Privacy Policy
Last updated: June 23, 2026
Who we are
The data controller responsible for your personal data is:
- Ironji Trade Ltd. (trading as Ironji)
- 4th floor, Fairview Building, KG622 Street, Kimihurura, Kigali, Rwanda
- Company / TIN: 108377382
- Privacy contact: [email protected]
Personal data we collect
Depending on how you use Ironji, we collect the following categories of personal data:
Everyone
- Identity & contact data: name, phone number, email address.
- Account & security data: hashed password, two-factor settings, and sign-in records.
- Device & technical data: device identifiers, push notification token, IP address, browser/app user-agent and a derived device fingerprint used for sign-in security.
- Usage data: pages/screens viewed, open/close events, and your activity history.
Drivers & truck owners
- Identity documents: national ID or passport number, date of birth.
- Driver & vehicle data: driving licence number and image, vehicle plate number, truck type, parking location, and uploaded documents (motor inspection certificate, vehicle insurance, yellow card).
- Photos & documents: profile picture, delivery notes, and invoices captured during deliveries.
- Location & movement data: precise GPS location (including in the background while on duty), speed, heading and movement type. See Location data.
- Payment data: earnings, balances, and payment-reference details for settlements.
Customers
- Shipment data: pickup and delivery addresses, recipient contact details, and cargo descriptions.
- Billing data: invoice and payment details for the services you request.
How and why we use your data
We process your personal data only for lawful purposes connected to our logistics service, on the legal bases set out in Article 46 of Rwanda Law N° 058/2021:
| Purpose | Legal basis |
|---|---|
| Create and manage your account; provide the app and services | Performance of a contract |
| Assign, dispatch, track and complete shipments (incl. live location) | Performance of a contract; legitimate interests |
| Process payments, settlements and invoicing | Performance of a contract; legal obligation |
| Verify identity, secure sign-in, prevent fraud and abuse | Legitimate interests; legal obligation |
| Send service, security and operational notifications (SMS, email, WhatsApp, push) | Performance of a contract; legitimate interests |
| Improve and analyze the service | Legitimate interests (or consent where required) |
| Comply with tax, accounting and other legal requirements | Legal obligation |
Location data
Location is used to dispatch and track deliveries, share live progress with authorized dispatchers and customers, and confirm completed trips. You can stop background collection at any time through your device permission settings; doing so may limit the app’s functionality. Raw location fixes are retained for 30 days (see retention).
International data transfers
Some of our sub-processors are located outside Rwanda, so your personal data may be transferred and stored abroad. Where this happens, we rely on the conditions for transfer permitted under Articles 48–50 of Rwanda Law N° 058/2021 (such as appropriate safeguards, your consent, or necessity for performing our contract) and take steps to ensure your data remains protected.
How long we keep data
We keep personal data only for as long as necessary for the purposes above (Article 52), and then delete or irreversibly anonymize it:
| Data | Retention period |
|---|---|
| Account & profile data | Until you delete your account |
| Raw GPS location fixes | 30 days |
| Financial & accounting records | 10 years (Rwanda Tax Procedures Law, 2023), then anonymized |
| Security & sign-in audit logs | Limited period for security/legal purposes, then anonymized |
| Message delivery logs (SMS / WhatsApp / email) | Limited operational period at our messaging gateway |
For details on deletion, see our Account & Data Deletion page.
Your rights
Under Rwanda Law N° 058/2021 you have the right to:
- Access your personal data and information about how it is processed (Art. 18).
- Object to certain processing (Art. 19).
- Data portability — receive your data in a structured, readable format (Art. 20).
- Restrict processing in certain cases (Art. 22).
- Erasure — request deletion of your data (Art. 23).
- Rectification — correct inaccurate or incomplete data (Art. 24).
- Withdraw consent at any time, where processing is based on consent (Art. 8).
To exercise any of these rights, contact [email protected]. We will respond within 30 days.
How we protect your data
We apply appropriate technical and organizational measures to protect your data (Article 47), including encryption of data in transit, hashed passwords, two-factor authentication, access controls, and monitoring for unauthorized access. No system is completely secure, but we work to protect your information and to respond promptly to any incident.
Children's data
Our services are intended for adults (drivers, partners and business customers) and are not directed at children under 16. We do not knowingly collect the personal data of children. If you believe a child has provided us data, contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above. Significant changes will be communicated where appropriate.
Contact & complaints
For any privacy question or to exercise your rights, contact us at [email protected] or +250 783 889 601.
You also have the right to lodge a complaint with Rwanda’s data protection supervisory authority, the National Cyber Security Authority – Data Protection & Privacy Office (NCSA/DPP).