We respect your right to privacy, it is very important to us, and we take the protection of your privacy and ensuring the security of your Personal Data very seriously. 

We are committed to the fair and transparent Processing of your Personal Data. This Privacy Notice describes how we Process your Personal Data, explains your rights in relation to the Personal Data we Process, and states our commitment when Processing your Personal Data in a compliant, ethical and secure manner. 

Who are we

We are MTN Rwandacell PLC. 

In this privacy notice “MTN”, “we”, “our” and “us” refers to

MTN Rwandacell PLC and its subsidiaries.

Who does this notice apply to?

This notice applies to individuals that are:

• any person(s) who contracts with us for the provision of products and services, or who purchases a product from us (“customers”), including potential customers to the extent MTN Processes your Personal Data;
• any person(s) who uses our website, mobile applications or any products or services (“users”); 
• all suppliers, contractors, and service providers of MTN (“suppliers”) including potential suppliers to the extent MTN Processes your Personal Data; 
• resellers such a MTN distributors and agents as well as partners (“resellers”) including potential resellers to the extent MTN Processes your Personal Data; and
• any other person (s) (save for employees and job applicants) who share Personal Data with MTN including beneficiaries, trustees, or donors to MTN trusts or charitable causes; MTN guests (“other Data Subjects”).

Important terms you need to understand when reading this notice?

Personal Data	means any information relating to an identified or identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, psychological, genetic, mental, economic, cultural, or social identity of that natural person.
Sensitive Personal Data	means any information revealing a person’s race, health status, criminal records, medical records, social origin, religious or philosophical beliefs, political opinion, genetic or biometric information, sexual life, or family details.
Cookies	means a small text file placed on your computer or device by Our Site when you visit certain parts of Our Site and/or when you use certain features of Our Site. Details of the Cookies used by Our Site are set out below.
Data Controller	means a natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the way any personal data are or are to be, processed. For this Privacy Policy, we are a Data Controller of your data.
Processing	Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, including collection, receipt, recording, organization, structuring, collation, storage; adaptation or alteration, updating, retrieval, consultation, use, dissemination, disclosure by means of transmission; or otherwise making available, alignment or combination, merging, restriction, erasure, destruction, and/or degradation.
Data Processor (or Service Provider)	means any natural or legal person who processes the data on behalf of the Data Controller. We may use the services of various Service Providers to process your data more effectively.
Data Subject	is any living individual who is the subject of Personal Data
User	means the individual using our Service. The User corresponds to the Data Subject, who is the subject of Personal Data

What Personal Data does MTN collect and use?

• Personal information collected and held by us may include but is not limited to; name, sex, date of birth, addresses, International Mobile Equipment Identity, mobile phone number, email address, occupation and information contained in supporting documents such as proof of identity and proof of address. 
• MTN and its authorized third parties may collect, store, and process the following types of Personal Information: biometric data, financial information, for providing our products, services and for use of our website, information related to your utilization of our services which may include your call patterns, your browsing history on our website, location details and additional information provided while using our services.

Where does MTN collect my Personal Data from?

In most circumstances we collect Personal Data directly from you, for instance, when you acquire our SIM card, when you buy or use any of our products or services, visit our website, or interact with our customer services departments. 

In some instances, however, we will also collect your Personal Data indirectly from third parties. And MTN will ensure that proper steps are taken.

For what purposes does MTN use your Personal Data?

• MTN collects your personal information for a variety of business purposes. These include, but are not limited to:
• Verifying your identity.
• Completing transactions effectively and billing for products and services.
• Responding to your request for service or assistance.
• Performing market analysis and research as well as business and operational analysis.
• Contracting and processing orders: we Process your Personal Data to meet our contractual obligation and to process your request so as to provide products and services and to keep you updated with your order progress and to provide our products and services to you.
• Providing, maintaining, and improving our products and services.
• Anticipating and resolving issues and concerns related to our products and services.
• Promoting and marketing our products and services which may benefit you and be related to products and services you are currently enjoying; and
• Fraud and crime prevention: We process your Personal Data to detect and prevent fraud or criminal activity using our products or services.
• MTN may keep a log of the activities performed by you on our network and websites by using various internet techniques such as web cookies, web beacons, server log files, etc. for analytical purposes, for analysis of the agreeableness of various features on our site and in accordance with requisite legal requirements. This information may be used to provide you with a better experience on our platforms. 
• At any time while you are browsing our site, if you do not wish to share browsing information, you may opt out of receiving the cookies from our site by making appropriate changes to your browser privacy settings. 
• If you do not provide your consent for usage of personal information or later withdraw your consent for use of the personal information so collected, MTN may not be able to provide certain products and services to you.

