Privacy policy and terms of service

Privacy policy

Last updated: 29 October 2026

This policy explains what personal data e-Mali collects, why, who we share it with, how long we keep it and the rights you have. It applies to the e-Mali website, the e-Mali app and the member portal.

We process personal data in line with Law n° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy in Rwanda. e-Mali is registered with the National Cyber Security Authority (NCSA) as a data controller, under data controller certificate n° 0010089DPO0926.

1. Who we are

   e-Mali is owned and operated by Tech & Us Ltd (www.techandus.com), a company registered in Rwanda with TIN 156336094, with its office at KG 167 St, Kimironko, Kigali, Rwanda ("e-Mali", "we", "us").

   You can reach us about anything in this policy, including our data protection officer, at info@e-mali.app, +250 789 261 140 or +250 780 840 983.

2. Our role and the role of your group

   We play two roles, depending on the data:

   • For the accounts of people who use e-Mali, enquiries sent to us and the data we need to run, secure and improve the service, e-Mali decides why and how the data is used, so we are the data controller.
   • For the records a cooperative or savings group (ikimina) keeps about its own members, such as savings, shares, loans and contributions, the group decides what to record and why. The group is responsible for that data, and we process it on the group's behalf and only on its instructions, as these terms and the law allow.

   If you are a member of a group and have a question about your records, you can ask your group's committee or contact us directly. We will help, or pass your request to the group when the decision is theirs.

3. The personal data we collect

   • Account details: full name, email address, phone number, the role you hold in your group, and your password or PIN, which we store only in a protected (hashed) form. We also handle one-time sign-in codes sent by SMS or email.
   • Member records entered by a group: full name, membership number, phone number, email address, national ID or passport number, TIN where given, address, date of joining, membership status, notes, and the member's savings, shares, contributions, loans, guarantees, repayments and other transactions with the group.
   • Documents uploaded by a group: receipts, proof of payment, meeting minutes, registers and similar files, which may include personal data.
   • Activity and security records: who did what in the app and when, the IP address and device or browser used, sign-in attempts and the audit log that the law requires groups to keep.
   • Enquiries: the name, group name, phone number, email and message you send through our contact form, by phone or by text message.

   We do not ask for sensitive personal data such as health, religion, political opinion or biometric data, and we ask groups not to record it in e-Mali.

4. Why we use it, and on what legal basis

   • To provide e-Mali to your group under our agreement with it: creating accounts, keeping records, calculating balances, interest and reports, and sending the notifications your group switches on.
   • To meet legal obligations: keeping financial records and supporting documents for the periods set by Law n° 057/2024 governing cooperatives and the rules for savings groups, and answering lawful requests from authorities.
   • For our legitimate interests, balanced against your rights: keeping the service secure, preventing fraud and misuse, fixing problems, and understanding how the service is used so we can improve it.
   • With your consent, which you can withdraw at any time: optional emails, such as news about e-Mali, each with a link to stop them.

   We do not sell personal data, we do not use it for advertising, and we do not make decisions about you that are based only on automated processing.

5. Who we share it with

   Personal data in a group's records is visible only to people that group has given access to, each according to their role. Members can see only their own records. Beyond that, we share personal data only with:

   • Service providers who host e-Mali, store its files and deliver our emails and text messages. They act only on our instructions, under written agreements that require them to keep the data confidential and secure.
   • Authorities, such as the Rwanda Cooperative Agency, the courts or law enforcement, when the law requires it or a valid order is presented. Where the law allows, we tell the group first.
   • A buyer or successor of our business, if e-Mali is ever reorganised or sold, under the same protections as this policy.

   Reports that a group exports or sends itself, for example to an auditor or to the Rwanda Cooperative Agency, are shared by the group under its own responsibility.

