THE HIGH COMMISSION OF THE REPUBLIC OF RWANDA PERSONAL DATA PROTECTION POLICY FOR “RWANDAGATEWAY”

Introduction

The High Commission of the Republic of Rwanda, 8 Temasek Boulevard, #14-03 Suntec Tower 3, Singapore 038988, as controller, (“RWANDAGATEWAY”, “we”, “us”, or “our”) is committed to protecting information under our control that identifies you (“personal data”), including your name and identifying contact details. This document serves to inform you of your rights for your personal data, why we collect your personal data, how we use and share your personal data, and for how long we store your personal data.

General information on our processing of personal data

We collect personal data in furtherance of the statutory functions of RWANDAGATEWAY (a) to develop and promote Rwanda as a travel and tourist destination; (b) to enhance the travel and tourism sector’s contribution to the Rwanda economy; and (d) to exercise licensing and regulatory functions in respect of such tourism enterprises as RWANDAGATEWAY may determine, including for the provision of services in any of our websites, applications, data analytics platforms, or other RWANDAGATEWAY platforms, or the conduct of surveys or elicitation of feedback, the organisation and running of events and programs, and the administration of grants.

We will process all personal data lawfully, fairly and in a transparent manner. We will collect personal data that is adequate, relevant and limited to what is necessary for the purposes for which they are processed. We will take reasonable steps to ensure that personal data is accurate and updated where necessary, and to erase or rectify inaccurate personal data without delay.

We will not store personal data longer than is necessary for the purpose for which the data is processed, and we will inform you of the period for which we will store your personal data and, if this is impossible, inform you of the criteria used to determine that period.

We will ensure appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical and organisational measures. We will not subject you to a decision based solely on automated processing (including profiling) where it produces prejudicially legal or similarly significant effects on you.

Personal data we will not collect

For EU residents, we will not collect personal data that reveals any of the following about you: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health or sex life, or sexual orientation.

No requirement to provide personal data

The provision of your personal data will generally be voluntarily where there is no statutory obligation to provide your personal data. We generally do not contractually require provision of your personal data; but note that in any event non-provision of personal data might exclude you from using some of our services or parts thereof or disqualify you from receiving particular benefits.

Sharing of personal data

Unless expressly stated otherwise in this policy, we will only share personal data with others where you have consented to our doing so or where it is lawful for other reasons to do so. Where we share personal data with your consent to other persons or entities, we will emplace contractual arrangement and security mechanisms to meet the standards under this policy.

Your rights and how to exercise them

You have rights over your personal data and we are committed to fulfilling these rights. You may be entitled to exercise some or all of the following rights:

1. require (a) information regarding whether your personal data is retained and (b) access to a copy of your personal data which we retain, including information on the purposes of the processing, the categories of personal data concerned, and the data recipients as well as potential retention periods;
2. request rectification, removal or restriction of your personal data, e.g. because (a) it is incomplete or inaccurate, (b) it is no longer needed for the purposes for which it was collected, or (c) the consent on which the processing was based has been withdrawn;
3. refuse to provide and, without impact to data processing activities that have taken place before such withdrawal, withdraw your consent to processing of your personal data at any time;
4. object, on grounds relating to your particular situation, that your personal data shall be subject to a processing. In this case, please provide us with information about your particular situation. After the assessment of the facts presented by you we will either stop processing your personal data or present you with our compelling legitimate grounds for ongoing processing;
5. take legal action in relation to any potential breach of your rights regarding the processing of your personal data, as well as to lodge complaints before the competent data protection authority; and/or
6. require that we (a) send to you personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and (b) transmit such data to another controller without hindrance; where technically feasible you shall have the right to require such data to be transmitted directly from us to another controller.

To exercise these rights or to raise any complaint of non-compliance with this policy, please contact our Data Protection Officer at info@rwandaembassy.org.sg. Should you wish to exercise some or all of the rights above, please be prepared to authenticate your identity.  

