Rushcart Privacy Policy

Version 1.0 · Last updated: 27 October 2026 · Effective: 27 October 2026

This Privacy Policy explains how Rushcart LTD ("Rushcart", "we", "us") collects, uses, shares and protects personal data when you use Rushcart to order, send, deliver or sell. It covers our apps Rushcart (for customers), Rushcart Courier and Rushcart Merchant (including the Rushcart Merchant web app), our website at rushcart.co (including the parcel tracking page), and our support channels.

We have tried to write it so that it can actually be read. If you only have a minute, start with Privacy at a glance. Then go to the part that applies to you: Customers · Parcel senders and recipients · Couriers · Merchants · Website visitors. To delete your account, go straight to Deleting your account and data.

1. Who we are and how to contact us

Rushcart LTD is the data controller for the personal data described in this policy. That means we decide why and how it is used, and we are responsible for protecting it under Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy ("the Law").

Data Protection Officer. As the Law requires, we have designated a Data Protection Officer (DPO). The DPO advises us on data protection, monitors how we comply, and is our contact point with NCSA. You can write to the DPO at privacy@rushcart.co, or by post to "The Data Protection Officer, Rushcart LTD" at the registered address above.

When someone else is also responsible. Some organisations that receive your data through Rushcart also use it for their own legal or business purposes and are responsible for that use themselves. This applies to:

• merchants, for their own records, such as a pharmacy's dispensing and prescription records;
• payment partners, such as licensed mobile-money operators and card processors, where those payment methods are available;
• authorities that receive data from us under the law.

Their own privacy notices apply to that use. This policy explains what we share with them and why.

2. Who and what this policy covers

Services covered

People covered

• Customers: people with a Rushcart account who order or send things.
• Parcel senders and recipients, and people you order for: including people who never create an account.
• Couriers: people who apply to deliver with Rushcart, and active couriers.
• Merchants and their staff: business owners and the people who handle orders for them.
• Website visitors and waitlist sign-ups.
• People who contact us, for example through support.

One account per phone number. A phone number is one Rushcart account, even if you use more than one app. For example, a courier who also orders food has one account with two roles. This affects account deletion.

Not covered by this policy

• What merchants do with your data outside Rushcart, for example their own loyalty schemes or a pharmacy's legally required records.
• What payment partners do with your data for their own legal obligations.
• Navigation apps (such as Google Maps, Waze or Apple Maps) that a courier chooses to open. Those apps handle data under their own terms.
• Personal data about Rushcart's own employees, which is covered by a separate internal notice.

Age. Rushcart accounts are for people aged 18 or over. See Children.

3. Words we use

Legal grounds

The Law only lets us use personal data when we have a legal ground for it. In the tables below we use these short names:

For sensitive personal data, we rely only on the narrower grounds in Article 10 of the Law. We explain which ones in section 11.

Required or optional. The Law asks us to tell you whether you must provide each piece of information and what happens if you don't. The last column of each table in sections 4 to 8 does this.

4. Customers

This section covers people who use the Rushcart app to order from merchants or to send parcels.

4.1 Information you give us

4.2 Information created when you use Rushcart

4.3 Information we get from other people and sources

• Couriers give us proof-of-delivery photos, reasons a delivery could not be completed, reports that a customer was not there, and any safety reports.
• Merchants tell us whether they accepted your order and when it was ready, and may reply in chat.
• Other customers who send you a parcel give us your name and phone number. See section 5.
• Payment partners, where those payment methods are available, tell us whether a payment succeeded, its reference and, for mobile money, possibly the name on the account.
• Our staff add notes to support cases and record refunds, credits and safety decisions.
• Authorities may give us information as part of a lawful request or investigation.

5. Parcel senders, recipients and people you order for

5.1 If you send a parcel or order for someone else

When you send a parcel, or have an order delivered to someone else, you give us information about other people: their name, phone number and where they are. When you do this:

• Only give us details you are entitled to share. Make sure the person knows you are using Rushcart to send them something and that we will contact them about it.
• We use their details only for that delivery. We do not use a recipient's number for marketing, and we do not add them to any marketing list.
• Your saved parcel contacts stay on your phone. The Rushcart app can remember up to 6 recent senders and 12 recent recipients so you don't have to retype them. That list is stored only on your phone and is not uploaded to our servers. A contact's details reach us only when you use them on a parcel. You can clear the list in Account › Saved people, and it is cleared when you sign out.
• We do not read your phone's address book. The Rushcart apps do not ask for access to your contacts.

5.2 If someone sends you a parcel

You may be reading this because someone used Rushcart to send you something. Here is what that means for you, even if you don't have a Rushcart account.

What we receive about you. From the sender, we receive your phone number (always), your name (if they gave it), where to deliver, and any delivery notes. We also hold the sender's name, a description of the parcel and its declared value.

