Privacy policy
Last updated
Who we are
This website is operated by HEOR Africa, Kigali, Rwanda (“we”, “us”). We are the data controller for personal data collected through this website.
For any privacy question or request, contact hello@heorafrica.com.
The law that applies
We process personal data in accordance with Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy (“the Rwanda data protection law”) and other applicable law.
What we collect and why
| Data | When | Purpose | Lawful basis |
|---|---|---|---|
| Name, organisation, email, request details | When you submit the contact form | To respond to your enquiry and discuss a possible engagement | Your consent, and steps taken at your request before entering into a contract |
| Name, organisation, email | When you request a resource download | To send you the resource and, only if you opt in, occasional updates | Your consent |
| Email address | When you subscribe to the newsletter | To send the newsletter | Your consent (you can unsubscribe at any time) |
| Booking details | When you book a call through Cal.com | To schedule and hold the call | Your consent, and steps taken at your request |
| Aggregate, anonymous usage statistics | When you visit the site | To understand which pages are useful | Our legitimate interest in improving the site |
We do not sell personal data, and we do not use it for automated decision-making or profiling.
Analytics without cookies
We use Umami, a privacy-focused analytics service that does not use cookies and does not collect personal data. It records aggregate information such as pages viewed, referring websites and device type. IP addresses are not stored.
Service providers
We use the following providers to run this website. Each processes data only on our instructions.
- Hosting: Netlify, Inc.
- Forms: Formspree, Inc.
- Scheduling: Cal.com, Inc.
- Analytics: Umami Software, Inc.
Transfers outside Rwanda. Personal data submitted through this website may be processed by these providers outside Rwanda, including in the United States. Such transfers are made subject to the cross-border transfer authorisation and safeguards required under the Rwanda data protection law.
How long we keep data
We keep personal data only for as long as it is needed for the purposes described above, and then delete or anonymise it. Newsletter details are kept until you unsubscribe.
Your rights
Under the Rwanda data protection law you have rights including the right to be informed, to access your personal data, to object to processing, to have inaccurate data corrected, to have data erased, to restrict processing and to data portability.
To exercise your rights, email hello@heorafrica.com. If you are not satisfied with our response, you may complain to the National Cyber Security Authority of Rwanda.
Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls and data minimisation.
Client and project data
This policy covers data collected through the website. Data shared with us during an engagement is governed by the confidentiality and data processing terms of that engagement.
Changes
We will post any changes on this page and update the date above.