Legal

Privacy Policy

Bulzz handles data differently depending on whether you use the app as a customer or run a shop on it. Choose the policy that applies to you.

Last updated: 22nd November 2025

This Privacy Policy explains how Bulzz Ltd ("Bulzz", "we", "us") collects, uses, shares and protects personal data of individuals who use the Bulzz app and website to discover Shops, join queues, and book grooming services ("Customers" or "you").

We act as a data controller for your personal data when you use Bulzz. Each Shop you interact with through Bulzz is also a separate data controller for the personal data it receives about you.

1. Scope

This Privacy Policy applies to:

  • The Bulzz app, website and related services used by Customers; and
  • Personal data we process when you browse, register, book, pay, or interact with Shops via Bulzz.

A separate policy applies to shop owners and staff — see the "For Shop Owners" tab above.

2. Who we are and how to contact us

Data Controller:
Bulzz Ltd
Address: KG 588, Kigali, Rwanda
Email: operations@bulzz.com

Where required by law, we may also appoint a Personal Data Protection Officer (DPO) as foreseen under Rwanda's data protection law.

3. Personal data we collect

We may collect the following categories of personal data:

  • Identification and contact data — name, phone number, email, profile photo (optional), address (if provided).
  • Account and authentication data — password or other login credentials, security tokens, device identifiers.
  • Booking and queue data — selected Shop, service type, date and time, queue position, booking history, cancellation and no-show information.
  • Payment-related data — payment method, payment status, transaction references. (Card or mobile money details may be processed by third-party payment providers; Bulzz typically receives tokens and transaction details, not full card data.)
  • Location and device data — approximate location for "nearby" search, IP address, device type, OS version, app version.
  • Usage data — log files, pages/screens viewed, features used, links clicked, time and duration of use, crash reports, performance data.
  • Communications — messages you send to Shops, support queries, feedback or complaints.
  • Review and rating data — content of reviews, star ratings, photos (if you choose to upload).

We generally do not ask Customers to provide sensitive personal data (e.g. health, religion, political opinions). If you voluntarily include such information (for example in a booking note), you do so at your own discretion, and we will treat it with higher protection as required by law.

4. How we collect your data

We collect data:

  • Directly from you, when you create an account, make a booking, join a queue, pay, contact support, or post a review.
  • Automatically, through cookies, SDKs and similar technologies when you use the app or website.
  • From Shops, when Shops upload or sync their existing customer lists into Bulzz or update your profile/visit history.
  • From third parties, such as payment providers, analytics providers or identity verification tools (if used).

5. Purposes and legal bases

We process your personal data for the following purposes and legal bases (under Rwanda's data protection law and, where applicable, other laws such as GDPR):

Providing the Service

Creating and managing your account; enabling search, booking, queue management and reminders; managing payments and receipts.
Legal bases: performance of a contract; legitimate interests.

Customer support and communication

Responding to your enquiries and complaints; sending operational messages about bookings, queues, or account changes.
Legal bases: performance of a contract; legitimate interests.

Service improvement and analytics

Monitoring usage, fixing bugs, improving UX; analysing bookings, queues and performance to improve features.
Legal bases: legitimate interests (improving and securing our service).

Marketing and promotions

Sending you optional marketing messages about Bulzz or selected Shops; providing discounts, loyalty features or referral programmes.
Legal bases: consent (where required); legitimate interests. You can opt out at any time.

Security and fraud prevention

Detecting suspicious or abusive activities; protecting Bulzz, Shops and users from fraud and misuse.
Legal bases: legitimate interests; legal obligations.

Legal and regulatory compliance

Complying with obligations under Rwanda's data protection law and other applicable laws, including responding to lawful requests from authorities.
Legal bases: legal obligations.

6. How we share personal data

We may share your data with:

Shops you interact with

When you book or join a queue, we share relevant information with the Shop (e.g. name, contact details, booking details, notes, history) so they can provide the service. Each Shop is an independent controller of the customer data it receives and has its own legal obligations and privacy practices.

Service providers (processors)

We use third-party vendors acting on our behalf, such as cloud hosting and storage providers, SMS and email providers, payment processors, and analytics/crash-reporting services. These providers only process personal data according to our instructions and under a written contract, as required by data protection law.

Corporate transactions

If we are involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction, in line with applicable law.

Authorities and legal recipients

We may disclose personal data if required by law or in good faith to comply with legal obligations or lawful requests, protect the rights, property, or safety of Bulzz, our users or others, or detect and prevent fraud or security issues.

We do not sell your personal data.

