Legal

Privacy Policy

Effective date: 26 May 2026
Last updated: 26 May 2026

1. Introduction

HomoCentric Group ("HomoCentric", "we", "us", or "our") respects your privacy and is committed to protecting personal data in a transparent and lawful manner. This Privacy Policy explains how we collect, use, disclose, store, and otherwise process personal information when you:

visit or interact with our public website at https://homocentricgroup.com and related subdomains (the "Website");
submit inquiries through our contact forms, project inquiry forms, or career application flows;
communicate with us by email, phone, or other channels;
access our internal staff dashboard and related authenticated services (the "Dashboard"); or
otherwise interact with us in connection with our software engineering, cloud, data, AI, cybersecurity, and digital transformation services (collectively, the "Services").

This Privacy Policy applies to personal data we process as a data controller. When we deliver client projects under a separate contract, statement of work, or data processing agreement, that engagement may be governed by additional or different terms agreed with the client.

Please read this Privacy Policy carefully. By using the Website or Services, you acknowledge that you have read and understood this Privacy Policy. Where required by applicable law, we will seek your consent for specific processing activities.

Important: This document is provided as a draft for operational use. You should have it reviewed by qualified legal counsel in Rwanda and any other jurisdictions where you actively market or process personal data before publication.

2. Who we are (data controller)

Data controller: HomoCentric Group
Registered / principal address: KG 503 St, Kacyiru, Kigali, Rwanda
General contact: [email protected]
Website: https://homocentricgroup.com

3. Scope of this policy

This Privacy Policy covers personal data processed through:

Surface Examples Public Website Browsing pages, reading blog posts, viewing portfolio work, browsing careers, submitting contact or project forms, applying for jobs Dashboard Staff login (email/password and one-time passcodes), password reset, content management, HR review of applications, audit activity Communications Email notifications (e.g., OTP codes, contact form alerts, application receipts) Infrastructure Hosting, database, media storage, and email delivery providers used to operate the Website and Dashboard

This policy does not cover:

Third-party websites, platforms, or services linked from our Website (each has its own privacy practices);
Client systems, applications, or environments we build or operate under separate contractual arrangements, unless we explicitly state otherwise in writing; or
Personal data you choose to publish in public forums or social networks that we do not control.

4. Personal data we collect

We collect personal data that you provide directly, that we generate in the course of providing Services, and that we receive from technology systems that support our operations.

4.1 Information you provide to us

Contact and inquiry forms

When you use our general contact form or project inquiry form, we may collect:

Full name
Email address
Company or organization name (optional)
Message content, project title, budget band, and timeline preferences (project inquiries)
Any other information you voluntarily include in your message

Career applications

When you apply for a role listed on our Website, we may collect:

Full name
Email address
Phone number (optional)
Cover letter or supporting statement (optional)
Résumé / CV and related documents you upload
Any information contained in documents you submit

Dashboard account registration and administration

For authorized staff and administrators, we collect and maintain:

First and last name
Work email address
Password (stored only as a cryptographic hash, never in plain text)
Role and access permissions (e.g., super administrator, editor, HR, viewer)
Account status (active/inactive)

Communications with us

If you email us, call us, or meet with us, we may retain the content of those communications and associated metadata (dates, participants, attachments).

4.2 Information collected automatically

When you visit the Website or use the Dashboard, our systems may automatically collect:

Device and browser data: IP address, browser type and version, operating system, device type, language preferences, and similar technical identifiers
Usage data: Pages viewed, referring/exit URLs, approximate geographic location derived from IP address, timestamps, and interaction events necessary to operate and secure the site
Session and security data: Authentication session identifiers, login timestamps, failed login attempts, rate-limit counters, and anti-abuse signals
Log data: Server, application, and error logs generated by our hosting infrastructure

We do not intentionally collect sensitive categories of personal data (such as health information, biometric data, or government ID numbers) through the public Website unless you voluntarily include them in a free-text field or uploaded document—and we ask that you avoid doing so unless strictly necessary.

4.3 Information from third parties

We may receive personal data from:

Email delivery providers (delivery status, bounce information)
Media hosting providers (metadata associated with uploaded files)
Professional references or recruiters (if you apply for a role through a third party, with your knowledge)
Clients or partners who introduce you to us for business purposes

We process such data in accordance with this Privacy Policy and applicable law.

4.4 Cookies and similar technologies

We use cookies and similar storage mechanisms as described in Section 8 below.

5. How we collect personal data

We collect personal data through:

Direct submission — forms, uploads, email, phone, and in-person interactions
Automated technologies — server logs, session cookies, and security tooling embedded in the Website and Dashboard
Administrative processes — creation of staff accounts by authorized administrators
Service providers — subprocessors that host, transmit, or store data on our behalf under contractual safeguards

We may combine information collected from different sources where lawful and relevant to the purposes described in this policy.

