Privacy Policy
Last updated: 12 March 2026
1. Who we are
MATABARO TECH Ltd is an IT consulting and software development company registered in Rwanda. Our principal place of business is Kigali, Rwanda. Contact: gedeon@matabaro.com
2. Data we collect
We collect three categories of data. Personal data: your name, email address, company name, and the content of enquiry forms or messages you submit through this website. Payment data: when you purchase services or a Pinakly subscription, we collect billing name and billing address. Full card or mobile-money credentials are handled exclusively by our payment processor, DPO Group; we receive only a transaction reference and a masked payment method identifier. Technical data: anonymised page views, referrer URLs, and session identifiers collected via technically necessary cookies to operate the site.
3. How we use your data
We use your data to respond to enquiries, scope and deliver services you have engaged us for, process payments via DPO Group, send transactional emails (quote confirmations, booking confirmations, invoices), and — with your consent — send occasional newsletters. We do not sell or rent your personal data to third parties.
4. Legal basis (Rwanda Law No. 058/2021)
We process personal data in compliance with Rwanda’s Law No. 058/2021 on Protection of Personal Data and Privacy. Our legal bases are: (a) contract — to fulfil services you have requested; (b) legitimate interest — to communicate with prospective clients and improve our services; (c) consent — for marketing communications; and (d) legal obligation — to retain financial records as required by Rwandan tax and accounting law.
5. Payment processing
Payments are processed by DPO Group (Direct Pay Online), a PCI DSS-certified payment service provider. When you make a payment, DPO Group collects and processes your card or mobile-money details under their own privacy policy and terms of service. We do not store or have access to your full card number or mobile-money credentials. DPO Group retains transaction data in accordance with their own data retention obligations and applicable financial regulations.
6. Third-party data sharing
We do not sell your personal data. We share data only where necessary: with DPO Group for payment processing; with cloud hosting and email delivery providers under data processing agreements; and with law enforcement or regulatory authorities where we are legally required to do so. Analytics data, where collected, is anonymised before sharing.
7. Data retention
Contact enquiry data is retained for up to 36 months. You may request deletion at any time by emailing us. Booking and invoice records are retained for 7 years to satisfy Rwandan tax and accounting obligations. Payment transaction references supplied by DPO Group are retained for the same period.
8. Your rights
Under Rwanda Law No. 058/2021, you have the right to access, correct, or delete your personal data; to receive a portable copy of data we hold about you; to object to certain processing; and to withdraw consent for marketing at any time. Email gedeon@matabaro.com to exercise any of these rights. We will respond within 30 days.
9. Cookies
We use technically necessary cookies for session management — these are required for the site to function and cannot be disabled. Where analytics are active, they operate in anonymised, cookieless mode and do not track individuals across sites. We do not use advertising cookies or third-party tracking pixels. You can disable non-essential cookies through your browser settings; note that disabling session cookies may affect site functionality such as form submissions and bookings.
10. International data transfers
Our services are primarily delivered from Rwanda. Some data may be processed by our cloud hosting or email providers in the EU or other jurisdictions. Any cross-border transfers are conducted under appropriate safeguards in line with Rwanda Law No. 058/2021. DPO Group processes payments in accordance with their own cross-border transfer policies and PCI DSS standards.
11. Changes to this policy
We may update this policy periodically. Material changes will be notified via a banner on this website at least 14 days before taking effect.