Privacy Policy
Last Updated November 08, 2023
This Privacy Policy (“Policy ”) describes how Kasha Technologies, Ltd, Kasha Rwanda
Ltd. and their affiliates (collectively, “Kasha,” “we,” “us,” or “our”) collect and processdata relating to individuals (“Personal Data”) when you visit Kasha’s websites (each“Site” and together the “Sites”) or purchase products from us through our WhatsApp
Channel , USSD, or call center (collectively, the “Services”), or otherwise interact with oruse the Services. Kasha respects your privacy and is committed to protecting your
Personal Data.
Specifically, in this Policy we will cover:
●
●
●
●
●
●
●
●
●
●
●
●
●
●

Who We Are
Data Controller
Information We Collect
How We Use Information
How We Share and Disclose Information
Data Retention
ChildrenYour Rights
Links to Other Sites
Cookies and Similar Technologies
Security
Changes to the Privacy Policy
Data Transfers
Contact Us

Please read this Policy carefully to learn how we collect, use, share, and otherwise
process Personal Data and to learn about your rights and choices regarding your
Personal Data. By using the Services or otherwise providing Personal Data to us, youagree to the practices described in this Policy. If you do not agree to this Policy, please
do not access the Services or otherwise provide Personal Data to us.
This Policy constitutes an integral part of our Terms and Conditions, accessiblehere:1. WHO WE ARE
Kasha provides an e-commerce platform for women’s health, personal care and beautyin Africa. Our mission is to make it easy for all women to get the health and self-care
products and information they need to live their best lives, including women in low-income
rural areas of emerging markets. We work with corporations and organizations alignedwith our purpose to deliver genuine health care and women-based products and services
to women and people that need them.
2. DATA CONTROLLER
The Kasha Rwanda with whom you are engaging is a Data Controller who is duly
registered with the National Cyber Security Authority. We are legally authorized toprocess the Personal Data that we collect in connection with our Services. You can find
our contact details under “Contact Us” below. We strictly adhere to statutory duties anddata subject’s rights as provided by the Law Nº 058/2021 Of 13/10/2021 Relating to theProtection of Personal Data and Privacy
3. INFORMATION WE COLLECTIn providing the Services, we collect various types of Personal Data. We have grouped
the types of Personal Data that we process as follows:
3.1. Information We Collect Directly From You
With your consent we collect the following categories of Personal Data from you when
you place an order or otherwise interact with or use the Services:
Account Information: If you choose to sign up for an account with Kasha on the Site wewill collect your email address and password. If you create an account or log into youraccount using third-party services, such as Google or Facebook, we will receive yourname and email address as permitted by your profile settings on the third-party service inorder to authenticate you. The information we receive when you authenticate through athird-party service depends on the settings, permissions and privacy policy controlled bythat third-party service. You should always check the privacy settings and notices in therelevant third-party services to understand what data may be disclosed to us. Moreover,
we may collect additional information if you elect to provide it, such as age and gender.
Order Information: When you place an order, we may collect information about theordered products, the name that you provide, your email address, address, phone
number, delivery location and any additional information that you may elect to provide.
We may also retain a history of the products you browse and/or purchase using theServices. Moreover, if you place an order through our call center, the conversation may
be recorded for quality control purposes.
Information You Provide In Correspondence and Through Forms: We may collect
Personal Data that you provide to us when you request information by entering Personal
Data into form fields, contact us by phone, email, use the chat functionality available on
the Services or otherwise, or leave comments on our Site, such as when using our blog
(however, your email will not be published). You decide what Personal Data is provided
to Kasha, but this may include your name, email address or phone number, and any otherinformation that you elect to share with us. Providing this information is optional to you.
Surveys: We may collect information when you voluntarily respond to questionnaires,
surveys or requests for market research seeking your opinion and feedback. Providing
this information is optional to you.
Payment Information: If you make a purchase through our Services, our payment
processors- bank or cash apps or Mobile transfer services , will process certain
payment and billing information, such as billing address, payment card details and bankinformation.
Information We Collect Through our Pharmaceutical and Telemedicine Solution: If
you make a purchase of pharmaceuticals through our Services, we may collectinformation about your age, a copy of the prescription, and other health related
information which is necessary to fulfill your order.
Information required for provision of Contraceptive Consultations:If you wish to seek contraceptive consultations we will collect your name, phone number,email address, age, gender, and preferred treatment location and share the information
with our Contraceptive Consultations Provider.
Medical Disclaimer: The information on our Services is not intended or implied to be a
substitute for professional medical advice, diagnosis or treatment. All content, including
text, graphics, videos, images and information, contained on or available through our
Services is for general information purposes only. You are encouraged to confirm any
information obtained from or through the Services with other sources, and review all
information regarding any medical condition or treatment with your physician. NEVER
DISREGARD PROFESSIONAL MEDICAL ADVICE OR DELAY SEEKING MEDICALTREATMENT BECAUSE OF SOMETHING YOU HAVE READ ON OR ACCESSEDTHROUGH THESE WEBSITES. IF YOU OR A LOVED ONE ARE EXPERIENCING A
MEDICAL EMERGENCY, CALL YOUR LOCAL EMERGENCY NUMBER.
Information We Collect Through Our Social Media Pages: We have pages on social
media sites like Facebook, Instagram, and LinkedIn (“Social Media Pages”). When you
interact with our Social Media Pages, we will collect Personal Data that you elect toprovide to us through your settings on the Social Media site, such as your contact details.
In addition, the companies that host our Social Media Pages may provide us withaggregate information and analytics regarding the use of our Social Media Pages.

