Privacy policy.

We collect information to provide and improve our cooperative management services:

We use collected information for the following purposes:

• Providing Services: Operating the COPA platform, processing transactions, and managing cooperative operations.
• Improving Services: Analyzing usage patterns to enhance features and user experience.
• Communication: Sending service updates, payment reminders, and responding to inquiries.
• Security: Detecting fraud, protecting against unauthorized access, and ensuring platform security.
• Legal Compliance: Meeting regulatory requirements and responding to legal requests.

We do not sell your personal information. We may share information in these limited circumstances:

We implement robust security measures to protect your information:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Regular security audits and vulnerability assessments
• Role-based access controls
• Secure data centers with physical security measures

You have control over your personal information:

We retain your information for as long as necessary to provide our services and comply with legal obligations:

• Account data: Retained while your account is active and for 12 months after deletion request.
• Transaction records: Retained for 7 years as required by Rwandan financial regulations.
• Usage logs: Retained for 90 days for security and debugging purposes.
• NIDA verification data: Verification status is retained; raw NIDA response data is not permanently stored.

Your data is processed on servers hosted by our infrastructure providers. While our primary operations are in Rwanda, some data processing may occur on servers located outside Rwanda. In such cases, we ensure appropriate safeguards are in place, including encryption in transit and at rest, and contractual obligations with our service providers to protect your data in accordance with Rwanda's Law No. 058/2021 relating to the protection of personal data and privacy.

COPA services are designed for cooperative management and are intended for users aged 16 and above. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will take steps to delete such information promptly. If you believe a child has provided us with personal data, please reach our Data Protection Officer at privacy@copa.rw or submit a request.

We use the following technologies to improve your experience:

• Authentication tokens: Stored securely in HTTP-only cookies to maintain your login session.
• Local storage: Used to store non-sensitive user preferences (language, theme) for a better experience.
• Error monitoring: We use Sentry for error tracking to improve service reliability. No personal data is intentionally captured.

We do not use third-party advertising trackers or sell data to advertisers.

COPA operates in compliance with Rwanda's Law No. 058/2021 relating to the protection of personal data and privacy. Under this law, you have the right to:

• Be informed about the collection and use of your personal data
• Access your personal data held by COPA
• Request correction of inaccurate personal data
• Request erasure of your personal data, subject to legal retention requirements
• Object to processing of your personal data
• Lodge a complaint with the National Cyber Security Authority (NCSA) if you believe your data rights have been violated

We may update this privacy policy from time to time. We will notify you of significant changes by posting the new policy on our platform and, where appropriate, sending you a notification. We encourage you to review this policy periodically to stay informed about how we protect your information.