | To respond to your enquiry and discuss a possible engagement | Your consent, and steps taken at your request before entering into a contract |
| Name, organisation, email | When you request a resource download | To send you the resource and, only if you opt in, occasional updates | Your consent |
| Email address | When you subscribe to the newsletter | To send the newsletter | Your consent (you can unsubscribe at any time) |
| Name, email, role applied for, highest level of education, technical skills and CV | When you apply through the careers page | To assess your application for the role | Your consent, and steps taken at your request before entering into a contract |
| Booking details | When you book a call through Cal.com | To schedule and hold the call | Your consent, and steps taken at your request |
| Phone number, name and message content | When you contact us on WhatsApp | To reply to your message | Your consent, and steps taken at your request |
| Aggregate, anonymous usage statistics | When you visit the site | To understand which pages are useful | Our legitimate interest in improving the site |
We do not sell personal data, and we do not use it for automated decision-making or profiling.
Analytics without cookies
We use Umami, a privacy-focused analytics service that does not use cookies and does not collect personal data. It records aggregate information such as pages viewed, referring websites and device type. IP addresses are not stored.
Service providers
We use the following providers to run this website. Each processes data only on our instructions.
- Hosting: Cloudflare Pages, Cloudflare, Inc.
- Forms: Formspree, Inc.
- Scheduling: Cal.com, Inc.
- Job applications: Google Drive and Google Sheets, Google LLC
- Bot protection on the application form: Cloudflare Turnstile, Cloudflare, Inc.
- Messaging (only if you choose to contact us on WhatsApp): WhatsApp, operated by Meta Platforms
- Analytics: Umami Software, Inc.
Transfers outside Rwanda and Ethiopia. Personal data submitted through this website may be processed by these providers outside Rwanda and Ethiopia, including in the United States. We transfer personal data outside Rwanda and Ethiopia only in line with the cross-border transfer requirements of the Rwanda and Ethiopia data protection laws.
Job applications
When you apply through the careers page we collect your name, email address, the role you are applying for, your highest level of education, the technical skills you select or type in, and your CV. This information is sent over an encrypted connection (HTTPS). Your CV is stored in a private Google Drive folder, and your answers and a private link to your CV are recorded in a private Google Sheet that we use to review and shortlist applicants. Only our hiring team can open them. To keep automated spam out, the application form uses Cloudflare Turnstile, which checks technical signals from your browser (not the content of your application) and does not use cookies to track you across sites.
We collect and use applicant data and CVs securely, for recruitment purposes only. We do not share them with third parties; Google stores the files and the Sheet on our behalf and has no right to use them for its own purposes. Decisions about applicants are made by people, not by automated means. If you are not hired, we delete your application within 12 months unless you ask us to keep it on file for future roles. You can ask us to see, correct or delete your application at any time.
How long we keep data
We keep personal data only for as long as it is needed for the purposes described above, and then delete or anonymise it. Newsletter details are kept until you unsubscribe.
Your rights
Under the Rwanda and Ethiopia data protection laws you have rights including the right to be informed, to access your personal data, to object to processing, to have inaccurate data corrected, to have data erased, to restrict processing and to data portability.
To exercise your rights, email [email protected]. If you are not satisfied with our response, you may complain to the National Cyber Security Authority of Rwanda or, in Ethiopia, the Ethiopian Communications Authority.
Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls and data minimisation.
Client and project data
This policy covers data collected through the website. Data shared with us during an engagement is governed by the confidentiality and data processing terms of that engagement.
Changes
We will post any changes on this page and update the date above.