Automatically Collected Data: When you visit, use and interact with the Services, we
may receive certain information about your visit, use or interactions. For example, we may
monitor the number of people that visit our Services, peak hours of visits, which page(s)are visited, the domains our visitors come from (e.g., google.com, yahoo.com, etc.), andwhich browsers people use to access and visit our Services (e.g., Firefox, Microsoft
Internet Explorer), broad geographical information, and navigation pattern. In particular,
the following information is created and automatically logged in our systems:● Log data: Information that your browser automatically sends whenever you visit the
Site (“log data”). Log data includes your Internet Protocol (“IP”) address (so weunderstand which country you are connecting from when you visit the Site), browser
type and settings, the date and time of your request, and how you interacted with the
Site.
● Cookies and Similar Technologies: Like many websites, we use "cookies" andsimilar technologies. Please see the “Cookies and Similar Technologies” (Paragraph10) section below to learn more about how we use cookies and similar technologies.
● Device information: Includes name of the device, operating system, and browser you
are using. Information collected may depend on the type of device you use and its
settings.
● Usage Information: We collect information about how you use our Site, such as thetypes of content that you view or engage with, the features you use, the actions you
take, and the time, frequency and duration of your activities.
Information We Collect from Other Sources: In some instances, Kasha may accessyour data through third parties. For example: local government entities may provide
Kasha with a list of patients’ contact information who are approved to order products
through our Services. And we might receive information about you from other sources,
such as updated delivery and address information from our carriers, which we use tocorrect our records and deliver your next purchase more easily.
4. HOW WE USE INFORMATIONWith your consent we process your information as necessary to:● Enable us to process your orders pursuant to the applicable Terms and Conditions
or to take steps at your request prior to entering into a contract with you(“Contract”), and/or● Enable us to comply with legal obligations (“Legal Obligation”)● Pursue legitimate interests of you, Kasha or those of third parties if any are
involved, provided your interests and fundamental rights do not override thoseinterests. This Policy describes when we process your Personal Data for
Legitimate Interests, what these interests are and your rights. We will not use your
Personal Data for activities where the impact on you overrides our interests,
unless we have your consent or those activities are otherwise required or
permitted by law.