How we contact you. We send you up to three text messages about that parcel, in Kinyarwanda and English:

1. when a courier is assigned: who is sending you the parcel, and the delivery code to give the courier (plus a tracking link, where we provide one);
2. when the courier has picked up the parcel;
3. when the courier arrives, with the delivery code again.

These messages are part of delivering the parcel to you, not marketing. We don't use your number for anything else.

The courier. The courier sees your name, phone number, drop-off location and notes, and may call or text you to find you. If the parcel is to be paid for on delivery, the courier collects the payment.

If you have a Rushcart account with the same phone number, the parcel also appears in your Rushcart app. There you can see the sender's name, the courier's name, phone number, vehicle and plate, and the courier's position on a map while the parcel is on its way to you. You never see the sender's phone number, pickup address or declared value.

Declining a parcel. If you have a Rushcart account, you can decline the parcel in the app before it arrives and choose a reason: "I don't know the sender", "I wasn't expecting it", "I'm not available" or "Other". The reason is shared with the sender and with our support team. Without an account, you can refuse the parcel at the door. Either way, we keep a record of the decline and its reason with the order for 2 years (see section 17).

High-value parcels. For some high-value parcels, the courier checks an ID document matching the recipient's name at the door. We record only that the check was done. We do not record your ID number and we do not take or keep a picture of your ID.

Proof of delivery. The courier may take a photo when handing over the parcel. The sender, the courier and our support team can see it.

Your rights without an account. You can ask what we hold about you, ask us to correct or delete it, or ask us to stop contacting you about a parcel. Email privacy@rushcart.co with your phone number and the date of the delivery or the delivery code. To check it is you, we will send a code to that phone number. See section 19.

5.3 The public tracking page

Where we send a recipient a tracking link, it opens a page on our website at an address that starts with rushcart.co/t/ followed by a long random code. The page is designed to show as little as possible.

What the page shows:

• the stage of the delivery and the estimated arrival time, as a range;
• the recipient's name and the sender's name, as the sender entered them (never the sender's phone number);
• the courier's first name and the last digits of their phone number only (for example •••3456), so the recipient can recognise the right courier at the door;
• the current delivery code.

What the page never shows: a map or the courier's location, the courier's vehicle or plate, anyone's full phone number, any address, the parcel's contents or value, or photos.

When it changes. The courier's details, the delivery code and the arrival estimate disappear as soon as the order ends. We switch tracking links off no later than 30 days after the order ends.

Who can see it. Anyone who has the link can open the page, so only forward it to people you trust. The delivery code works like a key to the parcel: don't share it with anyone except the courier at the door.

Privacy protections. The page:

• tells search engines not to index it;
• does not pass its address on to other websites;
• sets no cookies and runs no analytics;
• loads nothing from other companies;
• limits how often it can be loaded.

When someone opens it, our servers and website host record technical information, such as the IP address and browser type, in short-term logs (see section 17).

6. Couriers

This section covers people who apply to deliver with Rushcart and people who deliver using Rushcart Courier.

6.1 Information you give us

6.2 Information created when you use Rushcart Courier

6.3 Information we get from other people and sources

• Customers rate you and may leave comments. You see your ratings and comments, but not who left them. If you have only a few ratings, we also hide the dates and comments so the rater cannot be identified.
• Merchants confirm handovers and may report problems.
• Our staff record document review decisions, vetting decisions, support notes and any adjustment to your reliability score.
• Insurers, police or other authorities may give us information after an incident.
• Background checks: we do not run criminal-record or other background checks today. If we introduce them, see section 11.3.

7. Merchants and their staff

This section covers business owners and staff who use Rushcart Merchant on a phone or on the web. Most store information (menus, prices, opening hours) is business information. It becomes personal data where it relates to a person, such as an owner, a staff member or a sole trader.

If we introduce merchant verification. We may in future ask merchants for the owner's identity, the business's RDB registration number, its tax identification number (TIN), its electronic billing (EBM) details and, for pharmacies, a pharmacy licence. This would be to verify businesses and meet tax and sector rules. We will update this policy before we start.

Your responsibilities as a merchant. You receive customers' names, notes, order details and, once you accept an order, their phone number. Our terms with merchants require you to use this information only to fulfil the order and to keep it secure. Any records you are legally required to keep, such as a pharmacy's dispensing records, are your own responsibility as a controller.

8. Website visitors, waitlist sign-ups and people who contact us

Website visitors

Our website sets no cookies, uses no analytics, and shows no advertising. Pages are served by our website hosting provider. Our main pages load fonts from Google Fonts, which means your browser sends your IP address and basic browser information to Google when you open them. The parcel tracking page loads nothing from any other company (section 5.3).

