BRD MOBILE APP PRIVACY POLICY

1. WHO WE ARE

The App is operated by the Development Bank of Rwanda Plc, which is the controller of the personal data processed through the App. We process personal data in accordance with Law No 058/2021 of 13/10/2021 relating to the protection of personal data and privacy in Rwanda and other applicable laws. BRD is registered as a data controller with the National Cyber Security Authority (NCSA), the supervisory authority in Rwanda.

2. PERSONAL DATA WE COLLECT

We collect the following personal data when you register for and use the App. Some of this data is mandatory, we cannot open or operate your account, or assess a loan, without it (for example, identity, contact and account security data). Other data is optional, and you may choose whether to provide it. We will tell you at the point of collection where data is required.

2.1 Identity data: first and last name, date of birth, gender, National ID or passport number.

2.2 Contact data: phone number, email address and physical address (including district and sector).

2.3 Business data: company name, Tax Identification Number (TIN) and business registration details, where you apply on behalf of a business.

2.4 Financial data: bank account details, loan applications, loan and repayment information, and other information you provide to support a loan application. Where a payment is made through the App, it may be processed by a bank, card network or payment provider; we receive transaction confirmation details but do not receive or store your full payment card number.

2.5 Documents: files you choose to upload, such as identification documents, business plans and financial statements.

2.6 Account and security data: login credentials, PIN and one-time passwords (OTP) used to access your account and authorize actions.

2.7 Device and technical data: information collected automatically when you use the App, such as device type and operating system, App version, device identifiers, IP address, and app usage and diagnostic logs, used to operate, secure and troubleshoot the App.

3. HOW WE USE YOUR PERSONAL DATA

We use your personal data to:

3.1 Create and manage your account and verify your identity.

3.2 Receive, assess and process your loan applications, and show you your loan information. Where we use automated processing or profiling to help assess an application, a decision that produces legal or similarly significant effects for you will not be based solely on automated processing, and you may request human review, as provided by the Law.

3.3 Communicate with you about your account, applications and our services, including by SMS and email.

3.4 Keep the App and your account secure and prevent fraud.

3.5 Comply with our legal and regulatory obligations, including anti-money laundering and counter-terrorist financing requirements.

We do not sell your personal data and do not use it for third-party advertising.

4. HOW WE SHARE YOUR PERSONAL DATA

We only share your personal data where it is necessary for the purposes above, with:

4.1 Government agencies used to verify your identity or business, such as the National Identification Agency (NIDA) and the Rwanda Development Board (RDB).

4.2 Regulators, courts and law enforcement authorities, where required by law.

4.3 Banks and financial institutions, where needed to validate your bank account or process a loan.

4.4 Service providers that host or operate our systems or send messages on our behalf, who may only process your data on our instructions and must keep it confidential.

5. DEVICE PERMISSIONS

5.1 Biometrics (Face ID / fingerprint): if you enable biometric login, the check is performed by your device. We do not receive or store your fingerprint or face data.

5.2 Files and documents: the App only accesses the files you choose to upload or download.

5.3 Third-party services and links: the App relies on third-party providers (such as app stores, hosting and messaging providers) and may contain links to third-party websites or services. Those third parties process information under their own privacy policies, which we encourage you to review; we are not responsible for their practices.

6. HOW WE PROTECT YOUR PERSONAL DATA

We use appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration or disclosure. Data is encrypted in transit, and credentials stored on your device are kept in the device's secure storage. While we take reasonable steps to protect your personal data, like any digital service we cannot guarantee complete security. We will notify you and the supervisory authority of any personal data breach as required by Law.

7. DATA RETENTION

We keep your personal data for as long as your account is active and afterwards only for as long as required to meet our legal, regulatory, accounting and dispute resolution obligations. When it is no longer needed, it is securely deleted or anonymized. Residual copies may remain in secure backup or disaster-recovery systems for a limited period until they are overwritten in the ordinary course; such copies are not used for ordinary business purposes.

8. YOUR RIGHTS

Subject to applicable law, you have the right to:

8.1 Be informed about how your data is used and access a copy of it.

8.2 Have inaccurate data corrected.

8.3 Request erasure of your data, or restriction of or objection to its processing.

8.4 Withdraw consent where processing is based on consent.

8.5 Receive your data in a structured, commonly used format and, where feasible, have it transferred to another controller (data portability).

8.6 Lodge a complaint with the National Cyber Security Authority (NCSA), the personal data protection supervisory authority in Rwanda.

To exercise these rights, contact us using the details in section 12.

9. ACCOUNT AND DATA DELETION

You can request deletion of your account and associated personal data by calling 3288 or emailing secretariat@brd.rw. We will verify your identity and delete your data, except data we are legally required to keep (for example records of loans and transactions), which will be retained only for the period required by law.

10. CHILDREN

The App is not intended for persons under 16 years of age. We do not knowingly collect personal data from a person under 16 without the consent of a holder of parental responsibility over that person, as required by the Law. If we become aware that we have collected a child's personal data without such consent, we will delete it.

11. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. The latest version will always be available on the Bank's website with its "Last updated" date, and we will notify you in the App of material changes.

12. CONTACT US

For any questions, requests or complaints about this Privacy Policy or your personal data, contact the Development Bank of Rwanda Plc by calling 3288 or emailing secretariat@brd.rw.