Privacy Policy

1. Introduction

Good Link Solutions Ltd ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, process, and safeguard your information when you use our INKOMANE system and related services.

As a technology company incorporated under the laws of the Republic of Rwanda, we comply with all applicable Rwandan data protection laws and regulations, including but not limited to:

• The Constitution of the Republic of Rwanda
• Law Nº 058/2021 of 13/10/2021 on the protection of personal data and privacy
• Relevant regulations issued by the Rwanda Utilities Regulatory Authority (RURA)

2. Information We Collect

2.1 Personal Information

We collect personal information that you voluntarily provide to us when using the INKOMANE system, including:

• Identity Information: Full name, national ID number, date of birth, photograph
• Contact Information: Email address, phone number, physical address
• Employment Information: Job title, employer details, employment contract information, salary details, attendance records
• Financial Information: Bank account details, mobile money numbers, tax information, social security contributions
• Biometric Data: Fingerprints for smart card authentication (when applicable)
• Mining Operations Data: Production data, mineral traceability information, sales records

2.2 Automatically Collected Information

When you use our services, we automatically collect:

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, time spent, features used)
• Location data (when GPS services are enabled)
• System logs and error reports

3. How We Use Your Information

We use your personal data for the following purposes, all of which are essential for our legitimate business operations in Rwanda:

3.1 Service Provision

• Operating and maintaining the INKOMANE system
• Processing employment contracts and payroll
• Managing worker attendance and performance tracking
• Facilitating mineral traceability and compliance reporting
• Processing EBM transactions and tax compliance

3.2 Legal Compliance

• Complying with Rwanda Revenue Authority (RRA) tax requirements
• Meeting Rwanda Mines, Petroleum and Gas Board (RMB) reporting obligations
• Fulfilling social security and health insurance requirements (RMA)
• Adhering to labor law requirements in Rwanda

3.3 System Improvement

• Analyzing system performance and user experience
• Developing new features and services
• Ensuring system security and preventing fraud
• Providing customer support and technical assistance

4. Information Sharing and Disclosure

We may share your personal information in the following circumstances:

4.1 Government Authorities

We share data with authorized Rwandan government institutions as required by law:

• Rwanda Revenue Authority (RRA): Tax and payroll information
• Rwanda Mines, Petroleum and Gas Board (RMB): Mining operations and traceability data
• National Bank of Rwanda (BNR): Financial and export data
• National Institute of Statistics Rwanda (NISR): Statistical information
• Rwanda Medical Association (RMA): Health insurance and contribution data

4.2 Authorized Partners

• Financial institutions for payroll processing and financial inclusion services
• Mining companies and trading partners (with explicit consent)
• Technology service providers operating under strict data protection agreements

4.3 Legal Requirements

We may disclose information when required by Rwandan law, court orders, or to protect our legal rights and interests.

5. Data Security

We implement comprehensive security measures to protect your personal data:

5.1 Technical Safeguards

• End-to-end encryption for data transmission
• Secure database storage with access controls
• Regular security audits and penetration testing
• Multi-factor authentication for system access
• Automated backup and disaster recovery systems

5.2 Organizational Measures

• Staff training on data protection and confidentiality
• Strict access controls based on job requirements
• Regular review and update of security policies
• Incident response procedures for data breaches

6. Your Rights

Under Rwandan data protection law, you have the following rights:

6.1 Access and Portability

• Request access to your personal data we hold
• Receive a copy of your data in a structured format
• Transfer your data to another service provider

6.2 Correction and Updates

• Correct inaccurate or incomplete personal data
• Update your contact and employment information
• Modify your communication preferences

6.3 Deletion and Restriction

• Request deletion of your personal data (subject to legal requirements)
• Restrict processing of your data in certain circumstances
• Object to processing for direct marketing purposes

Note: Some data may need to be retained for legal compliance purposes as required by Rwandan law, particularly for tax, labor, and mining regulations.

7. Data Retention

We retain your personal data for different periods based on legal requirements and business needs:

• Employment Records: 7 years after employment termination (as required by Rwanda Labour Law)
• Tax and Financial Records: 10 years (as required by RRA regulations)
• Mining Operations Data: As required by RMB regulations
• Health Insurance Records: As required by RMA regulations
• System Logs: 2 years for security and troubleshooting purposes

Data is securely deleted when retention periods expire, unless legal obligations require longer retention.

8. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal data from a child under 18, we will take immediate steps to delete such information.

In accordance with Rwanda's child protection laws, any employment data involving minors will be handled with additional safeguards and parental consent where required.

9. International Transfers

We primarily process and store data within Rwanda. Any international transfers of personal data will only occur:

• With your explicit consent
• When necessary for contract performance
• When required by Rwandan law
• To countries with adequate data protection standards
• Under appropriate safeguards and legal mechanisms

10. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make significant changes, we will:

• Post the updated policy on our website
• Send notifications to registered users
• Provide at least 30 days' notice before changes take effect
• Highlight material changes clearly

Your continued use of our services after the effective date constitutes acceptance of the updated policy.

11. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

We will respond to your inquiries within 30 days as required by Rwandan data protection law.

12. Regulatory Compliance

This Privacy Policy complies with:

• Rwanda's Constitution and fundamental rights provisions
• Law Nº 058/2021 of 13/10/2021 on the protection of personal data and privacy
• Rwanda Revenue Authority (RRA) regulations
• Rwanda Mines, Petroleum and Gas Board (RMB) requirements
• Rwanda Utilities Regulatory Authority (RURA) guidelines
• National Institute of Statistics Rwanda (NISR) data sharing protocols
• Rwanda Medical Association (RMA) data protection standards

Any conflicts between this policy and applicable Rwandan law will be resolved in favor of the legal requirements.

13. Definitions

For the purposes of this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person
• "Processing" means any operation performed on personal data, including collection, storage, use, and disclosure
• "Data Controller" refers to Good Link Solutions Ltd as the entity determining the purposes and means of processing
• "Data Subject" means the individual whose personal data is being processed
• "INKOMANE System" refers to our integrated management platform and related services
• "Authorized Personnel" means employees, contractors, and partners with legitimate access to personal data

14. Acknowledgment and Consent

By using the INKOMANE system or our services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. You consent to the collection, processing, and use of your personal data as described in this policy.

For sensitive personal data such as biometric information, we will obtain your explicit written consent before processing.

You may withdraw your consent at any time, subject to legal and contractual obligations that require continued processing of your data.