Waitlist sign-ups

If you join our waitlist on rushcart.co, we collect:

• your email address (required);
• whether you want to use Rushcart as a customer, merchant, courier or business (required);
• your city (required);
• your name, phone number and business name (all optional);
• whether you want to try test versions of our apps (optional);
• the page you signed up on.

We use these details to tell you when Rushcart launches in your area, to invite you to test versions if you asked, and, if you gave a phone number, to call you instead of emailing. When you sign up, our team receives an email alert with your details. Legal ground: consent. You can withdraw at any time by emailing privacy@rushcart.co, and we will delete your sign-up. We delete sign-ups once we launch in your area or invite you, and no later than 12 months after you sign up.

People who contact us

When you contact support, we keep your phone number, your messages, any photos you attach, which channel you used, and, if you choose to give one, your satisfaction rating. Support agents may see the order you are asking about and its chat. Our agents are identified to you by an alias. If you message our WhatsApp business number, we receive your WhatsApp number and messages. We do not record support phone calls; if we ever start, we will tell you at the start of the call. Legal ground: contract, legitimate interests (handling complaints and improving service), and legal obligation where the law requires us to keep a record.

9. Location

9.1 Customers: only when you choose to use it

The Rushcart app asks for location permission only when you tap "Use my current location". It never asks when you open the app, and it never uses your location in the background.

• What we use it for: to drop your delivery pin, or a parcel pickup point, near where you are. If you have already allowed location, the parcel screen may suggest your current position as the pickup point.
• What you can do instead: search for a place, or move the pin on the map yourself. You can use every part of the app without allowing location.
• What we store: the pins you save or use on orders, not a history of where you have been. We do not follow your location while you wait for an order.
• Who else receives it: to suggest addresses and name the place under your pin, the app sends what you type, and the pin's position, to Google's place search service (Annex A).

9.2 Couriers: while you are online, including in the background

Rushcart Courier collects location data to find delivery offers near you, show your live position to the customer and store on your current delivery, estimate arrival times and support your safety, even when the app is closed or not in use, while you are online.

• When collection starts and stops. Location sharing starts when you tap to go online and stops when you go offline or sign out. If your phone restarts the app while you are still online, sharing continues until you go offline.
• Foreground and background. When you go online, the app asks for permission to use your location, then for permission to use it in the background ("Allow all the time" on Android, "Always" on iPhone). Background permission lets offers and tracking keep working when the app is not on screen. If you allow location only while the app is open, you can still go online, but your position stops updating when the app is not on screen, which can affect offers and tracking.
• How you can tell. On Android, a notification stays on screen the whole time you are online: "Rushcart is sharing your location – You are online. Go offline in the app to stop." On iPhone, a blue location indicator appears at the top of the screen.
• What is sent and how often. Your phone sends your position (latitude and longitude), direction of travel, speed, how accurate the reading is, and the time. It sends about every 2 seconds, or each time you move about 10 metres. Our servers keep at most about one position every 3 seconds unless you have moved 50 metres, and discard readings that are over 2 minutes old or very inaccurate.
• What we store. We keep your latest position only, in a real-time system that overwrites it with each update. We delete it within 24 hours of you going offline. We do not keep a trail of your routes. If a trip is handed over to another courier mid-delivery, the position at handover is kept with that order's record.
• What it is not used for. We do not use courier location for advertising, and we do not sell it.

9.3 Who sees location

9.4 Map, routing and place providers

• Maps. The Rushcart and Rushcart Courier apps and our operator console show maps from Mapbox. Loading a map sends Mapbox your IP address and the area being viewed. We switch off Mapbox's optional usage reporting in our apps.
• Routes. To draw routes and estimate arrival times, our servers and Rushcart Courier send Mapbox the courier's position and the next stop's position.
• Navigation. When a courier taps Navigate, Rushcart Courier opens the navigation app the courier chooses, such as Google Maps, Waze, Apple Maps or the phone's default maps app, with the stop's location. That app handles the location under its own terms.
• Address search. As described in 9.1.

9.5 How to stop location sharing

• Customers: don't tap "Use my current location", or turn off location for Rushcart in your phone's settings.
• Couriers: go offline in the app. To stop all access, change Rushcart Courier's location permission in your phone's settings. Without it you cannot go online.
• Merchants: Rushcart Merchant does not use your device's location.

10. Device permissions

Our apps ask for a permission only when you use a feature that needs it. You can change any permission at any time in your phone's settings.

What our apps do not access. None of our apps accesses your contacts, microphone, calendar, Bluetooth, health data or motion sensors, or uses Face ID or fingerprint data.

No advertising tracking. Our apps contain no advertising, analytics, attribution or crash-reporting software from other companies. We do not use your device's advertising identifier, we do not track you across other companies' apps or websites, and we do not share data with data brokers. If this ever changes, we will update this policy first and ask for your permission where the law or your phone requires it.