6. How long we keep it

   • Financial records and supporting documents: for as long as the law requires a group to keep them, which is at least 10 years for cooperatives and savings groups.
   • Accounts and other group data: for as long as the group uses e-Mali. When a group stops using e-Mali, it can export its records, and we delete or anonymise its data within 90 days, except what we must keep by law. Two of a group's officers (an Admin and the President, or two Admins) can also delete the group from its settings; its records are then kept, out of everyone's reach, only for as long as the law requires.
   • Activity and security records: 2 years, or longer where they form part of a group's legally required audit trail.
   • Enquiries that do not lead to an account: up to 12 months after our last contact.

7. How we protect it

   We use technical and organisational measures suited to financial records: encrypted connections, passwords and PINs stored only in hashed form, limits on failed sign-ins, sessions that time out, access by role, separation of each group's data, an audit log that cannot be edited, backups, and access by our own staff only when needed and under confidentiality duties.

   If a personal data breach happens, we will notify NCSA within 48 hours of becoming aware of it, as the law requires, and inform affected people and groups without undue delay when it is likely to put their rights at risk.

8. Your rights

   Under Law n° 058/2021 you have the right to:

   • be informed about how your personal data is used, as this policy does;
   • get a copy of the personal data we hold about you;
   • have inaccurate or incomplete data corrected;
   • have your data erased, or its use restricted, when there is no longer a valid reason to keep it;
   • object to processing based on our legitimate interests, and to any direct marketing;
   • receive your data in a usable format, or have it sent to another service (data portability);
   • withdraw consent at any time, for processing that relies on consent;
   • not be subject to a decision based only on automated processing that significantly affects you.

   To use any of these rights, contact us at info@e-mali.app, +250 789 261 140 or +250 780 840 983. We may ask you to confirm who you are. We reply within 30 days, free of charge. Some records, such as completed financial transactions, cannot be erased while the law requires the group to keep them, but they can be corrected through a recorded adjustment.

   If you are not satisfied with our answer, you can complain to the National Cyber Security Authority (NCSA), which supervises data protection in Rwanda.

9. Cookies and browser storage

   e-Mali uses one cookie that keeps you signed in, and stores your chosen language and open pages in your browser. These are needed for the app to work. We do not use advertising or tracking cookies.

10. Children

    e-Mali accounts are for adults. A group should not record personal data about a child under 16 unless a parent or legal guardian has given consent, as the law requires.

11. Changes to this policy

    We may update this policy when our service or the law changes. We will publish the new version here with its date, and tell group administrators by email or in the app at least 30 days before a significant change takes effect.

Terms of service

Last updated: 29 October 2026

These terms are the agreement between Tech & Us Ltd, the company that owns and operates e-Mali ("e-Mali", "we", "us") and the cooperative or savings group (ikimina) that creates an e-Mali account ("the group", "you"), and they also apply to every person who uses e-Mali for the group. By creating an account or using e-Mali, you accept these terms and our privacy policy.

1. The service

   e-Mali is online software that helps cooperatives and savings groups in Rwanda keep their members, savings, shares, loans, accounts and documents, prepare reports and follow the rules that apply to them.

   e-Mali is a record-keeping tool. We do not hold, move or lend money, we are not a bank or a microfinance institution, and nothing in e-Mali is legal, tax or accounting advice. The compliance checks and reminders in e-Mali are there to help, but the group remains responsible for its decisions, its records and its filings with the authorities.

2. Free trial

   • Every group can use e-Mali free of charge for a trial period of 60 days from the day its account is created. We do not ask for a card or any payment details to start.
   • Nothing is charged automatically when the trial ends. If your group wants to keep using e-Mali, contact us and we will agree a plan and its price with you in writing before anything is charged.
   • If your group does not continue, you can export your records during the trial and for 30 days after it ends. After that, your data is deleted as described in our privacy policy, except what we must keep by law.

3. Accounts and authority

   • The person who creates the account confirms that the group has authorised them to do so and to accept these terms for it.
   • The group decides who gets access and with which role, and is responsible for what its users do in e-Mali. Remove access promptly when someone leaves a role.
   • Keep passwords, PINs and sign-in codes secret. Tell us straight away if you think someone has used an account without permission.
   • The information you give us about the group and its users must be true and kept up to date.

