• Home
  • Privacy policy

Privacy policy

Privacy Policy – Homepoint (Hotpoint Appliances (Rwanda) Ltd.)

Nov 5, 2026 · @Manoj

1. Who we are and how to contact us

This policy explains how Hotpoint Appliances (Rwanda) Ltd., trading as Homepoint, collects and uses your personal data when you shop on www.homepoint.rw, visit our showrooms, or contact us. We follow Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, and we are registered as a data controller with the National Cyber Security Authority (NCSA), registration Nº 001/1454/024.

Company

Hotpoint Appliances (Rwanda) Ltd. (trading as Homepoint), TIN 101678370

Address

KK 10 Ave, Ngoma Cell, Kicukiro Sector, Kicukiro District, Kigali, Rwanda

Phone and email

0788381774, info@homepoint.rw

Data Protection Officer

Consolee Nshimiyimana, 0788381727, consolee@homepoint.rw

For any question about your personal data, or to exercise your rights (section 7), contact our Data Protection Officer.

2. What data we collect and why

We collect only the data we need for each purpose below. Data marked mandatory is needed to deliver the service; if you do not provide it, we cannot complete that order or service. Voluntary data is your choice and refusing it has no effect on your purchases.

When

Data we collect

Why we use it

Legal basis

Mandatory or voluntary

Creating an account

Name, email, phone number, password, saved addresses

To manage your account and order history

Contract with you

Voluntary (you can also order without an account where guest checkout is offered)

Placing an order (online or in a showroom)

Name, phone number, email, delivery address, products ordered, payment reference and status

To process, deliver and invoice your order, including RRA electronic invoicing (EBM)

Contract with you; legal obligation

Mandatory for the order

Paying

Mobile money number or card details

To take payment

Contract with you

Mandatory for online payment; entered directly with the payment provider, and we never see or store your PIN or full card number

Identity check (KYC)

National ID or passport details

To confirm your identity for services that require it; we tell you before we ask

Your consent

Requested only for those services

Delivery, installation, warranty and after-sales service

Name, phone number, address, product and serial number, service history

To deliver, install and repair products and handle warranty claims

Contract with you

Mandatory for the service

Contact form, phone, email or WhatsApp

Name, contact details, your message

To answer your question or request

Your consent

Voluntary

Newsletter and offers

Name, email, phone number

To send you news and offers

Your consent

Voluntary; you can withdraw at any time (section 5)

Browsing www.homepoint.rw

IP address, device and browser type, pages visited, cart contents

To run the website securely; with your consent, to measure and improve it (section 4)

Necessary to provide the website; your consent for analytics and marketing cookies

Necessary cookies cannot be switched off; others are voluntary

3. Who receives your data, and transfers outside Rwanda

We do not sell your personal data or share it with other companies for their own marketing. We share it only with the service providers below, who act on our instructions under written agreements, and with public authorities when the law requires it.

Recipient

What they do for us

Where the data is held

Shopify

Hosts our online store www.homepoint.rw, including accounts, orders and checkout

Mainly United States and Canada (Google Cloud and Amazon Web Services)

Odoo S.A.

Our business management software for sales, invoicing, delivery and warranty records

Saudi Arabia (Google Cloud data centre, Dammam), with backups in other data centres

Google (Google Workspace)

Company email and documents

Google data centres in several countries

MTN Mobile Money, Airtel Money, DPO Pay

Process your payments

According to each provider's own terms

Rwanda Revenue Authority (RRA) and other public authorities

Tax invoicing (EBM) and other obligations required by law

Rwanda

Storage and transfer outside Rwanda. Because Shopify, Odoo and Google host data abroad, your personal data is stored outside Rwanda. Each provider is bound by written service and data processing terms, encrypts data in transit, and holds recognised security certifications (for example, PCI DSS Level 1 for Shopify and ISO 27001 for Google). We are seeking authorisation from NCSA to store and transfer personal data outside Rwanda, as Articles 48 to 50 of the Law require, and we remain responsible for your data wherever it is held.

4. Cookies

Cookies are small files stored on your device when you visit www.homepoint.rw. We use only necessary cookies unless you accept others in the cookie banner shown on your first visit; you can change your choice at any time through the cookie settings link at the bottom of every page.

Type

What it does

Your choice

Necessary

Keeps your cart, logs you in, completes checkout, protects the site from fraud and misuse (set by Shopify)

Always on; the website cannot work without them

Preferences

Remembers choices such as language and region

Off unless you accept

Analytics

Counts visits and shows which pages are used, so we can improve the website (for example, Shopify Analytics)

Off unless you accept

Marketing

Measures our advertising and shows you relevant offers on other websites, where we use such tools

Off unless you accept

You can also delete or block cookies in your browser settings; blocking necessary cookies may stop the cart and checkout from working.