We strongly rely on your consent as a legal basis for processing your Personal Data, insuch case, you have the right to withdraw your consent at any time by following the
instructions contained in Withdraw consent form
We have set out below, in table format, the ways we use your Personal Data, and thelegal bases we rely on to do so. We may use your Personal Data for other purposes which
you have consented to at the time of providing your data.
Type of Personal Data

Why Processed

Account Information● To set up and maintainyour account and contact
you regarding your use of
the Services● To monitor and enforce
compliance with our Terms
and Conditions● To administer and protect
our business and theServices, prevent fraud,criminal activity, or misusesof our Services, and toensure the security of ourIT systems, architectureand networks (including
troubleshooting,testing,systemmaintenance,
support and hosting ofdata)● With your consent, to send
you information on our new
products or services orother promotions. If you
provide us with yourconsent for such purpose,
you have the right towithdraw your consent at
any time.
● In relation to information
about age and gender (if

Legal
Basis
for
Processing● Contract● Legal Obligation● Legitimate Interest in(i) conducting andprotecting
ourbusinessandoperations,(ii)
enforcing or defending
legal
rights,or
preventing
damage,(iii)
keeping
ourServices, network andinformation systems
secure;and(iv)
providevaluableinsights to third parties
forcommercial,statistical and market
research purposes, as
further
described
under the section
below titled “How We
Share And Disclose
Information”.
● Consent, for sending
marketingcommunications
regardingotherproducts and services

you elect to provide it), to
de-identify
and/oranonymize this informationand share it in de-identified
and/or anonymized way
only as described under thesection below titled “HowWe Share And Disclose
Information.
Order Informationthat may be of interest
to you● To take and handle orders, ● Contract
deliver
products
and ● Legitimate Interest inservices and communicate(i) personalizing yourwith you about orders,experience, andproducts and services.
(ii) provide valuable● In relation to recording
insights to third parties
calls with our call center, toforcommercial,
maintain, monitor andstatistical and market
improve the usability andresearch purposes, forfunctionality of theexample to allow thoseServices.
parties to analyze
patterns
among● To remember a history of
the products ordered togroups of people, andconducting research
recommendfeatures,on
consumerproducts, and services that
demographics,
might be of interest to you,interests and behavior,
identify your preferences,
as further describedandpersonalize
yourunder the section
experiencewith
ourServices.
below titled “How We
Share And Disclose● To de-identify and/or
Information”.
anonymize information and(Paragraph 5)
share de-identified and/or
anonymized information as
described under thesection below titled“How We Share And
Disclose Information”.
(Paragraph 5)

Information You Provide ● To respond to your ● Your Consent as data
In Correspondence andrequests or concerns
subject
Through Forms● Contractual necessity● Legitimate Interest incommunicating
withyou
Surveys● For
marketpurposes

research ● Your Consent as data
subject● Researchauthorizationupon● Our Legitimate Interest
is better understanding
our customer base so
we can improve our
products and services
Payment Information● To manage payment, fees ● Contract
and charges● Legal Obligation● Legitimate Interest in
enforcing or defending
legal
rights,or
preventing damage

Information We Collect ● To provide you with our ● Consent
ofdata
Throughour
products that require a
subject
Pharmaceuticalandprescription● Contractual necessity
Telemedicine Solution● Legal Obligation
Information that You ● To respond to your ● Vital interests of theProvide Through ourdata subject or otherinquiries
Social Media Pages
person● With your consent, to send●
Consentofdata
you information on our new
subject
products or services orother promotions. If you ● Contractual necessity
provide us with yourconsent for such purpose,
you have the right towithdraw your consent at
any time.
Information we collectfor
contraceptive
consultations● To refer you to ourContraceptive
Consultations Partner● To provide after care
support afterConsultations● To receive feedback fromyou or our consultant on
our service delivery

Automatically Collected ● To administer our Services,
Data
provide functionality, fix
errors, analyze how you
interact with our Services
and provide, maintain andimprove the usability andfunctionalityoftheServices.
● To protect our business,prevent fraud, criminal
activity, or misuses of ourServices, and to ensure thesecurity of our IT systems,
architecture and networks● To comply with legal
obligations and to protect
our operations and rights
and enforcing or defending
legal rights, or preventing
damage●Vital interests of thedata subject orother person● Consent of data
subject● Contractual
necessity● Legitimate Interest in(i) analyzing the use of
our Services in order todevelop and enhancethem,● (ii) conducting andprotecting ourbusiness andoperations,● (iii)keeping
ourServices, network andinformation systems
secure● Legal obligation

