Privacy Policy

For RENU Financial Services (RFS)

Last updated: February 15, 2026

This Privacy Policy explains how Research and Education Network for Uganda (RENU), through RFS ("we", "us", "our"), collects, uses, stores, and shares personal data when you use RFS and related services.

1. Who We Are

• Organization: Research and Education Network for Uganda (RENU)
• Product: RFS
• Contact email: devops@renu.ac.ug

2. Scope

This Policy applies to:

• RFS services and platforms
• Related backend APIs and payment processing services
• OTP and payment notifications sent by email/SMS

3. Personal Data We Collect

3.1 Identity and account-related data

• Consumer identifiers (e.g., consumer ID, payment code, generated reference number)
• First name and last name
• Vendor name and vendor association

3.2 Contact data

• Email address
• Phone number (including mobile money number used for payment)

3.3 Transaction and payment data

• Transaction ID and financial transaction ID
• Amount and currency
• Payer message/reference
• Payment status and provider status
• Date/time of transaction
• Network/provider metadata (e.g., MTN, Airtel)

3.4 Verification data

• One-time passwords (OTPs) generated for payment code retrieval
• One-time passwords (OTPs) generated for transaction history verification

3.5 Technical and security logs

• IP address and audit log events linked to system actions
• Error/debug logs necessary for troubleshooting

4. How We Collect Data

• Directly from user inputs in RFS services (e.g., email, phone, payment code, OTP)
• From vendor/consumer records in our backend systems
• From transaction responses returned by payment providers
• From service logs generated during API use and security monitoring

5. Why We Use Data

• Authenticate users and verify identity using OTP
• Retrieve payment codes and transaction history for authorized users
• Generate payment references
• Initiate and verify payment transactions
• Send OTP/reference/payment notifications via email or SMS
• Maintain audit trails, detect abuse, and secure the service
• Comply with legal, financial, and regulatory obligations

6. Sharing and Disclosure

We do not sell personal data.

We may share data with service providers/processors strictly for service operation, including:

• Mobile money/payment networks and APIs (e.g., MTN MoMo, Airtel Money)
• Messaging providers used for SMS delivery (e.g., EGO SMS)
• Email infrastructure used to send OTP/reference/payment notices
• Hosting/operations/security providers supporting the platform

We may also disclose data when required by law, regulation, court order, or competent authority.

7. International Transfers

Some processors or provider infrastructure may process data outside your country. Where this occurs, we apply reasonable safeguards and contractual controls appropriate to the transfer.

8. Data Retention

We retain personal data only for as long as needed for:

• Service delivery and transaction reconciliation
• Security, audit, and fraud-prevention purposes
• Legal, tax, accounting, and regulatory compliance

Retention periods may vary by record type (e.g., transaction records, OTP records, audit logs). Data no longer required is deleted, anonymized, or archived per our internal controls.

9. Security Measures

We implement technical and organizational safeguards designed to protect personal data, including:

• Access controls and role-based restrictions
• Use of HTTPS/TLS in transit
• Audit logging and monitoring
• Encryption controls for selected sensitive fields in backend systems

No method of transmission or storage is 100% secure; however, we continuously work to improve safeguards.

10. Your Rights and Choices

Subject to applicable law, you may have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion or restriction of processing
• Object to certain processing
• Request support for complaints regarding data handling

To exercise rights, contact: devops@renu.ac.ug

11. Children

RFS is not intended for children under the age required by applicable law without parent/guardian involvement. If you believe a child has provided personal data improperly, contact us so we can take appropriate action.