1. Who we are and scope
INDATAFLOW LTD is established in Rwanda. This Privacy Notice applies to personal data processed in connection with the InDataFlow website, accounts, platform, support, communications, document-intake channels and related services. We process personal data in accordance with applicable law, including Rwanda Law No. 058/2021 relating to the protection of personal data and privacy.
For customer-submitted operational data, the customer organization generally determines why the data is processed and InDataFlow processes it on the customer's behalf. For account administration, security, billing, support and our own legal obligations, InDataFlow may determine the purposes of processing.
2. Information we process
InDataFlow is not designed for the routine submission of sensitive personal data unrelated to trade and logistics operations. Customers should avoid submitting unnecessary sensitive information and remain responsible for ensuring that data submitted to the service may lawfully be processed.
- Account and business contact information, such as names, work email addresses, phone numbers, company details, roles and user/account identifiers.
- Trade and logistics information, such as shipment references, bills of lading, container references, invoices, packing lists, cargo records, shipment contacts and related operational information.
- Documents and communications submitted through the platform, including PDFs, images, WhatsApp messages, email messages, attachments, captions and support communications.
- Information extracted or generated from documents, including OCR text, document classifications, identifiers, matching results, workflow status and validation records.
- Payment and subscription information, such as transaction references and payment-confirmation information. Payment providers may process additional payment data under their own terms.
- Technical and security information, such as IP addresses, authentication events, access logs, browser/device information and system-security records.
3. How we receive information
We may receive information directly from users; from the organization that provides a user with access to InDataFlow; through documents uploaded to the platform; through authorized WhatsApp or email intake channels; from payment and authentication providers; and automatically through normal use of the service.
4. Why we process information
- To provide, operate and administer the InDataFlow service.
- To receive, organize, classify, extract and match trade documents and operational records.
- To authenticate users and manage access to customer workspaces.
- To maintain cargo/document workflows, dashboards, audit trails and operational notifications.
- To process subscriptions and confirm payments.
- To provide customer support, maintain the service and improve reliability.
- To protect the platform, investigate misuse and maintain security.
- To comply with applicable legal and regulatory obligations.
5. Legal bases
Depending on the context, processing may be based on performance of a contract, legitimate interests such as security and service administration, compliance with legal obligations, consent where required, or processing carried out on documented instructions from a customer acting as Data Controller.
6. OCR and automated document processing
InDataFlow uses optical character recognition (OCR), rules, heuristics and automated software to assist with document classification, information extraction, identifier detection, document-to-cargo matching and operational workflows. Automated outputs may be incomplete or inaccurate and are intended to support, not replace, appropriate human review. InDataFlow does not make governmental or customs decisions and does not guarantee customs clearance or regulatory outcomes.
8. International storage and transfers
InDataFlow uses cloud and communications infrastructure that may involve processing or storage outside Rwanda. Where required, InDataFlow applies appropriate safeguards and seeks or maintains the authorizations required under applicable Rwandan data-protection law. Specific hosting and processing locations may depend on the services and regions configured for the platform.
9. Retention and deletion
We retain personal data only for as long as reasonably necessary for the purposes for which it is processed, to provide the service, to meet contractual or legal obligations, to resolve disputes and to maintain appropriate security and business records. Customer data is deleted or returned following termination where required by the applicable agreement, subject to lawful retention requirements and reasonable backup cycles.
10. Security
InDataFlow uses technical and organizational safeguards designed to protect personal data, including authenticated access, role-based permissions, encrypted network transport and controls intended to reduce unauthorized access, alteration, disclosure or loss. No system can guarantee absolute security.
11. Your rights
Individuals may have rights under applicable data-protection law, including rights to request access, correction or deletion of personal data and to object to certain unlawful processing. Where InDataFlow processes data on behalf of a customer organization, we may refer the request to that organization or assist it in responding.
Privacy requests may be sent to indoha@indataflow.com.
13. Changes to this notice
We may update this Privacy Notice to reflect changes to the service, law or our processing practices. The current version will identify its effective or last-updated date.
14. Contact
Data Protection Contact
INDATAFLOW LTD
Rwanda
Email: indoha@indataflow.com
Phone: +250 788 324 982