Privacy Policy

HomeTrust Ltd ("HomeTrust", "we", "us") is a company incorporated in the Republic of Rwanda with its office at KG 7 Ave, Kacyiru, Kigali, Rwanda. We provide background verification for home workers (HomeTrust Check), incident reporting and watchlist screening (HomeTrust Protect), a verification API (HomeTrust API) and a network of field agents (HomeTrust Agents).

For the purposes of Law N° 058/2021 on the Protection of Personal Data and Privacy (the "Data Protection Law"), HomeTrust is the data controller of the personal data described in this policy, and is registered with the National Cyber Security Authority (NCSA). Employers who use our services to make hiring decisions are independent controllers of the reports they receive.

Our Data Protection Officer can be reached at privacy@hometrust.rw or by post at the address above.

This policy applies to everyone whose personal data we process, including:

• Employers — households and businesses with a HomeTrust account, and their team members.
• Applicants — candidates and workers invited to complete a verification.
• Guarantors and referees — people named by an applicant to vouch for them or confirm previous employment.
• Incident subjects — people named in an incident report submitted through HomeTrust Protect.
• Agents — applicants to, and members of, the HomeTrust field agent network.
• Visitors — people who browse our website or contact us.

Some of this data is sensitive personal data under the Data Protection Law — in particular biometric data (face images used for matching), health data and information about criminal convictions. We apply additional safeguards to it as described below.

• Directly from you — when you sign up, complete a verification journey, respond as a guarantor or referee, apply as an agent or contact us.
• From employers — the name and contact details of the applicants they invite, and incident reports they submit.
• From official and partner sources — identity registries (such as the National Identification Agency), partner clinics, and payment providers (MTN Mobile Money, Airtel Money and card processors).
• From our field agents — findings, photos and GPS coordinates captured during address visits.
• Automatically — technical data and cookies when you use our website and apps.

Every verification journey begins with a consent screen that names the employer, lists each check that will run and explains why. No check runs until the applicant agrees, and the time of consent is recorded on the report.

You may withdraw consent at any time by contacting us. Withdrawal stops further processing but does not affect checks already completed. If you withdraw before the report is complete, the employer will see that the verification was not completed.

• Biometrics: selfies and liveness frames are used only to match the applicant to their ID and are not used to build a general face database.
• Health: medical results stay with the partner clinic. Employers receive only a fitness outcome — never a diagnosis.
• Criminal records: declared convictions are reviewed by a person, not rejected automatically, and are shown to the employer with context.
• Access to sensitive data inside HomeTrust is limited to trained staff on a need-to-know basis and is logged.

We calculate a 0–100 trust score from the results of each completed check. The score is a summary to help employers read the report; it is not a hiring decision. The employer decides whether to hire, and we show the evidence behind every result.

Checks that are borderline — for example declared convictions or possible watchlist matches — are routed to manual review. You have the right not to be subject to a decision based solely on automated processing and may ask us for human review of any result.

• The employer who invited you receives your report. Reports are never shared with other employers.
• Guarantors and referees see only the applicant's name and the request they are responding to.
• Field agents see the address and name needed to carry out a visit, only while the task is assigned to them.
• Partner clinics receive the details needed to book and carry out health screening.
• Service providers acting on our instructions: cloud hosting, SMS and email delivery, payment processing (MTN Mobile Money, Airtel Money, card processors) and customer support tools, bound by data processing agreements.
• Authorities such as the Rwanda Investigation Bureau, courts and regulators when required by law.

We do not sell personal data.

Incident reports are handled with particular care because they can affect a person's livelihood:

• Reports are private until our trust & safety team has verified them against evidence and, for crimes, an RIB case number.
• Before verification, the subject is notified where contact details are available and given at least seven days to respond. Responses are considered and recorded.
• Only verified or resolved incidents are used in watchlist searches and verification screening, and only as a summary (type, district, month, status). Reporter identity and evidence are never disclosed to other employers.
• Subjects may dispute an entry at any time. Upheld disputes lead to correction or removal.

We aim to store personal data in Rwanda. Where a service provider stores or processes data outside Rwanda, we do so only as permitted by the Data Protection Law — including any authorisation required from the National Cyber Security Authority (NCSA) — and with contractual and technical safeguards that provide an equivalent level of protection.

We may keep data longer where required by law or to establish, exercise or defend legal claims.

• Encryption in transit (TLS) and at rest for databases and file storage.
• Passwords and API keys are stored only as one-way hashes.
• Role-based access for staff, multi-factor authentication for administrative access, and audit logs of sensitive actions.
• Regular security testing and staff training on confidentiality and data protection.
• If a personal data breach occurs we will notify the National Cyber Security Authority (NCSA) within forty-eight (48) hours of becoming aware of it, and notify affected people without undue delay where the breach is likely to put their rights at risk.

Under the Data Protection Law you have the right to:

• be informed about how your data is used (this policy);
• access the personal data we hold about you and receive a copy;
• have inaccurate or incomplete data corrected;
• have your data erased, where there is no longer a lawful reason to keep it;
• object to processing, including processing based on legitimate interest;
• restrict processing while a complaint is being resolved;
• data portability, in a commonly used electronic format;
• not be subject to a decision based solely on automated processing;
• withdraw consent at any time; and
• be represented and to lodge a complaint with the National Cyber Security Authority (NCSA).

To exercise a right, email privacy@hometrust.rw from the email or phone number linked to your data. We may ask you to verify your identity and will respond within 30 days.

HomeTrust does not verify anyone under 18 years of age. If we learn that an applicant is under 18, we stop the verification and delete their data. Information about children may appear in incident reports (for example, a child who was harmed); we limit it to what is strictly necessary and never disclose it in watchlist results.

We use essential cookies and local storage to keep you signed in and secure your session, and privacy-friendly analytics to understand how our website is used. We do not use advertising cookies. You can clear cookies in your browser at any time; essential cookies are required for the dashboard to work.

We may update this policy as our services or the law change. Material changes will be notified by email or in the app at least 14 days before they take effect. The "last updated" date at the top shows the current version. See also our Terms of Use.

Data Protection Officer, HomeTrust Ltd, KG 7 Ave, Kacyiru, Kigali, Rwanda. Email privacy@hometrust.rw or call +250 788 000 000. If you are not satisfied with our response, you may contact the National Cyber Security Authority (NCSA).