General information on consent

Where we are required under any applicable law to obtain your consent for the processing* of any personal data concerning you, we will do so. Where we seek your consent, we will inform you of the specific, explicit and legitimate purposes for which your consent is being obtained and thereafter process the personal data under the specific, explicit and legitimate purposes for which your consent has been obtained. Where consent is required from a child under the age of 16 years, we will obtain such consent from the parent or guardian. We will obtain such consent from you in a manner which is clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language. As mentioned above, you further have the right to withdraw your consent.

If you are browsing our websites:

1. General

When you visit our websites for informational reasons, i.e. without registering for any of our provided services and without providing us with personal data in any other form, we automatically collect your IP address in order to provide you with our websites and to ensure system stability and efficiency and to implement proper safeguards as to the security of our websites and services. The personal data automatically collected is necessary to provide the websites, as far as this is necessary to operate our websites or our legitimate interest with regards to our use of technical information to enhance our systems, make your usage of the websites more convenient or ensure the security of our websites. This is based on our legitimate interest as the data used for these purposes are stored for a limited period only and we are generally not able to personally identify the user without larger efforts.


2. Cookies and Web Analytics

Our websites use cookies in several cases. Cookies serve to make our offer more user-friendly, more effective, and safer. Cookies are small text files that are stored on your device. This data does not contain information that we could allocate to a natural person. Cookies do not harm your device and do not contain any viruses. You can prevent the use of cookies by adjusting your browser settings. Please note that in this case you may not be able to fully utilise all functions of the websites. We use cookies in order to enhance your customer experience. Our legitimate interest pursued is the provision and/or promotion of further products and/or services to you. Some of our websites use Adobe Analytics, a web analytics service provided by Adobe Systems Software Ireland Limited (“Adobe”). Adobe Analytics uses cookies in order to help the website to analyze overall traffic patterns through our Website. By transmitting the information generated by the cookie about the use of the website to Adobe, setting ensures that IP address is anonymized before geo-localization und will be replaced by a generic IP address before storage. On behalf of the website provider, Adobe will use this information for the evaluation of your use of the website, compiling reports on website activity for website operators, and in order to provide other services relating to website activity and use of the Internet to the website provider. Adobe will not associate your IP address with any other data held by Adobe. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that if you do, you may not be able to use the full functionality of the website. Furthermore, you can prevent Adobe’s collection and use of data (cookies and IP address) by downloading and installing the browser plug-in available under http://www.adobe.com/privacy/opt-out.html. Some of our websites further use Google Analytics, an analysing service provided by Google LLC, ( Mountain View, CA, USA) (“Google”). Google Analytics uses cookies, to help the website analyse, how users use the site. The information generated by the cookies about your use of the website will be transmitted to and stored by Google on servers in the USA. IP-anonymization is a functionality that is activated on our website, and as such your IP address will be truncated within the area of Member States of the European Union or other parties to the Agreement on the European Economic Area. However, in exceptional cases the whole IP address will be first transferred to a Google server in the USA and truncated there. Google will use this information on behalf of the operator of the website for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing them other services relating to website activity and internet usage. The IP-address that your browser conveys within the scope of Google Analytics, will not be associated with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of the website. You can also opt-out from being tracked by Google Analytics with effect for the future by downloading and installing Google Analytics Opt-out Browser Add-on for your current web browser: http://tools.google.com/dlpage/gaoptout?hl=en. Please refer to further information on usage rights or data protection please visit the following websites: https://www.google.com/policies/privacy/ https://www.google.com/intl/en/policies/terms/

If you subscribe to our newsletter:

Where you have granted consent, we use your name, e-mail address, country and other data you provide voluntarily to send you our newsletter on our services and products as well as general information on tourism in Singapore. Such newsletters might include advertisement for third-parties; however your personal data will not be transferred to such parties. You may revoke consent granted at any time. We will delete your personal data for marketing purposes immediately after you object to the processing of your data or withdrawing the consent.

