Privacy Policy

1.Introduction

Soma Foundation Rwanda (“SFR,” “we,” “our,” or “us”) is an education technology nonprofit organization committed to expanding access to quality education, digital learning, and skills development for underserved communities in Rwanda and beyond. Through our programs, partnerships, digital platforms, and educational initiatives — including the SOMABOX learning solution — we work with learners, teachers, schools, parents and guardians, institutional partners, donors, volunteers, and other stakeholders.

We recognize the importance of protecting personal information and respecting the privacy of everyone who interacts with our organization and website. This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you visit our website, contact us, participate in our programs, access our learning solutions, or otherwise engage with Soma Foundation Rwanda.

We are committed to handling personal information responsibly and in accordance with applicable data protection laws, including Rwanda’s Law No. 058/2021 of 13 October 2021 relating to the Protection of Personal Data and Privacy.

By using our website, you acknowledge that you have had the opportunity to read this Privacy Policy. Where applicable law requires consent for particular processing activities, we will request that consent separately.

2.Information We Collect

The personal information we collect depends on how you interact with Soma Foundation Rwanda. We aim to collect only information that is reasonably necessary for our organizational activities and legitimate purposes.

Information you provide directly. We may collect personal information that you voluntarily provide when you:

• Submit an inquiry through our website or contact forms.
• Apply to participate in our educational programs, training sessions, or other initiatives.
• Register as a learner, teacher, school representative, volunteer, or program participant.
• Request information about SOMABOX or other educational technology solutions.
• Subscribe to our newsletters, updates, or communications.
• Express interest in partnerships, volunteering, employment, or collaboration.
• Make a donation or participate in a fundraising activity, where applicable.
• Respond to surveys, feedback forms, interviews, or program evaluations.
• Communicate with us by email, telephone, social media, or other channels.

Depending on the interaction, this information may include your name, email address, telephone number, organization, professional role, school or institution, location, and the contents of your communication.

Program and educational information. When you participate in our programs or learning initiatives, we may collect information necessary to administer activities and assess their outcomes. This may include enrollment and registration details; age or date of birth, where necessary; educational background and training history; school, institution, or community affiliation; attendance and participation records; course completion and assessment results; digital skills development and learning progress; feedback and evaluation responses; and information needed to assess program eligibility or provide appropriate support.

Where relevant to a specific project, we may also collect information about gender, disability-related accessibility requirements, rural or underserved community participation, or other inclusion indicators. We will handle sensitive personal information with appropriate safeguards and process it only where a lawful basis and any additional requirements under applicable law are satisfied.

Information about children and young learners. Some of our educational activities may involve schoolchildren and other learners under the age of 18. Where we process personal information belonging to children under 16, we will obtain consent from a person holding parental responsibility as required by applicable Rwandan law, except where a lawful exception applies.

We will take particular care to ensure that information about children is collected and used in their best interests, with appropriate safeguards and access restrictions. We will not knowingly collect children’s personal information through a public website form for unrelated purposes. Where an activity involves children, we will provide additional information and obtain the necessary permissions where required.

Technical and website usage information. When you visit our website, certain technical information may be collected automatically, depending on our hosting configuration and the tools we use. This may include:

• Internet Protocol (IP) address.
• Browser type and version.
• Device type and operating system.
• Pages visited and the time spent on those pages.
• Date, time, and duration of website visits.
• Referring websites or links.
• Website performance, error, and security logs.

We use this information to maintain website functionality, understand visitor engagement, identify technical problems, and protect the website from misuse.

Photographs, videos, and testimonials. We may take or receive photographs, videos, interviews, and testimonials during training sessions, community activities, educational programs, events, and other organizational activities. Where these materials identify an individual, they may constitute personal information.

We will obtain appropriate consent or other lawful authorization before using identifiable photographs, videos, testimonials, or personal stories for publicity, fundraising, reports, publications, or promotional materials where required. For children, we will obtain the necessary parental or guardian permissions and take additional steps to protect their dignity, safety, and privacy.