Is MTN allowed to Process my Personal Data?

We are allowed to Process your Personal Data, so long as we have a legal basis to do so (i.e. there is a justification to Process your Personal Data in terms of laws applicable to MTN and/or our policies permit such Processing). When we Process your Personal Data, we will rely on one of the following legal bases, as appropriate, having regard to the purpose of Processing:

• Legal Obligation: In some circumstances, where the processing of personal data is necessary for the performance of an obligation conferred or imposed by law on MTN, we will rely on Legal Obligation as a basis to process the personal information you have provided.  
• Legitimate Interest: Our legitimate business interests, for example, direct marketing and improvement of our services. Whenever we rely on this lawful basis to process your data, we assess our business interests to make sure they do not override your rights. Additionally, in some cases, you have the right to object to this process. See the “Your Rights” section of the statement.
• Consent: We may rely on the consent you provide in the absence of any other legal basis. Consent will always be presented separately to you, can be withdrawn at any time and you will be given details on how to do so.
• We rely on contract as a legal basis to process your personal information when we need to deliver a contractual service to you or when it has become necessary to process data before entering into a contract with you. 

Is it mandatory to provide MTN the Personal Data asked for?

It is not mandatory for you to provide any Personal Data to us. However, failing to provide certain Personal Data to us, particularly where that Personal Data has been requested by us may impact our ability to, amongst other things:

• provide our products or services to you;
• to support you with and manage our products and services; 
• provide you full functionality to all our web pages; 
• on-board you as a supplier, reseller, contractor, or service provider;
• to allow you access to our premises or buildings.

Does MTN Process my Personal Data automatically?

MTN does not perform any automated decision-making (including profiling) which results in legal consequences for you and/or which affects you in a similarly significant manner. Should this change in the future, we will notify you and update this privacy notice accordingly.

How long does MTN keep my Personal Data for?

We will not retain your Personal Data for any longer than is necessary for achieving the purpose(s) for which the Personal Data is Processed, unless:

• retention of the Personal Data is required or authorized by Local laws;
• you have consented to the retention of the Personal Data; or
• the Personal Data is required for historical, statistical, or research purposes and provided that we have established appropriate safeguards against the Personal Data being used for any other purposes.

We will ensure that Personal Data that is no longer required, or which we are no longer authorized to retain, is as soon as reasonably practicable, de-identified, or destroyed through secure means, alternatively through permanent erasure by appropriate and effective mechanisms.

Does MTN transfer my Personal Data to third parties?

Yes, we do share Personal Data with affiliated third parties, as necessary for our legitimate business needs, to carry out your requests, and/or as required or permitted by law. This would include:

• Our service providers: We transfer your Personal Data to our third-party service providers, such as our (IT) systems providers, our hosting providers, consultants (such as legal advisers) and other goods and services providers. These providers Process your Personal Data on behalf of MTN in terms of a binding agreement with appropriate security safeguards. MTN will only transfer Personal Data to such a service provider when they meet our strict standards on the Processing of data and security. We only share Personal Data that allows our service providers to provide their services and they are not allowed to Process your Personal Data for any other purpose.
• If we are reorganized or sold to another organization: MTN may disclose Personal Data in connection with the sale, assignment, or other transfer of the business to which the data relates.
• Courts, tribunals, law enforcement, or regulatory bodies: MTN may disclose Personal Data in order to respond to requests of courts, tribunals, government, or law enforcement agencies or where it is necessary or prudent to comply with applicable laws, court or tribunal orders or rules, or government regulations.
• Audits: disclosures of Personal Data may also be needed by our auditors including to perform financial audits, data privacy or security audits and/or to investigate or respond to a complaint or security threat.
• Insurers: our business requirements mean that we carry significant insurance cover in respect of business activities. There are several different participants in the insurance market (e.g., brokers, insurers, and reinsurers, as well as their professional advisors and other third parties involved should there be a claim). Some of these insurance market participants will require that we disclose Personal Data about you to them. The information will be used by the insurance market participants in the underwriting and ongoing administration of the insurance products, where there is a claim that you are relevant to and to allow the insurance market participants to comply with their legal and regulatory obligations. Some of these insurance market participants will handle this information on our behalf (like our service providers described above), but others will want to Process information about you independent of us. 
• Other third parties: we may share information with other third parties who use MTN platforms/systems to advertise their product. However, the Personal Data collected is anonymized and/or aggregated prior to sharing with such third parties. 