6. Legal bases for processing

Depending on your location and the nature of the processing, we rely on one or more of the following legal bases:

Legal basis Typical use Contract Processing necessary to respond to your inquiry, evaluate your job application, provide Dashboard access to authorized users, or perform services under agreement Legitimate interests Operating and securing the Website and Dashboard, preventing fraud and abuse, improving our services, maintaining business records, and limited direct communication about related opportunities—balanced against your rights Consent Where required for optional communications, non-essential cookies, or other processing for which consent is the appropriate basis under applicable law Legal obligation Compliance with tax, employment, regulatory, or law-enforcement requirements Vital interests / public interest Rare circumstances involving safety or legal claims

For users in the European Economic Area (EEA), United Kingdom, or other jurisdictions with similar frameworks, we will identify and document the applicable legal basis upon request.

For users in Rwanda, we process personal data in accordance with Law No. 004/2021 of 8 October 2021 relating to the protection of personal data and privacy and related regulations, including ensuring processing is fair, lawful, and limited to stated purposes.

7. How we use personal data

We use personal data for the following purposes:

7.1 Website and communications

Respond to contact messages and project inquiries
Send acknowledgment or receipt emails where configured
Provide information you request about our services, careers, or content
Operate blogs, portfolio pages, service descriptions, and other published content

7.2 Recruitment

Review and evaluate job applications
Communicate with candidates about application status
Maintain recruitment records and internal notes (visible to authorized HR and administrative staff)
Comply with employment and equal-opportunity obligations

7.3 Dashboard and authentication

Create and manage staff user accounts
Authenticate users via password and/or one-time passcode (OTP) sent by email
Enforce role-based access control
Reset passwords and maintain session security
Record audit logs of significant administrative actions

7.4 Security, integrity, and compliance

Detect, prevent, and investigate fraud, spam, unauthorized access, and abuse
Apply rate limiting and similar protective measures
Monitor system performance and diagnose errors
Enforce our Terms of Service and protect our legal rights

7.5 Business operations

Internal reporting and analytics derived from aggregated or de-identified data
Record keeping, accounting, and legal compliance
Planning and improving our Website, Dashboard, and service offerings

7.6 Marketing (limited)

We do not sell your personal data. We may, where permitted by law:

Send service-related announcements to existing clients or contacts with a prior relationship
Publish case studies or testimonials only with appropriate consent or anonymization

If we introduce newsletters or promotional email programs, we will provide a clear opt-in mechanism and unsubscribe option.

8. Cookies and similar technologies

8.1 What we use today

Name / type Purpose Duration Essential? hg_dashboard_session Authenticates authorized Dashboard users via an HttpOnly session cookie tied to a server-side session record Session / up to 30 days (configurable) Yes (Dashboard only) hg_password_reset Short-lived token cookie supporting secure password reset after OTP verification Short-lived (minutes) Yes (password reset flow only) sidebar_state Remembers Dashboard sidebar expanded/collapsed preference Up to 7 days Functional (Dashboard UI) Server logs Security, debugging, and operational monitoring Per retention schedule Yes

We currently do not deploy third-party advertising cookies or mainstream analytics cookies (such as Google Analytics) on the public Website. If we add analytics or marketing tags in the future, we will update this policy and, where required, obtain consent before activating non-essential cookies.

8.2 Your choices

Dashboard cookies are required for authenticated access; you may clear them by signing out or using browser controls, which will end your session.
Most browsers allow you to block or delete cookies. Blocking essential cookies may prevent parts of the Website or Dashboard from functioning correctly.

We do not sell, rent, or trade your personal data. We may share personal data in the following circumstances:

9.1 Service providers (processors)

We use trusted third parties to help operate our business. These providers process personal data only on our instructions and subject to appropriate confidentiality and security obligations. Categories include:

Provider type Examples of processing Representative providers Cloud hosting Running the Website, Dashboard, and application servers Cloudflare Workers, Sevalla/Kinsta, or equivalent Node hosting Database Storing application and user records PostgreSQL hosting provider tied to your deployment Email delivery Sending OTP codes, contact notifications, and transactional mail Resend Media storage Storing uploaded images, documents, and résumés Cloudinary

We maintain an internal record of subprocessors and will provide a list upon reasonable request.

9.2 Professional advisers

We may disclose information to lawyers, accountants, auditors, insurers, or consultants when necessary for advice, compliance, or dispute resolution, subject to confidentiality duties.

9.3 Legal and safety

We may disclose personal data if we believe in good faith that disclosure is necessary to:

comply with applicable law, regulation, legal process, or governmental request;
enforce our Terms of Service or other agreements;
protect the rights, property, or safety of HomoCentric, our users, clients, or the public; or
detect or prevent fraud or security incidents.

