Privacy policy

This site is operated by ADFINANCE Rwanda Ltd, a company registered in Rwanda with its head office at Kimihurura, KG 28 Avenue, N° 55, Gasabo, BP 213, Kigali. We also have offices in Burundi, Burkina Faso and Mauritius.

For anything in this policy, write to info@adfinance.co. A person reads that address.

This is important, and it is the part most visitors need. ADFinance builds and licenses software to financial institutions. We do not provide banking, lending or payment services to the public.

If you hold an account, a loan or a savings product with a microfinance institution or SACCO that runs our software, then that institution — not ADFinance — decides what happens to your personal data and is responsible for it. We act only on that institution's instructions, under a contract with them. Requests about your account data should go to your institution directly; we cannot action them and, in most cases, cannot even identify you.

This policy covers only the personal data this public website collects: essentially, what you type into the contact form.

Four things, and nothing else.

• The newsletter signupYour email address, and nothing else — the form has one field. It is used to send you the newsletter and for no other purpose. Every issue carries a one-click unsubscribe, and you can also ask us to remove you by email.
• The demo request formYour name, work email address, institution, country, which product you are interested in, and the message you write. Every one of those fields is there because we need it to reply usefully — we ask for your institution and country because a demo that ignores your regulator and your scale wastes your time.
• Job applicationsOur careers pages do not host an upload form. Applying opens your own email client and you send your CV to us directly, so no application data passes through this website. Once your email arrives it is handled as described under retention below.
• Server logsOur hosting provider records standard technical request logs — IP address, timestamp, the page requested, and your browser's user agent. These exist to keep the site available and to investigate abuse. We do not use them to build a profile of you, and we do not connect them to form submissions.

We use what you send through the contact form for one purpose: to answer you and, if it goes further, to prepare a demonstration or proposal. Sending us an enquiry does not put you on the newsletter — the two are separate, and you join the newsletter only by entering your address into the newsletter form yourself.

The lawful basis for enquiries is our legitimate interest in responding to a business enquiry you chose to send us, and — where a proposal follows — taking steps at your request before entering into a contract. For the newsletter the basis is your consent, given by submitting that form, and you can withdraw it at any time using the unsubscribe link in any issue. Under Rwandan law this is governed by Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy. If you are writing to us from the European Union, the equivalent bases under the GDPR are Articles 6(1)(f), 6(1)(b) and 6(1)(a).

This site sets two small cookies. Both exist only to make the site work the way you expect, neither identifies you, and neither is read by anyone but this site.

• adf_splashSet the first time you open the site, so the welcome animation plays once and not on every page you visit. It stores the number 1 and nothing else, and your browser deletes it when you close it.
• NEXT_LOCALEWritten when you switch between English and French, so a return visit does not send you back to the wrong language. It stores a two-letter language code and nothing else, and it expires after one year. You can delete it in your browser at any time; the site will simply ask your browser's language preference again.

There is no analytics package on this site. No Google Analytics, no tag manager, no advertising or remarketing pixel, no session recording, no heatmap, no chat widget, and no social media tracking script. We do not sell, rent or trade personal data, and there is no arrangement under which anyone else can advertise to you because you visited this site.

The typefaces are served from our own domain rather than fetched from a font provider while you read, so no third party learns you were here from the fonts alone.

As few parties as the job allows.

• Our hosting providerThe site is served by Vercel Inc., which processes requests and holds the technical logs described above on our behalf.
• Our own systemsA demo request is passed to the ADFinance mailbox and customer relationship system so the right colleague can pick it up. It stays inside the company.
• Where we are legally required toIf a court or a regulator with proper authority compels disclosure, we comply — and we tell you unless we are prohibited from doing so.

Demo requests and general enquiries are kept for 24 months from your last contact with us, then deleted. If the enquiry becomes a client relationship, the data moves under our contract with that client and is kept for as long as that relationship and the applicable accounting and regulatory record-keeping rules require.

Speculative CVs sent to us are kept for 12 months so we can come back to you when a suitable role opens, then deleted. Tell us at any point if you would rather we did not, and we will delete it immediately.

Newsletter subscriptions are kept until you unsubscribe. There is no expiry on them, because the only thing keeping you on the list is that you have not asked to come off it.

Technical server logs are retained on a short rolling window by our hosting provider and are not archived by us.

This site's server-side work runs in our hosting provider's Frankfurt region, and the static pages are cached on servers around the world so the site loads quickly across Africa. That means a submitted form is processed in the European Union, and our staff in Rwanda, Burundi, Burkina Faso and Mauritius then read it.

Rwandan law permits this cross-border transfer where appropriate safeguards are in place. We rely on our processor's contractual data protection terms for that, and we do not transfer enquiry data to any country beyond the ones named here.

For data this website collected about you, you can ask us to:

• tell you what we hold and give you a copy of it
• correct it if it is wrong
• delete it
• stop using it, including stopping contact entirely
• provide it in a portable, machine-readable form

Email info@adfinance.co and say what you want. We do not require a form or a particular wording. We will answer within 30 days, and we will only ask you to verify your identity where we genuinely cannot otherwise be sure the request is yours — which for a request about a form submission usually just means writing from the same address.

Exercising any of these costs nothing, and we will not treat you differently for it. If you think we have handled your data badly, tell us first so we can put it right; you also have the right to complain to Rwanda's National Cyber Security Authority, which supervises data protection, or to your own supervisory authority if you are outside Rwanda.

The site is served over HTTPS only, with strict transport security enforced, and it sets headers that stop the pages being framed by another site or having their content type second-guessed. Credentials used to deliver form submissions are held server-side and are structurally prevented from being included in anything sent to your browser.

No system is perfect, and we do not claim otherwise. If you find a security problem with this site, please report it to us at info@adfinance.co before disclosing it publicly, and we will work with you.

This is a business-to-business website intended for people acting for a financial institution. It is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has sent us personal data, write to us and we will delete it.

If we change how this site handles personal data, we change this page and move the date at the top. Where a change is significant — a new category of data, a new recipient, a new purpose — we will say so plainly rather than expecting you to diff the text.