Participation in a program will not automatically constitute consent to use a participant’s image or personal story for public communications.

3.How We Use Personal Information

Soma Foundation Rwanda may use personal information for the following purposes.

Website and communication management. Responding to questions, requests, and feedback; providing information about our organization and activities; managing website contact forms and correspondence; sending newsletters or organizational updates where appropriate; and maintaining communication with schools, partners, donors, and other stakeholders.

Program delivery and educational support. Processing applications and registrations; organizing training sessions, workshops, and educational activities; managing learner and teacher participation; providing access to educational content and learning resources; monitoring learning progress and program completion; and improving the accessibility, quality, and effectiveness of our educational solutions.

Monitoring, evaluation, and reporting. We may use program information to measure our impact, understand learning outcomes, assess participation, and prepare reports for donors, funders, partners, and relevant authorities. Where possible, we will use aggregated or de-identified information for statistical analysis and reporting. We will avoid identifying individual learners in public reports unless there is an appropriate legal basis and any required consent has been obtained.

Partnerships and organizational development. We may process relevant information to establish and manage relationships with schools, universities, educational institutions, technology partners, suppliers, donors, and other organizations.

Website security and improvement. We may use technical information to maintain and improve website performance, detect and prevent unauthorized access, investigate technical errors and security incidents, and protect our website, systems, and users from fraudulent or harmful activity.

Legal and administrative obligations. We may process personal information when necessary to comply with applicable laws, respond to lawful requests, maintain appropriate records, establish or defend legal claims, or protect the rights and safety of individuals and our organization.

4.Legal Basis for Processing

We will process personal information only where an appropriate legal basis exists under applicable law. Depending on the circumstances, this may include:

• Consent: where you have freely agreed to a specified use of your personal information.
• Program or service delivery: where processing is necessary to provide a requested service or administer an applicable arrangement.
• Legal obligations: where processing is required to comply with applicable legal requirements.
• Legitimate and lawful organizational purposes: where permitted by law and where the rights and interests of the individual are appropriately protected.
• Protection of vital interests or other lawful grounds: where applicable law permits processing in specific circumstances.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. We will not use consent as a blanket authorization for unrelated processing activities.

5.Cookies and Similar Technologies

Our website may use cookies and similar technologies to support functionality, remember preferences, understand website usage, and improve the visitor experience. Cookies are small files stored on your device when you visit a website.

Depending on the tools installed on our website, cookies may be used for essential purposes such as website security and core functionality; preference cookies that remember selected settings; analytics cookies that help us understand how visitors use our website; and third-party cookies that support embedded content or services provided by external platforms.

Where required by law, we will request consent before placing non-essential cookies or using similar tracking technologies. You may be able to manage cookies through our website’s cookie settings, where available, or through your browser settings. Disabling certain cookies may affect website functionality.

Our Cookie Disclosure and Policy explains this in more detail.

6.How We Share Personal Information

Soma Foundation Rwanda does not sell personal information to third parties. We may share personal information only where necessary for a legitimate and lawful purpose, subject to appropriate safeguards.

Service providers. We may engage trusted service providers to support our operations, including website hosting providers, information technology providers, communication platforms, learning management systems, data storage providers, and administrative service providers. These providers may access personal information only to the extent necessary to perform their authorized services and subject to applicable contractual and legal obligations.

Schools and educational partners. Where necessary for the delivery of a program, we may share relevant information with participating schools, training institutions, educational partners, or authorized program facilitators. We will seek to limit such sharing to information needed for the relevant educational or administrative purpose.

Donors and funding partners. We may provide donors, grantmakers, and funding partners with program progress reports, participation statistics, and impact information. Whenever possible, these reports will use aggregated or de-identified data. Identifiable personal information will be disclosed only where there is an appropriate lawful basis, necessary authorization, and compliance with applicable requirements.