5. Marketing messages, consent and withdrawal

We send newsletters and offers by email, SMS or WhatsApp only if you have ticked the consent box or asked us to. Where we rely on your consent, you can withdraw it at any time, free of charge and as easily as you gave it:

  • click "unsubscribe" in any email, or reply STOP to an SMS or WhatsApp message;

  • tell staff in any Homepoint showroom; or

  • contact our Data Protection Officer (section 1).

We act on your request within 5 working days and confirm it to you. Withdrawing consent does not affect processing carried out before you withdrew it, and never affects your warranty or after-sales service. We will still keep the data the law requires, such as tax invoices, for the period in section 6.

6. How long we keep your data, and how we protect it

We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires, and then delete or anonymise it.

Data

How long we keep it

Orders, invoices and payment records

10 years, as required by Rwandan tax law

Customer account

Until you close it, or after 3 years without activity; order and invoice records are then kept only for the 10-year legal period

Delivery, installation and warranty records

Until the end of the product's warranty plus 1 year

Identity (KYC) details

For as long as the related service lasts, then deleted within 1 year

Contact-form and customer-service messages

2 years after your last contact

Marketing list

Until you withdraw consent, or 2 years after your last contact with us

Cookies

For the periods shown in the cookie banner

Security. We protect your data with individual staff accounts and two-step verification on our business systems and email, access limited to staff who need it, encrypted connections, and secure, certified hosting providers. If a breach of your personal data is likely to put your rights at high risk, we will inform you and NCSA as the Law requires.

7. Your rights and how to complain

Under Law Nº 058/2021 you have the following rights. To use any of them, contact our Data Protection Officer (section 1); we may ask you to confirm your identity, and we reply within 30 days.

Right

What it means

Information and access (Art. 18)

Know what data we hold about you, why, where it came from and whether it is transferred abroad, and receive a copy

Object (Art. 19)

Ask us to stop processing that causes you harm or distress, and to stop direct marketing at any time

Data portability (Art. 20)

Receive your data in a structured, readable format, or have it sent to another organisation where technically possible

Not to be subject to automated decisions (Art. 21)

Not be subject to decisions made only by automated means that significantly affect you

Restriction (Art. 22)

Ask us to limit the use of your data while its accuracy or an objection is being checked, or if processing is unlawful

Erasure (Art. 23)

Ask us to delete your data when it is no longer needed, you withdraw consent, or it was processed unlawfully, unless the law requires us to keep it

Rectification (Art. 24)

Have inaccurate data corrected and incomplete data completed

Designate an heir (Art. 25)

Name, in your will, an heir to exercise rights over your data

Representation (Art. 26)

Exercise your rights through a representative you authorise in writing, or a legal representative where the law allows

Withdraw consent

Withdraw any consent you have given, at any time (section 5)

Complaints. If you are not satisfied with our reply, you may appeal to the supervisory authority within 30 days of receiving it: National Cyber Security Authority (NCSA), Data Protection and Privacy Office, KG 7 Ave, A&P Building, Kacyiru, Kigali; dpp@ncsa.gov.rw; telephone +250 782 847 756 or toll-free 9080; dpo.gov.rw.

8. Other information

  • Children. Our website and services are intended for adults. We do not knowingly collect personal data of children under 16 without the consent of a parent or legal guardian; if we learn that we have, we delete it.

  • Automated decisions. We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

  • Changes to this policy. We may update this policy when our services or the law change. The latest version is always published at www.homepoint.rw with its effective date, and we will tell you about important changes by email or on the website.

Effective date: [date of publication on www.homepoint.rw].

9. Short notices for website forms

These short texts are for the web developer to place on each form, each linking to this Privacy Policy. They are not part of the policy page itself.

Where

Text to display

Registration page

We use your details to create and manage your Homepoint account and orders. Your data is hosted by our service providers, including outside Rwanda. See our Privacy Policy for how we use and protect it and for your rights.

Checkout page

We use your name, contact details and address to process, deliver and invoice your order (including RRA electronic invoicing). Payments are handled by MTN MoMo, Airtel Money or DPO Pay; we never see your PIN or full card number. Privacy Policy.

Contact form

We use your details only to reply to your message and keep it for 2 years. Privacy Policy.

Newsletter sign-up (unticked box)

☐ Yes, send me Homepoint news and offers by email, SMS or WhatsApp. I can unsubscribe at any time. Privacy Policy.

Cookie banner

We use necessary cookies to run this website. With your consent, we also use analytics and marketing cookies. Accept all / Reject optional / Settings. Privacy Policy.

Footer of every page

Privacy Policy · Cookie settings · Data Protection Officer: consolee@homepoint.rw