If you contact us or use our feedback forms:

If you have any questions, you want to make an enquiry, give compliments or submit a complaint, we offer you the opportunity to contact us using the forms provided on our websites or to contact our contact centre. Your name, e-mail address and place of residence and in some cases further contact details are required in order to process your request and follow up as required. The personal data will be processed for the purpose of contacting us to fulfil our obligations under a contract; or based on our legitimate interest to enhance your travel experience and improve our services, as required to follow up on your request, which may include the transfer to third parties as far as this is necessary to follow up on your request (e.g. when it concerns the business of other entities or legal bodies).  

If you register for our portal:

If you register for our Tourism Information & Services Hub portal, we process your personal data (name, e-mail address and contact details as well as further provided information) for the purpose of account creation in order for you to use our provided services. The processing is necessary for the fulfilment of our terms of use agreement. In addition, it is based on our legitimate interest in the offering of the service itself in order to provide you with information to our services.

If you register for our API application:

If you register for our API application we will process your name, e-mail address and country of residence as well as further provided information. We will do so to provide you with our API token and related services. The processing is based on the fulfilment of the respective agreement on the use of the API application as well as on our legitimate interest to provide you with the API and to improve traffic to and the visibility of our services.

If you are applying for a grant:

If you are applying for a grant we will collect your name, company name, designation and other relevant data requested in the specific grant application. We will use such personal data only for the assessment and audit against the requirements in order to receive such grant. Your personal data will be processed for the fulfilment of the respective agreement (terms of application). We will delete any personal data after the process is finally closed and respective statutory obligations related to the storing of the information have expired (up to 5 years from the final date of use for the purposes above).

If you are participating in an event or program organised by RWANDAGATEWAY:

If you are participating in an event or program organized by RWANDAGATEWAY, we will collect your name and business contact information as well as other related business information in order to process your specific request or application. Your personal data will solely be processed for the fulfilment of the respective contract related to the specific event or program you are applying to. If, in the course of such events, you provide us with your business card, we will use such contact details for the purpose you provided the business card for. The information will be added to our systems and stored for the purpose the business card was provided for. The processing of your personal data is based on our legitimate interest in delivering our services to you.

If you are participating in our survey:

If you participate in our surveys, we or our vendors (on our behalf) collect your name, e-mail address and further contact details for the purpose of fieldwork validation and data quality checks. All personal data is provided on a completely voluntary basis. From surveys conducted by our vendors, we will only receive aggregated data. The personal data is processed on the basis of our legitimate interest in order to enhance and improve our services.

If you take part in our contests:

If you take part in one of our contests, we will use the personal data you provide in order to execute such contest and to provide you with your prize. The processing is necessary for the fulfilment of the participation terms or in case these do not exist, processing is based on our legitimate interest in offering the services and promoting our services and tourism in Singapore.

if you nominate an individual/enterprise for an award:

If you want to nominate an individual or enterprise for one of our awards, we will process you name and e-mail address as well as the name of the person or entity you nominated for the purpose of assessing your nomination and in order to follow up on your nomination. Your personal data will be processed in order to fulfil our obligations under the participation terms.

If you apply for an internship or job opening:

If you apply for an internship or job opening, we will process the personal data you provide (e.g. resume data) only as far as necessary for the processing of your application. The legal basis for such processing is in connection with respective national laws; or in absence of such, in connection with the initiation of contract.

Processing personal data for regulatory or legal defence purposes:

Notwithstanding anything within this policy, we reserve the right to freely process your personal data for regulatory purposes under the statutory functions of RWANDAGATEWAY or to defend ourselves against any legal claim. Examples of regulatory purposes include travel agent licensing, tourist guide licensing, and collection of cess for tourism events. We do so, on the basis of our legitimate interest in fulfilling our public obligations and statutory functions.

Updates to this policy:

We reserve the right to update this policy for reasons including but not limited to complying with relevant Singapore legislation, Singapore Government guidelines, regulatory directions and other requirements of a similar nature. Examples of these include future amendments to the Singapore Personal Data Protection Act 2012 or amendments to the Singapore Government Instruction Manual.

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.