11. Sensitive information

11.1 Pharmacy orders

Ordering from a pharmacy can reveal information about your health, or the health of the person you are ordering for. Under the Law, health information is sensitive personal data.

• What we handle. The items and quantities you order, the store, the delivery details, and any note you add for the pharmacy.
• Who sees it. The pharmacy sees your full order so it can prepare it. The courier sees the item names and quantities so they can check the bag at pickup, plus the delivery details. Prices are not shown to couriers. Within Rushcart, only staff who need it for support, safety, refunds or accounting can see order contents.
• What we never do. We do not use pharmacy orders for marketing, to build profiles of you, or for advertising, and we do not share them with anyone else except as described in this section and section 15. We keep item names out of notifications and lock-screen displays. Notifications may show the store's name.
• Prescriptions. The Rushcart apps do not currently collect prescriptions. If a medicine needs a prescription, the pharmacy asks for it under its own procedures and keeps the records that pharmacy rules require. If we introduce prescription upload, we will update this policy first. Prescriptions would then be visible only to the pharmacy and to the Rushcart staff who need them, stored with extra protection, and kept only as long as pharmacy rules require.
• Legal ground. Consent (Article 10, 1°): you choose to place a pharmacy order with us after being told, in this policy and when you order, how its details are handled. Where pharmacy or tax law requires records to be kept, we also rely on legal obligations (Article 10, 2°). You can cancel an order before the pharmacy accepts it. Records already created for tax purposes are kept as described in section 17.
• Cold items. Orders that need a cold bag are offered only to couriers who have one.

Notes to stores about allergies or health. If you add a note to a store about allergies or dietary needs, it may reveal health information. Notes are optional. Only the store sees them, and we don't use them for anything else.

11.2 Courier documents and photos

National ID cards, licences and a photo of your face are highly personal, even where the Law does not class them as sensitive. We protect them as if it did:

• Only you and our trust & safety team can view them. Customers, merchants and general support agents cannot.
• A person reviews every document. We do not use facial recognition or automated face matching. If we ever introduce automated face matching, it would involve biometric data, which is sensitive. We would ask for your consent first and offer a manual alternative.
• They are kept in private storage, encrypted at rest, and shown only through short-lived secure links.
• We delete them after your courier account closes (see section 17).

11.3 Background checks (if we introduce them)

We do not currently request criminal-record certificates or run background checks on couriers. If we introduce them, for example for couriers who carry high-value parcels, we will:

• tell couriers in advance;
• explain the legal ground (criminal records are sensitive data and data about convictions, which the Law allows only under the supervision of NCSA);
• ask for consent where that is the ground;
• keep only the result, for no longer than needed;
• update this policy before we start.

11.4 Safety incidents

Incident reports may include health information, for example an injury, or information about a possible crime. We use them to get help to the people involved, protect others, deal with insurance and legal claims, and cooperate with authorities. Legal grounds: vital interests, and legal obligations (Article 10, 2° and 3°). Only our trust & safety team can see them.

11.5 How we protect sensitive information

• We limit access to the staff whose role requires it, and record the changes they make in an audit log.
• We keep the minimum. For example, at the door, ID checks record only that a check happened.
• We keep sensitive details out of notifications and lock-screen displays where we can.
• We encrypt data in transit, and encrypt stored documents and photos.
• We set fixed retention periods (section 17).

12. Messages and notifications we send

What appears on your lock screen. Push notifications and Live Activities can be seen without unlocking your phone. They may show:

• the order status and estimated arrival range;
• the store's name;
• the courier's first name;
• the delivery code;
• for parcels, the recipient's name.

They do not show the items you ordered. If you share your phone or leave it where others can see it, you can turn off previews or Live Activities in your phone's settings.

Marketing. We send promotions only if you switch them on. When you do, we record that and the date.

• Frequency. At most one promotional message a day, and never between 21:00 and 07:00 (Kigali time).
• Who receives a promotion. We may choose this based on when you last ordered or which stores you have ordered from (see section 14.8).
• Stopping. You can switch promotions off at any time in the app, and every marketing message we send by SMS, WhatsApp or email will tell you how to stop.
• Other channels. If we start sending promotions by SMS, WhatsApp or email, we will ask for your agreement first.
• Your number stays with us. We never give your phone number to merchants or anyone else for their own marketing. If you ask, we will tell you where we got your contact details.

Merchants and couriers receive operational messages about offers, orders and payouts. These cannot be switched off while your account is active, except through your phone's settings. Promotional messages to merchants and couriers follow the same opt-in rules.

Keep yourself safe. Rushcart will never ask for:

• your mobile-money PIN;
• your full card number or security code;
• a password;
• your sign-in code.

We will not ask for these by chat, SMS, WhatsApp, email or phone. Only enter a sign-in code in the Rushcart app. If someone asks you for one of these, it is not us: please tell us at privacy@rushcart.co.

