Privacy policy
Last updated
Who we are
This website is operated by HEOR Africa, with offices in Kigali, Rwanda, and Addis Ababa, Ethiopia (“we”, “us”). We are the data controller for personal data collected through this website.
For any privacy question or request, contact hello@heorafrica.com.
The laws that apply
We process personal data in accordance with:
- Rwanda: Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy (“the Rwanda data protection law”). We are registering with the National Cyber Security Authority (NCSA), Rwanda’s data protection supervisory authority.
- Ethiopia: the Personal Data Protection Proclamation No. 1321/2024 (“the Ethiopia data protection law”), which is overseen by the Ethiopian Communications Authority.
We also comply with other laws that apply to our work.
What we collect and why
| Data | When | Purpose | Lawful basis |
|---|---|---|---|
| Name, organisation, email, request details | When you submit the contact form | To respond to your enquiry and discuss a possible engagement | Your consent, and steps taken at your request before entering into a contract |
| Name, organisation, email | When you request a resource download | To send you the resource and, only if you opt in, occasional updates | Your consent |
| Email address | When you subscribe to the newsletter | To send the newsletter | Your consent (you can unsubscribe at any time) |
| Booking details | When you book a call through Cal.com | To schedule and hold the call | Your consent, and steps taken at your request |
| Phone number, name and message content | When you contact us on WhatsApp | To reply to your message | Your consent, and steps taken at your request |
| Aggregate, anonymous usage statistics | When you visit the site | To understand which pages are useful | Our legitimate interest in improving the site |
We do not sell personal data, and we do not use it for automated decision-making or profiling.
Analytics without cookies
We use Umami, a privacy-focused analytics service that does not use cookies and does not collect personal data. It records aggregate information such as pages viewed, referring websites and device type. IP addresses are not stored.
Service providers
We use the following providers to run this website. Each processes data only on our instructions.
- Hosting: Netlify, Inc.
- Forms: Formspree, Inc.
- Scheduling: Cal.com, Inc.
- Messaging (only if you choose to contact us on WhatsApp): WhatsApp, operated by Meta Platforms
- Analytics: Umami Software, Inc.
Transfers outside Rwanda and Ethiopia. Personal data submitted through this website may be processed by these providers outside Rwanda and Ethiopia, including in the United States. We transfer personal data outside Rwanda and Ethiopia only in line with the cross-border transfer requirements of the Rwanda and Ethiopia data protection laws.
How long we keep data
We keep personal data only for as long as it is needed for the purposes described above, and then delete or anonymise it. Newsletter details are kept until you unsubscribe.
Your rights
Under the Rwanda and Ethiopia data protection laws you have rights including the right to be informed, to access your personal data, to object to processing, to have inaccurate data corrected, to have data erased, to restrict processing and to data portability.
To exercise your rights, email hello@heorafrica.com. If you are not satisfied with our response, you may complain to the National Cyber Security Authority of Rwanda or, in Ethiopia, the Ethiopian Communications Authority.
Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls and data minimisation.
Client and project data
This policy covers data collected through the website. Data shared with us during an engagement is governed by the confidentiality and data processing terms of that engagement.
Changes
We will post any changes on this page and update the date above.