Privacy policy

Who we are

SwiftPass is a cashless payment and event access service operated by Zafrionet Ltd, a company registered in Rwanda. In this policy, "we" and "us" mean Zafrionet Ltd, and "you" means the person using the SwiftPass app.

For the purposes of Law No. 058/2021 relating to the protection of personal data and privacy, Zafrionet Ltd is the data controller for the information described here.

What we collect

Information you give us

• Your name, email address and mobile money phone number.
• A wallet PIN, which we store only as a one-way hash. We cannot read your PIN and neither can anyone at Zafrionet.
• Business details, if you register as a seller or an event organiser: trading name, category, and payout details.

Information created when you use SwiftPass

• Wallet balance and every transaction: top-ups, taps at a stall, money sent to another person, tickets bought, and withdrawals.
• Which wristband or card is linked to your account, and which band was presented for each payment.
• Tickets you hold and when they were scanned at a gate.
• Notification tokens, so we can tell you when a payment lands.
• Basic technical records needed to keep the service working and to investigate fraud.

Information from others

• Payment status and the name your mobile money account is registered under, from Centrika Ltd, so that money reaches the right account.
• Your name and profile photo, if you sign in with Google.

Why we collect it

What	Why
Name, email, phone	To create your account, verify it is yours, and send money to the right mobile money number.
Transactions and balance	To run the wallet, show you your history, settle with sellers, and answer disputes.
Band identifiers	To link a physical band to your account, and to answer "which band paid, and who held it" if something is queried later.
PIN hash, attempt counts	To protect your balance, and to lock the wallet after repeated wrong attempts.
Technical records	To keep the service running and to detect fraud and abuse.

We process this information to perform our agreement with you, to comply with Rwandan financial and anti-money-laundering law, and because we have a legitimate interest in keeping SwiftPass safe from fraud.

Who we share it with

We do not sell your personal information, and we do not share it for advertising. We share it only with the following, and only what each one needs:

• Centrika Ltd (XentriPay) — our payments partner, licensed by the National Bank of Rwanda. They receive your name, phone number, email and the amount, so that a top-up or a withdrawal can be processed.
• Google (Firebase) — hosting, sign-in, database and notifications. Data is stored on Google Cloud infrastructure.
• Event organisers and sellers — a seller sees the amount of a payment and enough to identify the payer for a refund. They do not see your balance, your other transactions, or your contact details.
• Authorities — where we are required by Rwandan law to disclose information, including to the National Bank of Rwanda or under anti-money-laundering obligations.

Transfers outside Rwanda

Google Cloud stores some data outside Rwanda. Where that happens we rely on the safeguards permitted under Law No. 058/2021, and we require our providers to protect your information to the standard set out in that law.

How long we keep it

What	Kept for
Your profile	While your account is open, then deleted when you close it.
Transaction records	Ten years from the transaction, as required of financial records in Rwanda. These are kept even after you close your account.
Band links	Kept as history, because a payment made with a band has to stay explainable.
Technical records	Up to 12 months.

Transaction records kept after closure are separated from your profile so far as the law allows, which means they remain as financial records rather than as a profile of you.

Your rights

Under Rwandan data protection law you may ask us to:

• tell you what personal data we hold about you;
• give you a copy of it;
• correct anything that is wrong;
• delete your account and the data we are not required to keep;
• stop processing your data in certain circumstances;
• object to processing based on our legitimate interests.

Write to info@zafrionet.com and we will respond within 30 days. To close your account, see Delete your account.

If you are not satisfied with our answer, you may complain to the National Cyber Security Authority, which supervises data protection in Rwanda.

How we protect it

• Your balance can only be changed by our servers. The app cannot write to it, and a modified app cannot make a wrong number true.
• Your PIN is stored as a one-way hash and is verified on the server, never on your phone.
• Data is encrypted in transit and at rest.
• Withdrawals go only to the mobile money number registered on your own account.
• Access to production data inside Zafrionet is limited to the people who need it, and is recorded.

Children

SwiftPass is for people aged 18 and over. We do not knowingly collect information from children. If you believe a child has created an account, write to info@zafrionet.com and we will close it and delete the data.

Changes

If we change this policy we will update the date at the top and, for anything significant, tell you in the app before the change takes effect.

Contact us