13. Payments and payouts

Today: cash on delivery. Today you pay in cash when your order is delivered. For parcels, the payer can be the sender or the recipient. The courier records the cash collected, and we keep a ledger of the cash each courier holds and hands over to us, with a limit on how much cash a courier can hold. Refunds can be given as platform credit, back to the original payment method, or in cash. Platform credit can be used on later orders.

Where available: mobile money and cards. We plan to accept mobile money and card payments through licensed payment partners. Where these are available:

• Mobile money (MTN MoMo, Airtel Money). We send the operator your mobile-money number and the amount. You approve the payment on your own phone. We receive the payment status, a reference and, from some operators, the name on the account.
• Cards. You enter your card details with a licensed card processor, not with us. We receive a token that represents the card and limited details, such as the card type and last four digits.

We do not store full card numbers, card security codes or mobile-money PINs, and we never ask for them (section 12).

Payouts. We pay couriers' earnings to the mobile-money number they give us, and pay merchants to the mobile-money number or bank account in the business's name they give us. We share the number or account and the amount with the operator or bank to make the payment, and keep a record of the amount, date and reference.

Payment partners are licensed financial institutions. They also process your data for their own legal obligations, for example anti-money-laundering checks, under their own privacy notices.

Legal grounds: contract (to take payment and pay out), and legal obligation (to keep financial records, see section 17).

14. Automated decisions and profiling

Some decisions at Rushcart are made, or prepared, by software. The Law gives you the right to know the logic behind these decisions, why they matter and what effect they can have. It also gives you the right not to be subject to a decision made solely by automated means that has legal or similarly significant effects on you, unless an exception applies. In that case you can ask for a person to review the decision. This section explains each automated process.

14.1 Matching orders with couriers

When an order needs a courier, our system looks at up to 50 of the nearest couriers who are online and free, and gives each one a score. The highest-scoring courier receives the offer first. If they decline or don't respond in time, it goes to the next.

Some orders are offered only to couriers who meet a requirement:

• a minimum reliability score, for standard orders;
• vetted status, granted by our staff, for high-value parcels;
• a cold bag, for pharmacy and cold items;
• enough room under your cash holding limit, for cash orders.

Why it matters. Matching affects which offers you receive, and so what you can earn. We may adjust the weights by area and time of day. If we change the factors themselves, we will update this policy.

Legal ground: contract. Matching is necessary to provide deliveries. Your safeguards: you can see your score and the figures behind it in the app, and you can ask for a person to review how you are being matched (14.9).

14.2 Courier reliability score

Your reliability score runs from 0 to 100. New couriers start with a provisional score until they have built up a history. The app shows the score together with the figures behind it: your acceptance rate, cancellations after accepting, on-time deliveries and ratings, each shown as actual numbers (for example "34 of 48 offers"). The score is used in matching, and as a minimum for standard orders. Our staff can adjust it after a review. If you think it is wrong, raise it through support (Account › Help & support). A person will review it.

14.3 Automatic suspension based on ratings

This is the one fully automated decision we make about a courier's account.

The logic. We look at your most recent 20 customer ratings, once you have at least 10. If more than 40% of them are below 4 stars, your courier account is suspended automatically and immediately. We may change these thresholds; if we do, we will update this section.

The effect. While suspended, you cannot go online or receive offers. A suspension is never lifted automatically.

Your safeguards.

• Every automatic suspension immediately opens a priority case for our trust & safety team.
• A person reviews it, looks at the ratings and any context, and decides whether to reinstate you.
• You can explain your side and contest the decision through Account › Help & support in Rushcart Courier, or by emailing privacy@rushcart.co.
• We keep a record of each automatic decision.

Legal ground: contract, with these safeguards (Article 21).

14.4 Store acceptance and automatic cancellation

When you place an order, we alert the store through the channels it has chosen and wait a set time for it to respond. If it doesn't, we try the next channel and then involve our team. If no one at the store accepts in time, the order is cancelled automatically and we tell you. Cash orders are not charged. A store can choose to accept orders automatically.

14.5 Arrival estimates and fees

Arrival estimates are always shown as a range. We calculate them from:

• the store's preparation time;
• the estimated travel time between the stops;
• an extra margin depending on how precisely the delivery place is described.

Fees.

• Delivery and service fees depend on the order, such as distance and, for parcels, the service type, size and declared value.
• Fixed fees apply to some events: a redelivery, a refused pickup, a recipient declining a parcel, or extra waiting time.

You see the fees before you confirm. We do not set prices based on who you are or on a profile of you.

14.6 Store ranking

Stores' average ratings affect the order in which they appear in the Rushcart app.

14.7 Safety and fraud checks

We use fixed rules to protect accounts and money:

• limits on how often sign-in codes can be requested and tried;
• blocking sign-in for suspended accounts;
• cash limits for couriers;
• requirements for high-value parcels.