5. HOW WE SHARE AND DISCLOSE INFORMATION
We share your information with third parties in the following situations:● Vendors and Service Providers: To assist us in meeting business operations
needs and to perform certain services and functions, we may share Personal Datawith service providers, including hosting and other information technology
services; email communication software providers and email newsletter providers;providers of call center services; database and sales/customer relationshipmanagement services; payment service providers; order fulfillment service
providers, and web analytics services (for more details on the third parties thatplace cookies and similar technologies through the Site, please see the “Cookies
and Similar Technologies” section below. Paragraph 10 Pursuant to our
instructions, these parties will access, process or store Personal Data in the courseof performing their duties to us.
● Information required for provision of Contraceptive Consultations: If you wish toseek contraceptive consultations, we will collect your name, phone number, email
address, age, gender, and preferred treatment location and share the same with
our Contraceptive Consultations Provider,● De-identified/Anonymized Data: We may de-identify and/or anonymize theinformation we process in connection with the Services and use such de-identified
and/or aggregated data for our own internal business purposes, including but notlimited to sharing anonymized and de-identified data with affiliated companies, ourcurrent and prospective brands, business partners, agents and other third parties
for commercial, statistical and market research purposes, for example to allow
those parties to analyze patterns among groups of people, and conducting
research on consumer demographics, interests and behavior.
● Business Transfers: With your consent, your Personal Data will be used by us orshared with our affiliated companies for internal reasons, primarily for businessand operational purposes. If we are involved in a merger, acquisition, financing
due diligence, reorganization, bankruptcy, receivership, sale of all or a portion of
our assets, or transition of service to another provider, your Personal Data may beshared in the diligence process with counterparties and others assisting with thetransaction and transferred to a successor or affiliate as part of that transaction
along with other assets.
● Legal Requirements: If required to do so by law or in the good faith belief thatsuch action is necessary to (i) comply with legal or regulatory obligations, (ii)protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent
circumstances to protect the personal safety of users of the Services, or the public,or (v) protect against legal liability.

6. DATA RETENTION
We keep Personal Data for as long as your account is active; as needed to provide you
products or services; as needed for the purposes outlined in this Policy or at the time ofcollection; as necessary to comply with our legal obligations (e.g., to honor opt-outs),
resolve disputes, and enforce our agreements; or to the extent permitted by law.
If you have elected to receive marketing communications from us, we retain information
about your marketing preferences until you opt out of receiving these communications
and in accordance with our policies.
To determine the appropriate retention period for your Personal Data, we will consider
your consent , the amount, nature, and sensitivity of the Personal Data, the potential riskof harm from unauthorized use or disclosure of your Personal Data, the purposes forwhich we use your Personal Data and whether we can achieve those purposes throughother means, and the applicable legal requirements.
Generally, if you are a customer and your account is inactive, we keep personal data fora minimum of 5 years from the date of your last interaction with us as per your consent.
For personal data relating to our suppliers and employees, we retain the personal data inaccordance with our internal retention policies relating to our employees and suppliers. If
you have any questions about our retention policies, you may contact us on
privacy@kasha.co
7. CHILDREN
The Services are not directed to children who are under the age of Sixteen years (16).
Kasha does not knowingly collect Personal Data from children under the age of Sixteen
years (16). If you have reason to believe that a child under the age of 16 has provided
Personal Data to Kasha through the Services, please contact us and we will endeavor todelete that information from our databases or seek necessary consent from theirrepresentative.
8. YOUR RIGHTS
Subject to certain conditions and exceptions contained in applicable law, you have thefollowing rights in relation to your Personal Data:● Right to information: you have a right to be informed of your rights, the fact that
we are collecting your personal data, the purposes for which the data is being
collected, the legal basis upon which we collect such data, the third parties towhom we will transfer your personal data, the measures we have taken to ensure
integrity and confidentiality of your data and the consequences if any, where you
fail to provide all or any part of the requested data. We have fulfilled this rightthrough this Privacy Policy.