Does MTN transfer my Personal Data internationally?

MTN may transfer your personal information or other information, or data collected, stored, and processed to any other entity or third party located outside the country of service, only if necessary, for legitimate business purposes for providing services to you. This may also include sharing aggregated information with third parties contracted to MTN for them to understand our environment and consequently, provide you with better services. While sharing your personal information with third parties, reasonable organizational, technical, and security measures shall be taken to ensure that reasonable security practices are followed by the third party and are in line with the Data Protection Principles and Regulations

How does MTN secure my Personal Data?

MTN secures the integrity and confidentiality of the Personal Data in its possession or under its control by implementing appropriate, reasonable technical, physical, and organizational measures to prevent:

• accidental loss of, damage to, or unauthorized destruction of your Personal Data;
• unlawful or unauthorized access to your Personal Data; and
• unlawful or unauthorized Processing of your Personal Data.

As part of its processes, MTN takes reasonable measures to regularly identify and assess all reasonably foreseeable internal and external risks to Personal Data in its possession or under its control and implements reasonable and appropriate technical, physical, and organizational security measures to protect against the identified risks. 

How does MTN handle Personal Data Breaches?

While MTN implements reasonable measures to prevent or reduce the likelihood and impact of Personal Data Breaches, this risk can’t be completely eliminated. If MTN becomes aware of or reasonably suspects a Personal Data Breach has occurred or that the integrity or confidentiality of Personal Data has been compromised, MTN adheres to its incident management Policies, Procedures and supporting documents governing the handling and reporting of Personal Data Breaches. 

What are my rights?

If MTN Processes Personal Data about you, you have the following rights:

• • Right to access personal information
    • You have the right to make a request for a copy of the personal information that MTN holds about you (including advertising audience categories and inferred information) as permitted by law.

• Right to correct personal information

• • • You have the right to correct information held about you to ensure it is accurate, relevant, complete, and not excessive. 

• Right to object to use of personal information

• • • You have the right to object to MTN processing your personal information, in certain circumstances as permitted by law. However, in instances where the basis for processing is Legal Obligation, you may not be able exercise your right to object. 

• Right to opt-out of marketing messages

• • • MTN will not issue targeted marketing to you unless you consent for us to do so. If you no longer want to receive marketing messages from MTN, you can choose to opt out at any time using the means made available to you. If you have previously opted in to receive personalized content based on how and where you use our network, you can also opt out at any time.  
  • Right to personal data portability
    • You have the right to request MTN, in writing or electronically to resend the personal data concerning you as it was provided to MTN, in a structured and readable format.
    • You also have the right to request the data controller in writing or electronically to have your personal data transmitted to another data controller, where technically feasible, without hindrance.

• Right to restriction of processing of personal data

• • You have the right to restrict MTN from processing your personal data for a given period under the conditions provided by the Law. Note that incase the purpose of collecting and processing your information was to meet our contractual obligation to you, objection to processing may hinder us from providing our services and products to you.
• Right to erasure of personal data
  • You have the right to request MTN in writing or electronically for the erasure of your personal data under the conditions provided by the Law.

You can make a request or exercise these rights by contacting MTN at dataprivacyoffice.rw@mtn.com and we will make all reasonable and practical efforts to comply with your request, so long as it is consistent with applicable law and internal policies.

Finally, you always have the right to lodge a complaint with the supervisory authority in charge of protecting Personal Data, the Data protection office, whose contact details are: 

• Postal Address: 21 KG 7 Ave, Kacyiru, Kigali-Rwanda

• Email Address: complaint@dpo.gov.rw, databreach@dpo.gov.rw

• Telephone number: +250 782 847 756 or 9080

• Website: https://dpo.gov.rw/

Changes to privacy policy

MTN may modify this Privacy Notice from time to time to reflect our current privacy practices. When we make changes to this notice, we will revise the “effective” date at the top of this notice and any changes affecting you will be communicated to you through an appropriate channel, depending on how we normally communicate with you.

Contact us.

If you have any questions or concerns regarding this Privacy Notice and would like further information about how we protect your information and/or when you want to contact your local Data Protection Officer (DPO), please email us at dataprivacyoffice.rw@mtn.com