Decisions to approve documents, grant vetted status, or suspend an account for reasons other than ratings are made by our staff. We do not currently use automated fraud scoring. If we introduce it, we will update this policy first, and a person will review any decision that restricts your account.

14.8 Marketing audiences

If you have switched promotions on, we may choose who receives a promotion based on when you last ordered or which stores you have ordered from. This is profiling for marketing. You can stop it at any time by switching promotions off. This right is absolute (section 19).

14.9 Asking for a person to review a decision

You can ask us:

• to explain an automated decision about you;
• to have a person review it;
• to take your point of view into account.

Use in-app support or email privacy@rushcart.co. We will respond within 30 days, and sooner for suspensions.

15. Who we share information with

15.1 Other people on your order

We share information between the people on an order only as needed to complete it.

Phone numbers are not masked. During an active order, the customer, courier, store and parcel recipient can see and call each other's real phone numbers, as shown above. If we introduce number masking, we will update this policy.

Proof-of-delivery photos can be seen by the customer, the store and the courier on that order, and by our support team.

15.2 Rushcart staff

Our support, operations, finance and trust & safety staff use the operator console to see the information they need for their role. For example:

• support agents see the orders and chats in their queue;
• only trust & safety staff see courier documents.

Staff actions that change accounts, orders, payments or reviews are recorded in an audit log. Staff are bound by confidentiality.

15.3 Service providers

We use service providers to host our systems, send messages and notifications, show maps and routes, suggest addresses, deliver app updates, send email and host our website. Annex A lists each one, what it does, what data it handles and where. They act on our instructions under written contracts and may not use your data for their own purposes.

15.4 Payment partners

Where mobile-money or card payments are available, we share what is needed to process a payment or payout with licensed payment partners (section 13).

15.5 Insurers and professional advisers

We may share relevant information with:

• insurers, for example for a claim about a lost or damaged parcel, or a courier's accident;
• lawyers, accountants and auditors, who are bound by confidentiality.

15.6 Authorities and law enforcement

We disclose personal data to authorities when Rwandan law requires it. These include:

• the Rwanda Investigation Bureau and the Rwanda National Police;
• the National Public Prosecution Authority and the courts;
• the Rwanda Revenue Authority;
• NCSA;
• the Rwanda Food and Drugs Authority.

The legal bases include Law Nº 058/2021, the cybercrime law (Law Nº 60/2018) and tax law. We check that each request is lawful and disclose only what it requires. Where the law requires, we preserve data for an investigation.

15.7 Emergencies

If someone's life or physical safety is at risk, we may share relevant information, such as a location and contact details, with emergency services or medical responders. The SOS button in Rushcart Courier dials the national emergency number (112) directly from your phone.

15.8 Business changes

If Rushcart is involved in a merger, acquisition, investment, reorganisation or sale of assets, personal data may be transferred to the organisation involved. It must protect your data as this policy describes. We will tell you before your data becomes subject to a different privacy policy.

15.9 With your consent or at your request

We share in other ways if you ask us to or agree. For example, when you share your referral code (which includes your first name) through your phone's share menu, or forward a tracking link.

15.10 Our commitments on sharing

• Equal protection. Every service provider, partner, and any company related to Rushcart that receives personal data from us is required, by written contract or by its own legal obligations as a licensed or regulated organisation, to protect it to the same or an equal standard as this policy and Rwandan law require.
• We do not sell personal data. We do not rent it or trade it, and we do not share it with data brokers or advertising networks.
• No sharing with third-party artificial intelligence services. We do not share your personal data with third-party AI services. If we ever want to, we will ask your permission first.

16. Where we store and transfer information

Our main systems are hosted outside Rwanda. Rushcart's application database, photo and document storage, backups, server logs, real-time location system, live-tracking service and order coordination systems are hosted with Amazon Web Services in its data centres in Sweden, in the European Union.

How this is lawful. Rwandan law requires personal data to be stored in Rwanda unless NCSA authorises storage elsewhere (Article 50). We store personal data outside Rwanda under an authorisation from NCSA: [NCSA storage-outside-Rwanda authorisation no. — to be inserted]. Our safeguards are:

• a written contract with the hosting provider. It sets out each party's role, lets the provider use the data only to provide its service to us, and requires it to protect the data (Article 49);
• encryption of data in transit, and of stored photos, documents and backups;
• access controls that limit who can reach the data, both at Rushcart and at the provider;
• the protection of the European Union's data protection law, which applies in Sweden.