● Right of access: If you ask us, we will confirm whether we are processing your
Personal Data and, if so, provide you with a copy of that Personal Data alongwith certain other details. If you require additional copies, we may need to chargea reasonable fee.
● Right to rectification: If your Personal Data is inaccurate or incomplete, youare entitled to ask that we correct or complete it.
● Right to erasure: You may ask us to delete or erase or destroy your Personal
Data, such as where you withdraw your consent. If we shared your data withothers, we will tell them about the erasure where possible.
● Right to restrict processing: You may ask us to restrict or ‘block’ theprocessing of your Personal Data in certain circumstances, such as:o Where you contest the accuracy of the data;o Your data is no longer required for the purposes of the processing, unless
we require the data for the establishment, exercise or defense of a legal
claim;o The processing is unlawful, and you oppose the erasure of personal data
and ask for restriction of its use instead; ando Where you object to us processing it (please read below for information on
your right to object).
● Right to data portability: You have the right to obtain your Personal Data fromus provided that (i) the processing is not necessary for the performance of a task
carried out in public interest or in the exercise of an official authority and (ii) yourright does not adversely affect the rights and freedoms of others. We will give
you your Personal Data in a structured, commonly used and machine-readable
format.
● Right not to be subjected to automated individual decision making: If
applicable, in certain instances, you have the right not to be subjected to adecision based solely on automated processing, including profiling.
● Right to object: You may ask us at any time to stop processing your Personal
Data, and we will do so:
o If we are relying on a legitimate interest to process your Personal Data -unless we demonstrate compelling legitimate grounds for the processing or
your data is needed to establish, exercise, or defend legal claims;
o If we are processing your Personal Data for direct marketing. We may keep
minimum information about you in a suppression list in order to ensure yourchoices are respected in the future and to comply with data protection laws
(such processing is necessary for our and your legitimate interest in
pursuing the purposes described above).
● Right to withdraw consent: If we rely on your consent to process your Personal
Data, you have the right to withdraw that consent at any time. Withdrawal ofconsent will not affect any processing of your data before we received notice thatyou wished to withdraw consent.
● Right to representation: You have right to be represented when:v -You are under sixteen (16) years of age
v -You have a physical impairment and unable to represent yourself

v -You have a medically determinable mental impairment and you areunable to -represent yourself
v -You have any other reason, in which case you are being represented byanother person● Right to designate an heir to personal data: Your personal data are notprimarily subject to succession but, where you have an option to leave a will,
provide your heir with full or restricted rights relating to the processing of yourpersonal data kept by us, if such personal data still need to be used.
● Right to raise a complaint to the data protection authority: If you have aconcern about our privacy practices, including the way we handled your Personal
Data, you can report it to the Data Protection Office in Rwanda through their
Email: dpp@dpo.gov.rw
Please see the “Contact Us” section below for information on how to exercise your rights.
9. LINKS TO OTHER WEBSITESThe Services may contain links to other websites not operated or controlled by Kasha,
including social media services (“Third Party Sites”). The information that you share withThird Party Sites will be governed by the specific privacy policies and terms of service of
the Third- Party Sites and not by this Policy . By providing these links we do not imply that
we endorse or have reviewed these sites. Please contact the Third Party Sites directly for
information on their privacy practices and policies.
10.

COOKIES AND SIMILAR TECHNOLOGIESWe and our partners use cookies and similar technologies on our Services to operate andadminister the Services, conduct analytics and improve the Services. In this section we
explain these technologies, why we use them, and the choices you have.
What Are Cookies?
A cookie is a text file which is stored on your computer or other device when you visit a
website.
We use two types of cookies: session and persistent cookies. Session cookies are stored
temporarily on your device while you browse the Site and are deleted from your device
when you finish browsing. Persistent cookies remain on your device after you havefinished browsing the Site so that we can remember your preferences when you visit the
Site in future.
Some cookies are set by us (first party cookies); some cookies are set by another party’s
website (third-party cookies).

For more information about cookies, including how to set your internet browser to restrict,block or delete cookies, please go to http://www.allaboutcookies.org/.
What Types of Technologies Do We Use?
We use cookies, web beacons and other technologies to improve and customize our
Services and your experience; to allow you to access and use the Services without reentering your username or password; to understand usage of our Services and theinterests of our customers; to determine whether an email has been opened and acted
upon; and to present you with advertising relevant to your interests.
How Do We Use Them?
●

Where strictly necessary. These cookies and other technologies are essential
in order to enable the Services to provide the feature you have requested, suchas remembering you have logged in.

