Privacy Policy

1. Who we are

IYAWE Art Collection is a Rwanda-based online marketplace that connects artists and artisans with buyers in Rwanda and abroad.

We are the data controller responsible for the personal information described in this policy. Our contact details are at the end of the page.

2. Information we collect

We collect the following categories of information:

• Account information: your name, email address, phone number, password (stored only in hashed form), and your language and currency preferences.
• Artist and shop information: if you open a shop, the shop name, description, location, logo and banner images, and any social media links you choose to add.
• Listing content: titles, descriptions, prices and images you upload for the items you sell.
• Order and delivery information: the items ordered, order value, delivery address, recipient name and phone number, and your order and wishlist history.
• Payment information: payments are processed by our payment provider, Flutterwave. We receive the payment status, amount, currency and a transaction reference. We never receive or store your full card or mobile money credentials.
• Communications: messages you send through our contact form or by email, and any support requests.
• Device and usage information: IP address, browser type and version, device type, the pages you visit, and the date and time of your visit.
• Approximate location: we look up the country associated with your IP address so we can show prices in a suitable currency and estimate delivery. This is a country-level lookup, not precise GPS location.
• Cookies and browser storage: see the section on cookies below.

3. How we use your information

We use personal information to:

• create and manage your account and keep you signed in securely;
• show the website in your chosen language and prices in your local currency;
• process orders, take payment, arrange delivery and handle returns or refunds;
• let artists manage their shop, listings, orders, transactions and payouts;
• keep your cart and wishlist between visits;
• answer your messages and provide customer support;
• protect the website against fraud, abuse and security incidents;
• meet our legal, accounting and tax obligations;
• understand how the website is used so we can improve it.

4. Our legal bases

We only process personal information where we have a lawful basis: to perform our contract with you (your account, orders and payouts), for our legitimate interests (keeping the service secure, preventing fraud and improving the website), to comply with a legal obligation (tax and accounting records), or with your consent (for example non-essential cookies or marketing emails, where you can withdraw consent at any time).

We do not sell your personal information, and we do not use it for automated decision-making that produces legal effects for you.

5. Cookies and similar technologies

We use a small number of cookies and browser storage entries:

• Essential cookies: needed to sign you in, keep your session secure and remember your cart. The website cannot work without them.
• Preference storage: remembers the language and currency you selected.

6. Your cookie choices

We do not currently use advertising or cross-site tracking cookies. If that changes, we will update this policy and ask for your consent where the law requires it.

You can delete or block cookies in your browser settings at any time, but parts of the website, in particular signing in and checking out, may then stop working.

7. How we share your information

We share personal information only in the ways described here:

• Artists and sellers: when you place an order, the artist fulfilling it receives what is needed to prepare and ship it, including your name, delivery address, phone number and the items ordered.
• Payment provider: Flutterwave processes payments and handles your payment details under its own privacy policy.
• Delivery and logistics partners: to deliver your order to the address you gave us.
• Service providers: hosting, storage, email delivery and IP-geolocation providers who process data on our instructions and only for the purposes we set.
• Legal and safety reasons: where we must comply with a law, court order or lawful request, or to establish, exercise or defend legal claims, or to protect the rights and safety of our users.
• Business transfers: if IYAWE is involved in a merger, acquisition or sale of assets, personal information may be transferred. We will let you know before your information becomes subject to a different privacy policy.
• We do not sell or rent your personal information, and we do not share it with third parties for their own advertising.

8. International transfers

Some of our service providers operate outside Rwanda. When personal information is transferred abroad we take reasonable steps to make sure it stays protected by appropriate safeguards, such as contractual commitments with the provider that require a level of protection comparable to the one described in this policy.

9. How long we keep your information

We keep personal information only for as long as we need it:

• Account and shop information: while your account is open, and up to 12 months after you close it.
• Order, payment and invoicing records: for as long as tax and accounting law requires us to keep them.
• Contact form messages and support correspondence: up to 24 months after the matter is closed.
• Server and security logs: normally up to 12 months.
• When information is no longer needed we delete it or anonymise it so that it can no longer identify you.

10. How we protect your information

We serve the website over encrypted HTTPS connections, store passwords only in hashed form, limit access to personal information to the people and roles that need it, and rely on a payment provider certified to handle payment data.

No online service can be completely secure. If a personal data breach affects your information, we will notify you and the competent authority where the law requires it.

11. Your rights

Depending on where you live, including under Rwanda's Law No. 058/2021 relating to the protection of personal data and privacy and under the EU and UK GDPR, you have the right to:

• ask what personal information we hold about you and receive a copy of it;
• have inaccurate or incomplete information corrected;
• ask us to delete your account and your personal information;
• object to certain processing, or ask us to restrict it;
• receive the information you gave us in a portable, machine-readable format;
• withdraw your consent at any time, without affecting processing already carried out;
• complain to the National Cyber Security Authority in Rwanda, or to the data protection authority where you live.

12. How to exercise your rights

You can view and update most of your information yourself in your account settings, and you can ask us to delete your account at any time.

For anything else, contact us using the details below. We answer requests within 30 days. We may need to verify your identity first, and we may have to keep information that we are legally required to retain, for example invoicing records.

13. Children's privacy

This website is not directed at children. You must be at least 18 years old to create an account, place an order or open a shop.

We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, contact us and we will delete it.

14. Links to other websites

Our website links to other sites, for example artists' social media profiles and our payment provider's checkout. We are not responsible for their content or their privacy practices, and we encourage you to read their privacy policies before sharing information with them.

15. Changes to this policy

We may update this Privacy Policy from time to time. The date shown at the top of this page tells you when it was last changed.

If a change is significant we will give notice on the website or by email before it takes effect. If you keep using the website after a change takes effect, you accept the updated policy.

16. Contact us

If you have questions about this policy or about how we handle your personal information, or if you want to exercise any of your rights, get in touch:

• Data controller: IYAWE Art Collection
• Address: 3"S 30°, Kimironko Market Side Doors opposite Police Station 1°56'19, 08 11.0"E, Kigali
• Email: infro@iyawe.com
• Phone: +250795463865

You can also reach us through our contact form.