Legal
Data Protection.
Being recognised and remembered is part of the experience at The Rec. That depends on trust. This policy explains what personal data we collect, why, how we protect it and the rights you have over it.
Who we are
The Rec, Gacuriro, Kigali, Rwanda, is the data controller for the personal data described in this policy. We process personal data in line with Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, and we are registered with the National Cyber Security Authority (NCSA) as required.
What we collect
| Category | Examples |
|---|---|
| Identity & contact | Name, email, phone number and country code, preferred contact method, date of birth |
| Membership | Membership type, add-ons, family and child profiles, start and renewal dates, freeze requests |
| Bookings & visits | Classes, sessions, reservations, event tickets, check-ins, attendance and no-shows, activity interests |
| Payments | Amounts, payment method and reference, receipts. Card and MoMo details are handled by our payment providers, not stored by us. |
| Health & wellbeing | Only what you choose to share for your safety, such as injuries or conditions relevant to training or treatments, and wellness assessment results |
| Communications | Enquiries, messages via our website, WhatsApp, email or phone, and feedback |
| Website & app | Pages visited, device and browser type, and campaign tags (for example UTM parameters) |
| Security | CCTV images in public areas of The Rec |
Health information is sensitive personal data. We only process it with your explicit consent, or where it’s needed to protect your vital interests, and access to it is strictly limited.
How and why we use it
| Purpose | Legal basis |
|---|---|
| Managing your membership, account, bookings and payments | Performance of our contract with you |
| Replying to enquiries and tour requests | Steps you asked us to take before a contract, or consent |
| Recognising you on arrival and personalising your experience | Our legitimate interest in delivering genuine hospitality |
| Safety, security, CCTV and incident records | Legitimate interest and legal obligation |
| Health information for safe training and treatments | Your explicit consent |
| Newsletters, event invitations and offers | Your consent, which you can withdraw at any time |
| Accounting, tax and legal compliance | Legal obligation |
| Improving our services and website | Legitimate interest, using aggregated data where possible |
We do not sell your personal data, and we do not make decisions about you based solely on automated processing.
International transfers
Some of our service providers may store data outside Rwanda. Where this happens, we only transfer personal data as permitted under Law N° 058/2021, with appropriate safeguards and, where required, authorisation from the supervisory authority.
Children’s data
Children do not create their own accounts. Children aged 0–12 and young adults aged 13–17 are linked to a parent or legal guardian’s family account, and the parent or guardian provides consent on their behalf. We collect only what is needed to register, book and keep them safe: name, age, programme, attendance, emergency contacts and any relevant health or learning-support information. We never use children’s data for marketing, and we never publish identifiable photos of children without a parent’s consent.
How long we keep it
- Member records: for the duration of your membership, plus up to five years for accounting, legal and dispute purposes.
- Enquiries from non-members: up to 24 months after our last contact, unless you become a member.
- Payment and tax records: as long as the law requires.
- CCTV footage: up to 30 days, unless needed for an investigation.
- Marketing preferences: until you unsubscribe or withdraw consent.
How we protect it
We use appropriate technical and organisational measures, including encrypted connections, access controls by staff role (for example Gym, Memberships & Events, and Superadmin), secure payment processing, staff confidentiality and training, and regular reviews. If a personal data breach is likely to put your rights at risk, we will notify the supervisory authority and, where required, you, within the timeframes set by law.
Your rights
Under Rwandan law, you have the right to:
- Be informed about how your data is used
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Erase your data, where there is no longer a valid reason to keep it
- Object to processing, including direct marketing
- Restrict processing in certain circumstances
- Data portability: receive your data in a commonly used format
- Withdraw consent at any time, without affecting earlier processing
- Not be subject to decisions based solely on automated processing
To exercise any of these rights, email privacy@thereckigali.com. We may need to verify your identity, and we will respond within the time the law allows. You can also lodge a complaint with the National Cyber Security Authority (NCSA).
Marketing & communications
We will only send newsletters, invitations and offers if you have opted in. You choose your preferred contact method (WhatsApp, phone or email) and can unsubscribe at any time using the link in our emails, by replying STOP, or through your member account. Service messages about your bookings, payments and membership will still be sent.
Changes to this policy
We may update this policy to reflect changes in our services or the law. We will notify members of significant changes by email or through the member app. The date at the top shows when it was last updated.
Contact our Data Protection Officer at privacy@thereckigali.com