Privacy Policy

Last updated: 17 August 2026

This policy explains how ELOHOME Ltd (Kigali, Downtown, CHIC Building, Basement -3, A056B (Gate 5), Rwanda), the data controller for the ELOHUBS marketplace at elohubs.com, collects, uses, shares and protects personal data, in line with Rwanda's Law No. 058/2021 relating to the protection of personal data and privacy.

1. What we collect

Account data: name, email address, phone number, password (stored only as a secure hash), and the one-time sign-in codes we email you.
Order data: delivery addresses, order contents and history, payment method and status, and delivery confirmations.
Payment data: processed by our payment partner (XentriPay). We receive transaction references, amounts and statuses; we never receive or store card numbers. For mobile money we process the phone number used to pay or receive payouts.
Seller verification (KYC) data: business details and supporting documents (e.g. registration certificate, ID). These are stored privately and accessible only to our verification staff via time-limited links.
Messages and reviews: conversations between buyers and sellers on the platform, product reviews, and dispute evidence you submit.
Technical data: IP address, device/browser information and server logs used for security and troubleshooting, plus the cookies described in the Cookie Policy.

2. Why we use it

To operate your account and sign you in securely (contract).
To process orders, payments, deliveries and payouts (contract).
To verify sellers and keep the marketplace trustworthy (legal obligation and legitimate interest).
To handle disputes, prevent fraud and secure the platform (legitimate interest).
To send transactional emails: order updates, sign-in codes, payout notices (contract).
To improve the platform using aggregated, non-identifying usage information (legitimate interest).
To measure platform usage and our own advertising with Google Analytics and the Meta Pixel, but only for visitors who chose "Accept all" on the cookie banner (consent; see the Cookie Policy).

We do not sell personal data.

3. Who we share it with

Sellers/Buyers you transact with: a seller sees the delivery name, address and phone needed to fulfil your order; a buyer sees the seller's business profile.
Service providers: payment processing (XentriPay), transactional email delivery (Brevo), cloud hosting and file storage (DigitalOcean), and Google (only if you use Google sign-in or view an embedded map). Each provider processes only what its service requires.
Authorities: where disclosure is required by Rwandan law or a lawful order.

Some providers store data outside Rwanda. Where that happens we rely on the safeguards permitted under Law No. 058/2021 for cross-border transfers.

4. How long we keep it

Account data: for as long as your account exists.
Deactivated accounts can be restored within 30 days; after permanent deletion your profile is erased and completed orders are kept in anonymised form for the other party's records and our legal obligations.
Transaction and payout records are retained as required by Rwandan commercial and tax law.

5. Your rights

Under Law No. 058/2021 you have the right to:

access the personal data we hold about you; your settings page includes a one-click "download my data" export;
correct inaccurate data (most of it is editable directly in your account);
request deletion, available in your settings, subject to the retention rules above;
object to or restrict certain processing, and withdraw consent where processing is based on it;
lodge a complaint with Rwanda's supervisory authority for data protection (the National Cyber Security Authority).

6. Security

All traffic is encrypted (HTTPS). Passwords are hashed, payment pages are hosted by our payment partner, KYC documents are stored privately with time-limited access links, and administrative actions on the platform are recorded in an audit log.

7. Children

ELOHUBS is for users aged 18 and over. We do not knowingly collect data from children.

8. Changes and contact

We will update this policy as the platform evolves and refresh the "Last updated" date above. Questions or requests about your data: use the support contacts in the site footer or on the About page.

Last updated: 17 August 2026

1. What we collect

Account data: name, email address, phone number, password (stored only as a secure hash), and the one-time sign-in codes we email you.

Order data: delivery addresses, order contents and history, payment method and status, and delivery confirmations.

Payment data: processed by our payment partner (XentriPay). We receive transaction references, amounts and statuses; we never receive or store card numbers. For mobile money we process the phone number used to pay or receive payouts.

Seller verification (KYC) data: business details and supporting documents (e.g. registration certificate, ID). These are stored privately and accessible only to our verification staff via time-limited links.

Messages and reviews: conversations between buyers and sellers on the platform, product reviews, and dispute evidence you submit.

Technical data: IP address, device/browser information and server logs used for security and troubleshooting, plus the cookies described in the Cookie Policy.

2. Why we use it

To operate your account and sign you in securely (contract).

To process orders, payments, deliveries and payouts (contract).

To verify sellers and keep the marketplace trustworthy (legal obligation and legitimate interest).

To handle disputes, prevent fraud and secure the platform (legitimate interest).

To send transactional emails: order updates, sign-in codes, payout notices (contract).

To improve the platform using aggregated, non-identifying usage information (legitimate interest).

To measure platform usage and our own advertising with Google Analytics and the Meta Pixel, but only for visitors who chose "Accept all" on the cookie banner (consent; see the Cookie Policy).

We do not sell personal data.

3. Who we share it with

Sellers/Buyers you transact with: a seller sees the delivery name, address and phone needed to fulfil your order; a buyer sees the seller's business profile.

Service providers: payment processing (XentriPay), transactional email delivery (Brevo), cloud hosting and file storage (DigitalOcean), and Google (only if you use Google sign-in or view an embedded map). Each provider processes only what its service requires.

Authorities: where disclosure is required by Rwandan law or a lawful order.

Some providers store data outside Rwanda. Where that happens we rely on the safeguards permitted under Law No. 058/2021 for cross-border transfers.

4. How long we keep it

Account data: for as long as your account exists.

Deactivated accounts can be restored within 30 days; after permanent deletion your profile is erased and completed orders are kept in anonymised form for the other party's records and our legal obligations.

Transaction and payout records are retained as required by Rwandan commercial and tax law.

5. Your rights

Under Law No. 058/2021 you have the right to:

access the personal data we hold about you; your settings page includes a one-click "download my data" export;

correct inaccurate data (most of it is editable directly in your account);

request deletion, available in your settings, subject to the retention rules above;

object to or restrict certain processing, and withdraw consent where processing is based on it;

lodge a complaint with Rwanda's supervisory authority for data protection (the National Cyber Security Authority).