Privacy Policy

1. Who is responsible for what

For the account you open with us — your users, your billing details, your usage of the product — we are the data controller.

For the records you put into the product — your employees' payroll data, your customers' and suppliers' details, the documents you upload — you are the controller and we act as your processor. We process that content on your instructions, to run the Service, and for nothing else.

2. What we collect

Account and billing data

• Name, work email, phone number and role of each user you create
• Organisation name, country, TIN and VAT registration where you supply them
• Plan, invoices and payment records

Content you enter

• Accounting records: accounts, journals, invoices, bills, payments, stock movements
• Contacts: customer and supplier details you record
• Payroll and HR data: employee identifiers, salaries, statutory deductions, leave and attendance
• Files you upload, such as supporting documents and receipts

Technical data

• Sign-in events, IP address, browser and device type
• Audit records of actions taken in the product — who changed what, and when
• Error and performance logs

3. Why we process it

• To provide the Service — posting entries, producing reports, running payroll, sending the documents you ask us to send. Basis: performance of our contract with you.
• To keep it secure — authentication, audit trails, abuse and fraud prevention. Basis: legitimate interest and legal obligation.
• To support you — answering your questions, reproducing faults you report. Basis: performance of our contract.
• To bill you — invoicing, collections, and keeping the records tax law requires. Basis: contract and legal obligation.
• To improve the product — aggregated, de-identified usage patterns. We do not mine your ledgers for marketing, and we do not sell data to anyone.

4. Who we share it with

We share personal data only where it is needed to run the Service, and only with parties bound to protect it:

• Hosting and infrastructure providers that operate the servers and backups
• Email, SMS and messaging providers, to deliver the notifications and documents you send
• Payment processors and banks, for subscription billing
• Professional advisers, where we need legal or audit support
• Authorities, where a valid legal order requires it — we tell you unless the law forbids it

We never sell personal data, and we do not share it for third-party advertising.

5. Where it is stored

Your data is stored on servers managed by us or our infrastructure providers. Where data is processed outside Rwanda, we put appropriate safeguards in place as required by Law nº 058/2021, including contractual protections with each processor. Tell us if your organisation has a specific data-location requirement and we will confirm what is possible.

6. How long we keep it

• While your account is active: for as long as you keep the records in the product.
• After termination: content is deleted or anonymised once the account is closed and billing is settled, subject to any longer period Rwandan accounting and tax law requires.
• Backups: retained on a rolling schedule and then overwritten.
• Audit and security logs: retained for a limited period for investigation and compliance.

7. How we protect it

• Traffic encrypted in transit; credentials stored only as salted hashes
• Each organisation's data is logically isolated from every other tenant
• Role-based access, so a user sees only what their job needs
• Audit trails on record changes, and access controls on our own staff accounts
• Backups taken regularly and tested for restore

If a breach affects your data, we notify you and the competent authority without undue delay, with what we know and what we are doing about it.

8. Your rights

Under Rwandan data-protection law you may ask us to:

• confirm what personal data we hold about you, and give you a copy;
• correct data that is wrong or incomplete;
• delete data we no longer have a lawful reason to keep;
• restrict or object to a particular processing activity;
• provide your data in a portable format.

Write to info@opa.rw and we will respond within the statutory period. If you are an employee or a customer of one of our clients, ask that organisation first — they control those records, and we will help them answer you. You may also complain to Rwanda's supervisory authority for data protection.

9. Cookies

We use cookies and similar storage for sign-in sessions, security, and remembering your preferences (such as which company or branch you last worked in). We use a minimal amount of aggregated analytics to understand how the product is used. We do not run third-party advertising cookies.

10. Changes and contact

We update this policy when the product or the law changes, and we post the new version here with a fresh date. Material changes are announced in the product or by email.

Privacy questions, requests or concerns: info@opa.rw · +250 789 216 483 · Ziniya, Near World Food Program, Kicukiro- Kigali, Rwanda, Kigali, Rwanda.