Legal and regulatory authorities. We may disclose information when required by law, pursuant to a lawful request, or where reasonably necessary to protect the rights, safety, property, or legal interests of individuals or the Foundation.

International partners. Some of our programs and partnerships may involve organizations located outside Rwanda. Where personal information needs to be accessed, disclosed, stored, or transferred internationally, we will comply with applicable legal requirements, including the relevant requirements for international data transfers under Rwanda’s data protection framework.

We will not assume that a partnership or donor relationship, by itself, authorizes an international transfer of personal information.

7.SOMABOX and Educational Technology

Soma Foundation Rwanda supports access to educational content and digital learning opportunities through initiatives such as SOMABOX, a learning solution designed to make educational resources available in environments with limited or unreliable internet connectivity.

Where SOMABOX or an associated learning platform collects or processes personal information, the information may be used to provide learning services, administer access, maintain system security, and evaluate educational outcomes. Depending on the technical configuration of the relevant solution, information may include:

• User or account details, where accounts are enabled.
• Device or system identifiers.
• Learning activity and usage records, where these are collected.
• Technical logs necessary for troubleshooting and security.
• Feedback provided by learners, teachers, or administrators.

The specific information collected will depend on the features enabled in each deployment.

The offline nature of a SOMABOX deployment does not automatically mean that no personal information is collected or stored. Information may be stored locally on a device or server, depending on the configuration.

We will seek to apply appropriate access controls, minimize the collection of unnecessary personal information, and communicate relevant privacy information to participating institutions and users. Where a school or partner organization independently determines the purposes and means of processing learner information, the respective responsibilities of that organization and Soma Foundation Rwanda will depend on the actual arrangement and applicable law.

8.Data Security

We take reasonable technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, loss, misuse, or destruction. Depending on the nature of the information and the systems involved, these measures may include:

• Restricting access to authorized personnel.
• Using passwords, access controls, and authentication measures.
• Maintaining appropriate system and software security.
• Protecting information during storage and transmission where applicable.
• Providing staff and authorized personnel with privacy and data protection guidance.
• Reviewing data access and handling practices.
• Taking steps to identify, investigate, and respond to security incidents.

We seek to ensure that individuals who handle personal information understand their responsibilities and that third-party service providers are subject to appropriate safeguards. However, no website, electronic communication method, or storage system can be guaranteed to be completely secure. We cannot promise absolute security, but we will take reasonable steps to reduce risks and respond appropriately when incidents occur.

Where a personal data breach occurs, we will follow applicable legal requirements concerning assessment, documentation, notification, and mitigation.

9.Data Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law. Retention periods may vary according to the type of information and the relevant activity. For example:

• Website inquiries: retained for the period necessary to respond to and manage the inquiry and any related follow-up.
• Program and training records: retained as necessary for program administration, evaluation, accountability, and applicable reporting obligations.
• Donor and partnership records: retained as necessary to manage relationships, document activities, and meet relevant legal or contractual requirements.
• Financial and administrative records: retained in accordance with applicable recordkeeping requirements.
• Photographs and testimonials: retained for the period necessary for the authorized purpose, subject to applicable consent and withdrawal requirements.
• Technical and security logs: retained for a period appropriate to the security, maintenance, and operational purposes for which they were collected.

When personal information is no longer required, we will take appropriate steps to delete, anonymize, or securely dispose of it, subject to applicable legal obligations and legitimate recordkeeping requirements.

10.Your Privacy Rights

Subject to applicable law and any relevant limitations, you may have the right to:

• Access: request information about the personal information we hold about you.
• Correction: request correction of inaccurate or incomplete information.
• Deletion: request deletion of personal information where applicable legal conditions are satisfied.
• Withdraw consent: withdraw consent where processing is based on consent.
• Object or restrict processing: exercise applicable rights concerning certain uses of your personal information.
• Receive information: ask how your personal information is collected, used, and shared.
• Seek redress: submit a complaint to the relevant data protection authority where you believe your rights have been infringed.

