Last updated: 22 August 2026
This Privacy Policy explains how ToWando collects, uses, stores, shares and protects personal information when you use our website, create an account, contact us or make an accommodation booking.
ToWando operates from Kigali, Rwanda and processes personal data in accordance with applicable data-protection requirements, including Rwanda's Law Nº 058/2021 of 13/10/2021 relating to the protection of personal data and privacy.
1. Information we may collect
Depending on how you use ToWando, we may process:
- your name and contact information;
- email address and telephone number;
- account and authentication information;
- booking dates and reservation details;
- number of guests and accommodation preferences;
- communications with our booking-support team;
- payment status, transaction references and payment method information;
- property reviews or feedback you choose to provide;
- technical information such as IP address, browser, device and system logs;
- information reasonably necessary to prevent fraud, maintain security or resolve disputes.
2. Payment information
Where a payment is processed through a mobile-money, banking or card-payment provider, that provider may process information required to authenticate and complete the payment.
ToWando does not require customers to provide their Mobile Money PIN to us, and customers should never disclose their MoMo PIN to ToWando staff.
Where card payments are supported, ToWando does not intend to store full card numbers, CVV security codes or other authentication credentials that should remain with the authorised payment provider.
3. Why we use personal information
We may process personal information to:
- search for and provide accommodation services;
- create and manage bookings;
- communicate booking confirmations and changes;
- provide customer and guest support;
- process or verify payments and refunds;
- share required booking details with the relevant property;
- manage guest accounts and saved information;
- prevent fraud, abuse and security incidents;
- maintain records required for accounting or legal obligations;
- improve the reliability and usability of the platform;
- send marketing communications where permitted and appropriately authorised.
4. Legal grounds for processing
Depending on the circumstances, personal data may be processed because it is necessary to provide a requested service or perform a booking contract, because you have given valid consent, because ToWando must comply with a legal obligation, or because processing is otherwise permitted by applicable law.
Where processing relies on consent, you may withdraw that consent subject to applicable legal requirements and without affecting processing that was lawful before withdrawal.
5. Information shared with property partners
When you make a reservation, information reasonably necessary to provide the accommodation may be shared with the property owner, manager or authorised staff.
This can include your name, contact details, reservation dates, guest count, room information, special requests and payment/booking status where necessary.
6. Other service providers
We may use trusted service providers for services such as website hosting, email delivery, communications, payment processing, security, backups, analytics and technical support.
Such providers should receive only information reasonably necessary for their function and must handle personal information subject to appropriate legal and contractual safeguards.
7. International storage or transfers
Some technology providers may operate infrastructure outside Rwanda.
Where personal data is stored, accessed or transferred outside Rwanda, ToWando will seek to comply with applicable requirements concerning international storage and transfers, including required authorisations and safeguards.
8. Data retention
We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including completing bookings, providing support, maintaining accounting and transaction records, resolving disputes and meeting legal obligations.
Retention periods may differ depending on the type of information and applicable legal requirements.
9. Security
ToWando uses reasonable technical and organisational measures intended to protect personal information against unauthorised access, alteration, loss, disclosure or destruction.
No internet-based system can guarantee absolute security. Users should protect their account passwords and should never send payment PINs or other authentication secrets to ToWando.
10. Your data-protection rights
Subject to applicable law, you may have rights including the right to:
- obtain information about personal data held about you;
- request access to your personal data;
- request correction of inaccurate information;
- request erasure where legally applicable;
- object to certain processing;
- request restriction of processing;
- request data portability where applicable;
- withdraw consent where processing relies on consent.
11. Children
ToWando's booking services are intended to be used by persons legally capable of entering a booking arrangement.
Where ToWando knowingly processes personal data of a child in circumstances requiring parental or guardian consent, the applicable requirements of Rwanda's data-protection law will be followed.
12. Cookies and similar technology
Our website may use cookies and similar technologies required for login sessions, security, preferences, website functionality and, where implemented, analytics.
Additional details may be provided through a separate Cookie Policy as the platform's analytics and marketing technologies develop.
13. Privacy requests and complaints
To exercise a privacy right or raise a privacy concern, contact ToWando using the contact details displayed on our website and clearly identify that your request concerns personal data or privacy.
Where applicable, individuals may also raise concerns with Rwanda's Data Protection and Privacy Office.
14. Changes to this Privacy Policy
We may update this policy to reflect changes in ToWando's services, technology or legal obligations. The updated policy and revision date will be published here.