Privacy Policy

Welcome to MasokoLink — Rwanda's digital marketplace connecting buyers, sellers, manufacturers, and agents across the country and beyond.

We are committed to protecting the privacy and security of all users. This Privacy Policy describes how MasokoLink ("we," "us," or "our") collects, uses, stores, protects, and discloses personal information when you access or use our website, mobile application, and related services (collectively, the "Platform").

By creating an account, browsing our marketplace, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy and agree to its terms. If you do not agree, please stop using MasokoLink immediately.

This policy is designed to be consistent with Rwanda's Data Protection and Privacy Law (Law N° 058/2021 of 13/10/2021) and internationally recognised best practices for data protection.

To provide a secure and functional marketplace, we collect different categories of information depending on how you use the Platform. We only collect information that is necessary for a specific, legitimate purpose.

MasokoLink uses collected information only for legitimate business purposes. We do not use your data in ways that are inconsistent with the reasons it was originally provided. Specifically, we use information to:

• Create, verify, and manage user accounts
• Verify sellers and businesses to ensure marketplace integrity
• Process orders, payments, and escrow transactions
• Facilitate communication between buyers and sellers through our messaging system
• Provide customer support and resolve disputes
• Detect, investigate, and prevent fraudulent or suspicious activities
• Maintain the security and reliability of the Platform
• Generate aggregated analytics and business insights to improve the marketplace
• Send transactional notifications (order confirmations, payment receipts, status updates)
• Send marketing or promotional communications (with your consent; you may opt out at any time)
• Comply with applicable legal and regulatory obligations

We rely on one or more of the following legal bases for processing: performance of a contract with you, compliance with a legal obligation, your explicit consent, or our legitimate interests in operating a secure and effective marketplace.

Your financial security is a top priority. MasokoLink does not store, process, or have access to sensitive payment credentials, including:

• MTN Mobile Money or Airtel Money PINs
• Bank account passwords or card security codes (CVV/CVC)
• Full card numbers

All payment transactions are handled through our authorised payment partners, which include:

• MTN Mobile Money
• Airtel Money
• Partner banks and licensed financial institutions
• Other authorised payment providers

Each partner operates under their own security standards and regulatory obligations. All payment data transmitted through or in connection with MasokoLink is protected using industry-standard encryption (TLS/HTTPS). You should review the privacy and security policies of the respective payment providers for further information.

MasokoLink does not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes. We share information only in the limited circumstances described below.

We take technical and organisational measures to protect your information against unauthorised access, alteration, disclosure, or destruction. Our security measures include:

• Encrypted communications using HTTPS/TLS for all data in transit
• Bcrypt password hashing — passwords are never stored in readable form
• Role-based access controls limiting who within our organisation can access sensitive data
• Continuous security monitoring and anomaly detection
• Regular system updates and security patching
• Backup and disaster recovery procedures to prevent data loss

Despite these efforts, no internet-based system can guarantee 100% security. We encourage all users to protect their own accounts by using a strong, unique password, enabling any available two-factor authentication, and logging out on shared or public devices.

If you believe your account has been compromised, contact us immediately at security@masokolink.com.

Under Rwanda's Data Protection and Privacy Law, and consistent with international standards, you have the following rights with respect to your personal information:

• Right of Access — you may request a copy of the personal information we hold about you.
• Right to Rectification — you may update or correct inaccurate information at any time through your account settings or by contacting us.
• Right to Erasure — you may request deletion of your account and associated personal data, subject to any legal obligations to retain certain records.
• Right to Data Portability — you may request a machine-readable copy of your personal data to transfer to another service.
• Right to Withdraw Consent — where processing is based on your consent (e.g., marketing emails), you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to Object — you may object to certain types of processing, including direct marketing.
• Right to Complain — if you believe we have not handled your data appropriately, you may lodge a complaint with Rwanda's National Cyber Security Authority (NCSA) or the relevant data protection authority.

To exercise any of these rights, please contact us at privacy@masokolink.com. We will respond within 30 days. We may need to verify your identity before processing certain requests.

MasokoLink uses cookies and similar technologies (such as local storage and session tokens) to deliver a reliable, personalised, and secure experience. Cookies are small text files stored on your device by your browser.

We use the following categories of cookies:

• Strictly necessary cookies — required for core functions such as authentication, session management, and security. These cannot be disabled.
• Functional cookies — remember your preferences (e.g., language, saved searches) to improve usability.
• Analytics cookies — help us understand how users interact with the Platform so we can improve it. Data is aggregated and anonymised where possible.
• Marketing cookies — used to deliver relevant content or promotions. These are only activated with your consent.

You can manage or disable non-essential cookies through your browser settings. Note that disabling certain cookies may affect how the Platform functions. Most browsers also allow you to delete existing cookies at any time.

We retain your personal information only for as long as it is necessary to fulfil the purposes for which it was collected, or as required by law. Specifically:

• Account data is retained for as long as your account is active.
• Transaction and payment records are retained for a minimum of 5 years to comply with financial and tax regulations.
• Support and dispute records are retained for the period necessary to resolve the matter plus any applicable legal retention period.
• Anonymised or aggregated analytics data may be retained indefinitely as it cannot be linked back to any individual.

When data is no longer required for any legitimate purpose, we securely delete or anonymise it so that it can no longer be associated with you. You may request earlier deletion under your rights in Section 7, subject to overriding legal obligations.

MasokoLink is intended exclusively for users who are 18 years of age or older. Our services — including seller registration, product listing, purchasing, and escrow — involve financial transactions and commercial activities that require adult capacity.

We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe that a child under your care has provided us with personal information, please contact us immediately at privacy@masokolink.com and we will take prompt steps to delete that information.

MasokoLink is based in Rwanda, and we primarily store and process data within or through services accessible from Rwanda. However, some of our third-party service providers — including cloud hosting and analytics platforms — may be located outside Rwanda or process data on servers in other countries.

When personal data is transferred internationally, we take steps to ensure that appropriate safeguards are in place, including:

• Using service providers who adhere to internationally recognised data protection standards
• Incorporating data processing agreements with contractual protections equivalent to those required under Rwandan law
• Verifying that destination countries or organisations offer an adequate level of data protection

By using MasokoLink, you acknowledge that your information may be transferred to and processed in countries other than your own, under the protections described above.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last updated" date at the top of this page.

For significant changes — those that materially affect how we handle your data or your rights — we will provide additional notice through one or more of:

• A prominent notice on our website or application
• An email notification to registered users
• An SMS notification (for users who have provided a phone number)

Your continued use of MasokoLink after any update becomes effective constitutes your acceptance of the revised Privacy Policy. If you do not agree with any changes, you should stop using the Platform and may request deletion of your account.

If you have any questions, concerns, or requests regarding this Privacy Policy or how your personal information is handled, please reach out to us:

MasokoLink was built to make commerce in Rwanda safer, faster, and more accessible. Privacy is not an afterthought — it is foundational to earning and keeping the trust of every person who uses our platform.

We are committed to being transparent about what data we collect and why, giving you meaningful control over your information, protecting your data with robust technical and organisational safeguards, and complying fully with Rwanda's data protection laws.

Our mission is to build a trusted digital marketplace where buyers can Buy Safe and sellers can Sell Smart. Protecting your privacy is a core part of that mission — today and as we grow.