9.4 Business transfers

If we undergo a merger, acquisition, reorganization, or sale of assets, personal data may be transferred to the successor entity, subject to this Privacy Policy or a successor policy with notice to you where required by law.

9.5 With your direction or consent

We may share information when you explicitly ask us to do so or when you consent to a specific disclosure.

10. International data transfers

HomoCentric is based in Rwanda. Our service providers may process personal data in Rwanda, the European Union, the United States, or other countries where they maintain infrastructure.

When personal data is transferred outside Rwanda or the EEA/UK to jurisdictions that may not provide an equivalent level of protection, we implement appropriate safeguards, which may include:

standard contractual clauses or equivalent transfer mechanisms;
verifying that the recipient maintains adequate security practices; and
limiting transfers to what is necessary for the stated purpose.

You may contact us for more information about transfer safeguards relevant to your data.

11. Data retention

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law.

Data category Typical retention period Contact and project inquiry messages Up to 36 months after last interaction, unless a business relationship continues Career applications (including résumés) Up to 24 months after the hiring decision or closure of the role, unless you consent to longer retention for future opportunities Dashboard user accounts Duration of employment/engagement plus up to 12 months thereafter for audit and security purposes Authentication sessions and OTP records Sessions expire automatically; OTP tokens expire within minutes and are invalidated after use Server and security logs 90 days to 12 months, depending on severity and investigation needs Audit logs (administrative actions) Up to 24 months or longer if required for compliance

When retention periods expire, we delete or anonymize personal data. Backups may persist for a limited additional period before being overwritten.

12. Security measures

We implement administrative, technical, and organizational measures designed to protect personal data, including:

Encryption in transit (HTTPS/TLS) for Website and Dashboard traffic
Hashed password storage using industry-standard password hashing algorithms
HttpOnly, Secure session cookies for Dashboard authentication where supported by the deployment environment
Role-based access control limiting staff access to data required for their function
Rate limiting on authentication and sensitive endpoints to mitigate brute-force and abuse
Audit logging of significant administrative actions
Vendor due diligence for hosting, email, and media providers
Principle of least privilege for production systems and credentials

No method of transmission or storage is completely secure. While we strive to protect personal data, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your Dashboard credentials and OTP codes.

If we become aware of a personal data breach that poses a risk to your rights and freedoms, we will notify affected individuals and regulators as required by applicable law.

13. Your privacy rights

Depending on your jurisdiction, you may have some or all of the following rights:

Right Description Access Request confirmation of whether we process your personal data and obtain a copy Rectification Request correction of inaccurate or incomplete personal data Erasure Request deletion of personal data in certain circumstances Restriction Request that we limit processing in specific situations Objection Object to processing based on legitimate interests or for direct marketing Portability Receive personal data you provided in a structured, commonly used, machine-readable format where technically feasible Withdraw consent Where processing is based on consent, withdraw consent at any time without affecting prior lawful processing Complaint Lodge a complaint with a supervisory authority

13.1 Rwanda

Under Rwanda's data protection framework, you may exercise rights including access, rectification, erasure, restriction, and objection, subject to legal exceptions. You may also file a complaint with the National Cyber Security Authority (NCSA) or other competent body designated under applicable Rwandan law.

13.2 EEA / UK

If GDPR or UK GDPR applies, you have the rights listed above and may contact your local supervisory authority.

13.3 How to exercise your rights

Submit a request to [email protected] with the subject line "Privacy Rights Request". We may need to verify your identity before responding. We aim to respond within 30 days, or within the timeframe required by applicable law.

We will not discriminate against you for exercising privacy rights.

14. Children's privacy

The Website and Dashboard are not directed to children under the age of 16 (or the minimum age required in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact us and we will take steps to delete such information.

15. Automated decision-making and profiling

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals in connection with the public Website or standard recruitment workflows.

Internal spam and abuse prevention may use automated scoring (e.g., rate limits, honeypot fields) without legal effect on your rights beyond temporary access restrictions.

16. Third-party links and embeds

Our Website may contain links to third-party sites (e.g., LinkedIn, GitHub, Twitter/X). We are not responsible for the privacy practices of those sites. We encourage you to review their privacy policies before providing personal data.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will:

update the "Last updated" date at the top of this document;
publish the revised policy on the Website at /legal/privacy-policy; and
where required by law, provide additional notice (such as email or a prominent Website banner).

Your continued use of the Website or Services after the effective date of an updated policy constitutes acknowledgment of the changes, except where further consent is required.

18. Contact us

For questions, concerns, or requests relating to this Privacy Policy or our data practices:

HomoCentric Group
KN 503 St, Kacyiru, Kigali, Rwanda
Email: [email protected]
Website: https://homocentricgroup.com