PRIVACY
POLICY.

This Privacy Policy explains how KibuGo Ltd ("we", "us", or "our") collects, uses, discloses, and safeguards your personal data when you use the KibuGo mobile application and website (collectively, the "Service"). We are committed to protecting your privacy and complying with the Rwanda Data Protection and Privacy Law (Law No. 058/2021 of 14/10/2021). This policy applies to all users of the Service, including players, field owners, and staff.

KibuGo Ltd, registered in Kigali, Rwanda, is the Data Controller responsible for your personal data under Law No. 058/2021. If you have any questions about this Privacy Policy or our data practices, you may contact us at support@kibugo.com.

We collect the following categories of personal data: (a) Account Information — full name, email address, phone number, profile photo, and date of birth; (b) Booking & Payment Data — booking history, preferred fields, payment confirmations via MTN MoMo or Airtel Money (we do not store PIN codes or full payment credentials); (c) Location Data — approximate location to surface nearby fields and pitches (collected with your consent); (d) Device & Usage Data — device model, operating system, app usage statistics, crash reports, and IP address; (e) Community Data — player ratings, reviews, and fair-play feedback you provide or receive.

Under Law No. 058/2021, we process your personal data on the following legal grounds: (a) your explicit consent; (b) the performance of a contract (your booking and participation in matches); (c) compliance with legal and regulatory obligations; and (d) our legitimate interests in operating, securing, and improving the Service.

We use your personal data to: (a) create and manage your account; (b) process bookings, split payments, and issue e-tickets with QR codes; (c) match you with players and fields; (d) verify identity at field gates via QR scanning; (e) send booking confirmations, reminders, and support messages; (f) maintain community trust through ratings and fair-play enforcement; (g) prevent fraud, abuse, and unauthorized access; and (h) analyze usage to improve the platform. We do not sell your personal data to any third party.

We may share your data with: (a) Field Owners — only the booking details necessary to fulfill your reservation (name, booking time, field); (b) Payment Processors — MTN MoMo and Airtel Money, solely to complete transactions; (c) Cloud Service Providers — hosting and infrastructure providers under data-processing agreements; (d) Law Enforcement — where required by Rwandan law or a valid court order. All sharing is limited to the minimum data necessary for the stated purpose.

KibuGo primarily stores and processes personal data within Rwanda. Where data is processed by cloud infrastructure located outside Rwanda, we ensure appropriate safeguards are in place, including standard contractual clauses and compliance with Law No. 058/2021's cross-border transfer requirements.

We retain your personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law. Booking and transaction records are retained for a minimum of five (5) years for accounting and tax compliance. Inactive accounts may be deleted after twenty-four (24) months of inactivity.

We implement bank-grade security measures including AES-256 encryption at rest, TLS 1.3 encryption in transit, strict access controls, and regular security audits. Payment credentials are never stored on our servers. Despite our efforts, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

As a data subject under Rwandan law, you have the right to: (a) be informed about how your data is used; (b) access the personal data we hold about you; (c) rectify inaccurate or incomplete data; (d) erase your personal data (the right to be forgotten); (e) restrict or object to processing; (f) data portability; and (g) withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal. To exercise any of these rights, contact us at support@kibugo.com.

The Service is not directed to children under 18 years of age. Users must be 18 or older, or have verifiable parental/guardian consent. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

Our website and app may use cookies and similar technologies to remember preferences, analyze traffic, and improve performance. You can control cookies through your device or browser settings. Disabling cookies may limit some functionality of the Service.

The Service may contain links to third-party websites or services (e.g., social media, payment providers). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies separately.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes via in-app notification or email at least thirty (30) days before the changes take effect. The "Last updated" date below indicates when the policy was last revised.

If you believe we have not handled your personal data in accordance with this policy or Law No. 058/2021, you have the right to lodge a complaint with the National Cyber Security Authority (NCSA) of Rwanda or the relevant data protection supervisory authority. We encourage you to contact us first at support@kibugo.com so we can address your concerns.

Users have the right to request the deletion of their personal data and account. To initiate a deletion request, please contact our support team at support@kibugo.com. Requests will be processed within 48 hours in accordance with Law No. 058/2021.