4. Your group's data

   • The records your group enters in e-Mali belong to the group. You allow us to store and process them only to provide the service, as described in our privacy policy.
   • You can export your records at any time while your account is active.
   • Before entering members' personal data, the group must make sure it has a lawful reason to do so and that its members know their data is kept in e-Mali, as Law n° 058/2021 requires.
   • We may use anonymous, combined statistics that identify no group or person to run and improve the service.

5. Acceptable use

   You agree not to:

   • use e-Mali for anything unlawful, including fraud, money laundering or financing terrorism;
   • enter records you know to be false, or try to hide or alter the audit trail;
   • try to access another group's data or an account that is not yours;
   • test, probe or attack the security of e-Mali, overload it, or copy, resell or reverse engineer it;
   • upload malware or content that infringes someone else's rights.

   If you find a security problem, please tell us at info@e-mali.app, +250 789 261 140 or +250 780 840 983 instead of testing it further.

6. Availability, support and changes

   We work to keep e-Mali available and your data safe, with regular backups. The service may sometimes be unavailable for maintenance or for reasons outside our control, and we will try to announce planned maintenance in advance.

   We improve e-Mali over time, so features may change. If we remove a feature your group relies on, we will tell you in advance where we reasonably can. Support is available by phone, text message and email during working hours, Monday to Friday.

7. Our rights in e-Mali

   e-Mali, its software, design and brand belong to us or our licensors. These terms give your group the right to use e-Mali for its own operations while the account is active, and no other rights. Suggestions you send us may be used to improve e-Mali without any obligation to you.

8. Suspension and ending

   • A group can delete itself from its settings, without contacting us, but it takes two of its officers: one Admin or the President asks for the deletion, and another of them confirms it within 7 days. Each confirms the group's name and their own password or PIN. A cooperative also attaches the minutes of the General Assembly that decided it, as Law n° 057/2024 requires. Every Admin and the President are emailed at each step, and the request can be cancelled until it is confirmed.
   • Once confirmed, the group closes for everyone at once. For 30 days we can restore it if its officers ask us; after that the deletion is final and the group can't be turned back on.
   • A deleted group's records are not erased straight away: they stay stored, out of everyone's reach, for as long as the law requires the group to keep them, and are then deleted. Every step of the deletion, including who asked, who confirmed, when, from where and why, is kept in the audit log.
   • A deletion is the group's own decision, made by the officers it has given these roles. The group is responsible for it and for its consequences, including towards its members, and we are not liable for a deletion carried out in this way.
   • You can also stop using e-Mali by telling us.
   • We may suspend or close an account that breaks these terms, puts the security of e-Mali or other groups at risk, or where the law requires it. Unless the matter is urgent or the law prevents it, we will warn you first and give you a chance to fix the problem.
   • When an account ends, your data is handled as described in the free trial section and in our privacy policy.

9. Liability

   We provide e-Mali with reasonable skill and care. Apart from that and to the extent the law allows, e-Mali is provided as it is, and we do not promise that it will be free of errors or meet every need of your group.

   To the extent the law allows, we are not liable for indirect or consequential losses, such as lost profits or lost opportunities, or for losses caused by incorrect records entered by the group, by a user's misuse, or by events outside our reasonable control. Our total liability under these terms is limited to the amount the group paid us in the 12 months before the claim. Nothing in these terms limits liability that cannot be limited under Rwandan law.

10. Governing law and disputes

    These terms are governed by the laws of the Republic of Rwanda. If a disagreement arises, we will first try to settle it amicably by talking with you. If that fails within 30 days, the dispute will go to the competent courts of Rwanda.

11. Changes to these terms

    We may update these terms. We will publish the new version here with its date and tell group administrators at least 30 days before a significant change takes effect. If your group does not agree, it can stop using e-Mali and export its records before the change applies.

12. Contact

    Questions about these terms: info@e-mali.app, +250 789 261 140 or +250 780 840 983, or Tech & Us Ltd, KG 167 St, Kimironko, Kigali, Rwanda.