Other providers outside Rwanda. Some providers handle limited data in other countries, including Kenya, Switzerland and the United States. This covers text messages, WhatsApp messages, push notifications, maps and place search, app updates, email, and website hosting and fonts. Annex A lists each one. We send them only what their service needs. We share this data because it is necessary to provide the service you have asked for: for example, sending your sign-in code, notifying you that your courier has arrived, or showing you a map (Article 48, 3°(a)). Each one is bound by a written contract (Article 49), and we hold NCSA authorisation where the Law requires it.

Your rights about transfers. You can ask us whether your data has been transferred outside Rwanda, to whom, and what safeguards apply. You can also ask for a copy of the safeguards, free of charge.

17. How long we keep information

We keep personal data only as long as we need it for the purposes in this policy, or as long as the law requires. When a period ends, we delete the data or anonymise it so it can no longer identify you. "Account closes" means when your account is deleted, or closed for inactivity.

We may keep specific information for longer only where we need it for an unresolved dispute, claim or investigation, or where a law or court order requires it. We keep it only until that matter is resolved.

18. Deleting your account and data

This section is the account and data deletion page for the apps published by Rushcart LTD: Rushcart, Rushcart Courier and Rushcart Merchant (including the Rushcart Merchant web app). You do not need to have the app installed to ask us to delete your account.

How to ask us to delete your account

Choose whichever is easiest for you.

Option 1: in the app (where available). We are adding a "Delete account" option to all three apps. If your version of the app shows it:

• Rushcart: Account › Delete account
• Rushcart Courier: Account › Delete account
• Rushcart Merchant: Store › Delete account

Until your app shows this option, use option 2 or 3.

Option 2: through in-app support.

• Rushcart: Account › Help center › Get help › "I want my data deleted".
• Rushcart Courier: Account › Help & support › Get help. Choose an account topic and write "Please delete my account".
• Rushcart Merchant: open Get help and write "Please delete my account".

Option 3: by email. Email privacy@rushcart.co with the subject "Delete my account". Include:

• the phone number your Rushcart account uses;
• which app or apps you use;
• your name.

You can email from any address. To make sure the request is really from you, we send a one-time code by SMS or WhatsApp to that phone number, or call it, and ask you to confirm. If you no longer have that number, we will ask a few questions about your account instead, such as recent orders. We will never ask for a PIN or password.

What happens next

1. We confirm we've received your request within 3 working days.
2. We check it's you, as described above.
3. We settle anything outstanding.
   • Any active order is completed or cancelled first.
   • Couriers hand over any cash-on-delivery money they hold, and we pay any earnings due.
   • Merchants receive their final settlement.
4. We delete your account within 30 days of receiving your request. If we need more information to check it's you, the 30 days start when we receive it.
5. We confirm by SMS or email when the deletion is complete. You are signed out of all Rushcart apps. If you sign in again later with the same number, you start a new, empty account.

One account across apps. Because a phone number is one Rushcart account, deleting it removes you from every Rushcart app. If you only want to stop being a courier, or close your store, but keep ordering as a customer, tell us. We will close that role and delete the data that belongs only to it.

What we delete

For everyone:

• your phone number and name on your account, and your sign-in sessions;
• your saved places and entrance photos;
• the delivery details on your past orders (pins, landmarks, notes and photos);
• the names and phone numbers of parcel senders and recipients you entered;
• your chat messages and support conversations, or your name and phone number in them where a conversation must be kept for an open case;
• photos you uploaded;
• your notification settings, notification inbox and device tokens.

Couriers, in addition:

• your documents and photo;
• your payout number and vehicle plate;
• your location data;
• your offer and performance history.

Merchants, in addition:

• the link between you and your store;
• the store's contact phone number;
• staff details.

The store is removed from Rushcart.

What we keep, why, and for how long

A pharmacy keeps its own dispensing records as pharmacy regulations require. Ask the pharmacy directly about those.

Deleting only some data

You don't have to delete your whole account to remove some data:

• Saved places: Account › Saved places.
• Saved parcel contacts: Account › Saved people, or sign out.
• Promotions, reminders and chat notifications: Account › Notifications.
• Location, camera, photos and notifications: your phone's settings.
• A specific photo, conversation or other item: email privacy@rushcart.co and tell us what you want deleted.

Uninstalling an app does not delete your account. It removes the data stored on your phone, but not the data on our servers. To delete your account, use one of the options above.

Not an account holder? If you are a parcel recipient, a waitlist sign-up or someone else we hold data about, email privacy@rushcart.co (see section 5.2 and section 8).

19. Your rights and how to use them

Under Law Nº 058/2021, you have these rights:

How we handle your request

• Where to send it. Use in-app support, email privacy@rushcart.co, or write to the DPO at our registered address.
• Checking it's you. To protect your data, we confirm your identity before acting. Usually we send a one-time code to your account's phone number. We ask only for what we need, and use it only to handle your request.
• Timing. We respond within 30 days of receiving your request, and tell you what we have done or why we cannot do it.
• Cost. Handling your request is free. If a request is clearly unfounded or excessive, for example repeated requests for the same information, we may decline it, and we will explain why.
• Limits. Some rights have legal exceptions. For example, we cannot give you data that would reveal someone else's personal data, and we keep records the law requires even if you ask us to delete them (section 18). We will always tell you which exception applies.