To exercise a right, please contact us using the details in the Contact Information section of this Policy. We may need to verify your identity before responding to a request. We will handle requests in accordance with applicable law and explain where a request cannot be fulfilled in whole or in part.

Where a request concerns a child’s personal information, we may need to verify the authority of the parent, guardian, or other person making the request.

11.Children’s Privacy and Safeguarding

Protecting children and young learners is particularly important to our educational mission. Where our activities involve children, we will take reasonable steps to ensure that personal information is collected and used appropriately, securely, and for purposes consistent with the child’s interests. Our approach includes:

• Collecting only information reasonably necessary for the relevant activity.
• Obtaining parental or guardian consent where required by law.
• Limiting access to children’s information to authorized individuals.
• Avoiding unnecessary public disclosure of identifiable information.
• Applying appropriate permissions when using photographs, videos, or testimonials.
• Taking reasonable steps to prevent the misuse of children’s personal information.

Under Rwanda’s Law No. 058/2021, parental responsibility consent is generally required for the processing of personal information belonging to a child under 16, subject to applicable legal exceptions. Where we become aware that children’s information has been collected improperly, we will assess the situation and take appropriate corrective action.

12.Third-Party Websites and Services

Our website may contain links to external websites, social media platforms, educational resources, partner websites, or other third-party services. These external services may have their own privacy policies, cookies, and data collection practices.

Soma Foundation Rwanda does not control the privacy practices of independent third-party websites and is not responsible for their policies or content. We encourage you to review the privacy policy of any external website or service before providing personal information.

Where our website embeds third-party content or tools, those services may process technical or usage information in accordance with their own terms and applicable law.

13.International Data Transfers

Soma Foundation Rwanda may work with international organizations, technology providers, and educational partners. Where personal information is transferred outside Rwanda or made accessible to recipients in other countries, we will ensure that the transfer satisfies applicable requirements under Rwanda’s Law No. 058/2021 and any other relevant law.

Depending on the circumstances, this may require appropriate authorization, consent, contractual safeguards, or another lawful transfer mechanism. We will also take account of any applicable requirements governing the storage of personal information outside Rwanda.

Where necessary, we will enter into appropriate agreements with recipients and service providers to establish their responsibilities for protecting the information.

14.Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our programs, website functionality, technology, organizational practices, or legal obligations. When we make changes, we will update the date shown at the top of this page.

Where changes materially affect how we use personal information, or where applicable law requires additional notice or consent, we will take appropriate steps to inform affected individuals. We encourage visitors to review this Policy periodically.

15.Complaints and Concerns

If you have concerns about how Soma Foundation Rwanda collects, uses, stores, or shares your personal information, we encourage you to contact us first so that we can review and address your concern.

You may also contact the relevant data protection authority in Rwanda or another competent supervisory authority, as applicable. The Rwanda Data Protection and Privacy Office provides information about personal data protection requirements and avenues for complaints, at https://dpo.gov.rw/

16.Contact Information

For questions, requests, or concerns relating to this Privacy Policy or the handling of your personal information, please contact:

• Soma Foundation Rwanda (SFR)
• Registration No: N°908/RGB/NGO/LP/06/2023
• Address: 87 KG 601 Street, Kigali, Rwanda
• Email: somafoundationrw@gmail.com
• Website: www.sfrw.org
• Subject line: Privacy Policy or Personal Data Request

When contacting us, please describe your request clearly and include sufficient information for us to understand and respond to it.

Please do not send unnecessary sensitive personal information or copies of identity documents unless we specifically request them through an appropriate secure process.

Soma Foundation Rwanda is committed to protecting privacy, respecting the rights of individuals, and handling personal information responsibly as we work to expand access to education and digital learning opportunities.