Contents
1. Who We Are
The RISE (Rwanda Integrated Support for Education) Programme is administered by the Rwanda Education Board (REB), a government agency under the Ministry of Education of Rwanda. The RISE Platform (“Platform”) is the digital system used to manage recruitment, assessment, and operational oversight of learning facilitators across Rwanda.
For data protection purposes, REB is the Data Controller for all personal information processed through this Platform.
2. Data We Collect
We collect the following categories of personal data when you use the Platform:
| Category | Examples | Required? |
|---|---|---|
| Identity | Full name, National ID (16-digit), date of birth, gender | Yes |
| Contact | Phone number, email address | Phone required; email optional |
| Location | Province, district, sector, cell, village, GPS coordinates | District & sector required |
| Education | Degree type, graduation year, university | Depends on campaign |
| Documents | CV link, degree certificate link, ID scan link | Optional / campaign-specific |
| Vulnerability | Disability status and type, refugee status | Optional |
| Application data | Responses to campaign form questions, scores, review comments | Yes |
| Usage data | Browser type, IP address, page views (anonymised) | Automatic |
Sensitive data (National IDs, phone numbers) is encrypted at rest using AES-256 encryption.
3. How We Use Your Data
We use your personal data exclusively for the following purposes:
- Processing and evaluating your application to the RISE Programme
- Communicating your application status via SMS and email
- Matching selected facilitators with appropriate learning sites based on location
- Conducting programme quality assurance and monitoring
- Generating anonymised aggregate statistics for programme reporting to donors and government bodies
- Verifying your identity when you use the Application Status Check feature
- Complying with applicable Rwandan law and education sector regulations
We do not use your data for marketing, profiling, or automated decision-making that produces legal effects without human oversight.
4. Legal Basis for Processing
Our legal bases for processing your data under Rwandan data protection law are:
- Consent — for optional data fields and email communications
- Contractual necessity — for processing applications and managing facilitator assignments
- Legitimate interests — for programme monitoring, quality assurance, and security
- Legal obligation — where required by Rwandan Ministry of Education directives
6. Retention Period
We retain your personal data for the following periods:
- Active applicant records: for the duration of the recruitment campaign plus 3 years
- Hired facilitator records: for the duration of the programme plus 5 years
- Rejected or withdrawn applications: 1 year from the close of the campaign
- System access logs: 90 days
After the retention period, personal data is either anonymised for statistical purposes or securely deleted.
7. Your Rights
Under Rwandan data protection law, you have the following rights:
- Access — to request a copy of the personal data we hold about you
- Rectification — to correct inaccurate or incomplete data
- Erasure — to request deletion of your data (subject to legal obligations)
- Restriction — to request that we limit processing of your data
- Objection — to object to processing based on legitimate interests
- Portability — to receive your data in a machine-readable format
To exercise any of these rights, contact us at the address in Section 11. We will respond within 30 days of receiving your request.
8. Data Security
We implement the following technical and organisational security measures:
- AES-256 encryption for all sensitive PII at rest (National IDs, phone numbers)
- TLS/HTTPS encryption for all data in transit
- Role-based access controls limiting data access to authorised staff only
- Audit logs tracking all access to and modifications of personal data
- Regular security assessments and penetration testing
- Secure, password-protected MongoDB replica set with authentication
In the event of a data breach that poses a risk to individuals, we will notify affected parties and the relevant authority within 72 hours of becoming aware of the breach.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be announced via the Platform and, where appropriate, by email. The “Last updated” date at the top of this page indicates when the policy was last revised.
Continued use of the Platform after a change constitutes acceptance of the updated policy.
11. Contact Us
For data protection queries, to exercise your rights, or to report a concern, please contact:
Rwanda Education Board (REB)
Data Protection Officer
KG 595 St, Gasabo, Kigali, Rwanda
Email: dpo@reb.rw