Privacy policy

Piganwa, on the website piganwa.rw and in the Piganwa app, is run by Polyserve Ltd, a company registered in Rwanda. Polyserve Ltd decides how your personal data is used and is responsible for it, under Rwanda's Law N° 058/2021 on the protection of personal data and privacy. Contact us at [email protected].

• Your account: your name, work email, mobile number, your role in your company, and a protected (hashed) form of your password. If you sign in with Google, we receive your name, email and Google account identifier.
• Your company: its TIN and the details the tax and business registries hold for it (name, address, registration details, registered contact email), and the documents you upload.
• Your procurement activity: the tenders you publish or bid on, your bids and their documents, evaluations, awards, fee payments (amount, method, status and the mobile number used to pay), and support tickets.
• Sign-in and security records: when and from where you sign in (IP address, browser or app), the devices you have signed in from, and the outcome of security checks.

• To run your account and let your company publish tenders, bid and get paid.
• To confirm a company is real and that you speak for it, using the tax and business registries.
• To send the emails and text messages the platform needs: codes, deadlines, bid and award updates. You can turn off non-essential emails in your settings.
• To keep accounts safe: spotting unusual sign-ins and stopping automated password guessing.
• To keep the record of each procurement that public procurement rules require.

We don't sell personal data or use it for advertising. Bid prices stay sealed until the opening. We share data only as far as needed with:

• Other users of a procurement: the procuring entity sees the bids it receives and who submitted them; published awards name the winning company.
• Service providers that work for us: the email and SMS providers that deliver our messages, ITEC Pay for mobile-money and card payments, Google when you choose Google sign-in, Cloudflare for the bot check on unusual sign-ins, and, only when a procuring entity uses the drafting assistant, an AI provider that receives the tender text being drafted.
• Registries: the tax and business registries we check your company's TIN against.
• Authorities: when the law requires it, for example in a procurement review or appeal.

We keep your account data while your account exists. Records of procurements (tenders, bids, evaluations, awards and payments) are kept for as long as procurement and tax rules require, even after an account is deleted, but no longer show who you are. Sign-in codes expire within minutes and are deleted with your account.

You can see and correct your details in your account settings, turn off non-essential emails, and ask us at [email protected] for a copy of your data or to object to or limit how we use it. You can also complain to Rwanda's National Cyber Security Authority, which supervises data protection.

You can delete your account yourself, in the app or on the website, under Settings. We email you a code to confirm it. Deleting your account erases your name, email, phone and sign-in details and signs you out everywhere. It can't be undone. How to delete your account.

Data travels encrypted (HTTPS). Passwords and codes are stored only as hashes, sealed bids can't be read before the opening, and every important action is recorded so it can be checked.

When we change this policy we update the date below, and tell you in the app or by email if the change matters to how your data is used.