●

For functionality. These cookies and similar technologies remember choices
you make such as language or search parameters. We use these cookies andsimilar technologies to provide you with an experience more appropriate withyour selections and to make your use of the Services more tailored.

●

For performance and analytics. These cookies and similar technologies collectinformation on how users interact with the Services and enable us to improve
how the Services operate. For example, we use Google Analytics cookies to help
us understand how visitors arrive at and browse our website to identify areas for
improvement such as navigation, user experience, and marketing
campaigns. For more information about Google Analytics visit
https://policies.google.com/technologies/partner-sites. To prevent the storage
and processing of this data (including your IP address) by Google, you candownload and install the browser-plugin available at the following link:
https://tools.google.com/dlpage/gaoptout?hl=en.

●

Targeting or advertising cookies. These cookies collect information about yourbrowsing habits in order to make advertising relevant to you and your interests.
They remember the websites you have visited and that information is shared withother parties such as advertising technology service providers and advertisers.

●

Social media cookies. These cookies are used when you share information
using a social media sharing button or “like” button on our websites or you link
your account or engage with our content on or through a social media site. The
social network will record that you have done this. This information may be linked
to targeting/advertising activities.

What Choices Do I Have?
On most web browsers, you will find a “help” section on the toolbar. Please refer to thissection for information on how to receive a notification when you are receiving a new
cookie and how to turn cookies off. Please see the links below for guidance on how tomodify your web browser’s settings on the most popular browsers:●●●●

Internet Explorer
Mozilla Firefox
Google Chrome
Apple Safari

Please note that if you limit the ability of websites to set cookies, you may be unable toaccess certain parts of the Services and you may not be able to benefit from the fullfunctionality of the Services.
Most advertising networks offer you a way to opt out of targeted advertising. If you would
like to find out more information, please visit the Network Advertising Initiative’s online
resources at http://www.networkadvertising.org and follow the opt-out instructions there.
If you access the Services on your mobile device, you may not be able to control tracking
technologies through the settings.
11.

DATA SECURITY

We have implemented physical, technical, and administrative security measuresdesigned to protect Personal Data. However, no Internet or e-mail transmission is everfully secure or error free. In particular, e-mail sent to or from us may not be secure.
Therefore, you should take special care in deciding what information you send to us via
the Services or e-mail. Please keep this in mind when disclosing any Personal Data to
Kasha via the Internet. In addition, we are not responsible for circumvention of any privacy
settings or security measures contained on the Services, or third party websites. Should
any breach of your personal data occur, Kasha shall inform you with in 72 Hours for thetime the breach was realized
12.

CHANGES TO THE PRIVACY POLICYThe Services, and our business may change from time to time. As a result, we may
change this Policy at any time. When we do we will post an updated version on this page,
unless another type of notice is required by the applicable law. By continuing to use our
Services or providing us with Personal Data after we have posted an updated Policy , ornotified you if applicable, you consent to the revised Policy and practices described in it.

13.

DATA TRANSFERS

In connection with the operation of our Services, your Personal Data will be stored onservers in Rwanda, Kenya, and the European Economic Area (“EEA”). Your Personal
Data may be processed outside your jurisdiction by us, our contractors and third-parties
disclosed in Section 5 above that are based in other countries, as needed for the purposes
described in Section 4 above. We ensure that those countries will provide for the samelevel of data protection as your jurisdiction. When we transfer your Personal Data outsideof the country where you reside, we ensure that we have binding cross-border transfer
agreements with the parties disclosed in section 5 in place and that adequate protection
for your personal data is provided as required by applicable law.
14.

CONTACT US

If you have any questions about our Policy or the information practices of the Services,or would like to exercise any of your rights in relation to your Personal Data, please feel
free to contact us at privacy@kasha.co or reach out on:
Kasha Rwanda Limited.
Rwanda, Kigali, Gasabo, Rugando, KG 624 Street
Tel: 9111
Web: www.kasha.rw