Complaining to NCSA

We would like the chance to resolve your concern first, but you can contact the regulator at any time. If you are not satisfied with our response to a request, you can appeal to NCSA within 30 days of receiving it. NCSA responds within 60 days.

National Cyber Security Authority (NCSA): Data Protection and Privacy Office
21 KG 7 Ave, A&P Building, Ground Floor, Kacyiru, Gasabo, Kigali, Rwanda
Toll-free: 9080 · Phone: +250 782 847 756
Complaints: complaint@dpo.gov.rw · General: dpp@dpo.gov.rw
Website: https://dpo.gov.rw

20. How we protect your information

We use technical and organisational measures appropriate to the risk, and we review them regularly. They include:

• Encryption in transit. All connections between our apps, website, live-tracking service and servers, and between our servers and database, are encrypted.
• Encryption at rest for stored photos, documents and backups.
• Private storage. Photos and documents are never public. Each time someone opens one, we check they are allowed to see it, and give them a link that expires within 5 minutes. Only you and our trust & safety team can see courier documents.
• Secure sign-in. Sign-in codes expire after 5 minutes and stop working after 5 wrong attempts. We limit how often codes can be requested. Access tokens expire after 15 minutes. Sessions are renewed securely and ended when you sign out, and we detect reused session tokens. On iPhone and Android, sign-in tokens are kept in your phone's secure storage.
• Live tracking locked to the order. Our live-tracking service checks every connection and refuses access by default. You can only see an order's live updates if you are part of that order, and only while it is active.
• Limited staff access. Staff access depends on their role. Operator access can only be granted on our servers, not through the apps. Staff actions that change data are recorded in an audit log.
• Careful logging. Our application logs are designed to hide phone numbers, vehicle plates and security tokens.
• Abuse limits. We limit request rates to protect against attacks. Tracking links use long random codes and are rate-limited.
• Protected secrets. System passwords and keys are kept in a managed secret store.

If something goes wrong. If a personal data breach occurs, we notify NCSA within 48 hours of becoming aware of it and send a full report within 72 hours, as the Law requires. If the breach is likely to result in a high risk to you, we tell you without undue delay, in the app, by SMS or by email. We will explain what happened and what you can do.

Your part. Never share your sign-in code. Keep your phone locked. Contact us at privacy@rushcart.co if you think someone has accessed your account. No system is perfectly secure, but we work to protect your data and to respond quickly if something goes wrong.

21. Cookies, local storage and similar technologies

We do not use cookies or similar technologies for advertising, cross-site tracking or device fingerprinting.

22. Children

Rushcart is for adults. You must be 18 or over to create an account as a customer, a courier or a merchant account holder.

• We do not knowingly collect personal data from children under 16 except where a customer gives us a recipient's details to deliver a parcel. Please involve a parent or guardian before sending a parcel to a child.
• If we learn that an account holder is under 18, we will close the account and delete its data, except records the law requires us to keep.
• If you are a parent or guardian and believe your child has given us personal data, contact privacy@rushcart.co and we will help.

23. Changes to this policy

We update this policy when our services, the law or our practices change. The "Last updated" date at the top shows when it last changed, and Annex B lists every version.

• Important changes, for example a new purpose, a new type of data or a new kind of recipient: we tell you at least 14 days before they take effect, in the app and by push notification, SMS or email.
• If a change needs your consent, for example to use data for a new purpose, we will ask for it and won't apply the change to you until you agree.
• Minor changes, such as clearer wording or updated contact details: we update the policy and the date.

You can ask us for any earlier version at privacy@rushcart.co.

24. Language and governing law

Language. This policy is written in English. Our apps work in Kinyarwanda, French and English, and we may provide this policy in Kinyarwanda and French as well. If a translation differs from the English version, the English version applies. However, no version of this policy reduces any right you have under Rwandan law. If you would like this policy explained in Kinyarwanda or French, contact us.

Governing law. This policy, and how we handle personal data, are governed by the laws of the Republic of Rwanda, including Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy. NCSA handles data protection complaints and disputes, and you may also go to the competent Rwandan courts.

25. Contact us

Annex A: Service providers

These providers process personal data on our behalf, under written contracts that require them to use it only to provide their service to us and to protect it to the same or an equal standard as this policy. We update this list when providers change.

Payment partners. Where mobile-money or card payments are available, licensed payment partners, such as mobile-money operators and card processors, receive the data described in section 13. They process it under their own licences and legal obligations as well as their contracts with us.

Annex B: Version history