7. International data transfers

Bulzz may host or process data using infrastructure located outside Rwanda (for example, global cloud service providers). Where we transfer personal data outside Rwanda, we will ensure that the transfer is authorised or allowed under Law No. 058/2021 (for example through standard contractual clauses approved by the supervisory authority or other recognised safeguards), and that appropriate technical and organisational measures protect your data.

8. Data retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy, including:

  • Account data — stored while your account is active and for a reasonable period thereafter for record-keeping, dispute resolution and legal compliance.
  • Booking and transaction data — retained in accordance with legal retention requirements (e.g. tax or accounting laws) and legitimate business needs.
  • Marketing data — stored until you opt out or withdraw consent.

When data is no longer needed, we will delete or irreversibly anonymise it, unless we are required by law to keep it longer.

9. Your rights

Under Rwanda's data protection law and other applicable laws, you may have the following rights regarding your personal data:

  • Right of access — to know whether we process your data and to obtain a copy.
  • Right to rectification — to request correction of inaccurate or incomplete data.
  • Right to erasure — to request deletion of your data in certain circumstances.
  • Right to restriction — to request restriction of processing in certain circumstances.
  • Right to object — to object to processing based on legitimate interests or for direct marketing.
  • Right to data portability — to receive your data in a structured, commonly used and machine-readable format where technically feasible.
  • Right not to be subject solely to automated decisions that produce legal or similarly significant effects.
  • Right to designate an heir for your personal data, as provided under Rwandan law.

To exercise your rights, contact us at operations@bulzz.com. We may need to verify your identity. We will respond within the timeframe required by applicable law.

You also have the right to lodge a complaint with the National Cyber Security Authority – Data Protection & Privacy Office (NCSA/DPP) if you believe your rights have been violated.

10. Children's data

The Service is not intended for children under 13 years (or younger than the minimum age in your country). We do not knowingly collect personal data from children without appropriate consent, as required by law. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will take steps to delete it.

11. Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These may include encryption, access controls, logging and regular security reviews. No system is completely secure; we cannot guarantee absolute security of your data.

12. Changes to this Policy

We may update this Privacy Policy from time to time. We will indicate the "Last updated" date at the top and, where required, notify you via the app or by email. If you continue to use the Service after changes take effect, you are deemed to have accepted the revised Policy.

13. Contact

For privacy questions, requests, or complaints:
Bulzz Ltd
Email: operations@bulzz.com
Address: KG 588, Kigali, Rwanda

Last updated: 22nd November 2025

This Policy explains how Bulzz Ltd ("Bulzz", "we", "us") processes personal data related to shop owners, managers and staff who use the Bulzz business dashboard or app, and customers whose personal data is processed via Bulzz on behalf of Shops. It should be read together with the Business Subscription Agreement.

1. Roles under data protection law

For personal data about Shop owners, staff and users of the Bulzz dashboard, Bulzz is a data controller.

For personal data about Shop Customers processed via the Bulzz platform, the Shop is the data controller, and Bulzz acts as its data processor.

This distinction follows Rwanda's Law No. 058/2021 on personal data and privacy and relevant guidance by the National Cyber Security Authority.

Part A – Shop owner & staff data (Bulzz as controller)

2. Data we collect about Shop users

We may collect:

  • Business identity data — Shop name, registration details, address, sector.
  • Contact data — name, role, phone number, email address.
  • Account data — username, password, roles/permissions, access logs.
  • Billing data — subscription plan, invoices, payment status, transaction details.
  • Usage data — how Shop staff use the dashboard (features used, log-ins, etc.).
  • Communications — support tickets, feedback, onboarding information.

3. Purposes and legal bases

We process this data to: set up and manage your business account; provide and support the Bulzz Service; communicate with you about updates, incidents, and marketing (where permitted); invoice and process payments; ensure security and prevent abuse; and comply with legal obligations (e.g. tax, data protection, registration with the supervisory authority).

Legal bases include performance of contract, legitimate interests, and legal obligations.

4. Sharing and retention

We share Shop data with payment providers and banks; cloud and communication providers; and professional advisors (lawyers, accountants) where needed.

Retention periods follow similar logic to the Customer Privacy Policy (contract duration + legal retention requirements). After that, data is deleted or anonymised.

Part B – Customer data processed for Shops (Bulzz as processor)

This section summarises how Bulzz handles Customer personal data on behalf of Shops. Full legal obligations are in the Business Subscription Agreement (Section 10).

5. Categories of data and processing activities

Bulzz processes: Customer profile data (name, phone, email, etc.); booking and queue data; payment references and receipts; notes and tags created by Shops.

Processing activities include storage, retrieval, transmission, analytics (for Shop dashboards), and, where configured, messaging/reminders.

6. Instructions and purpose limitation

Bulzz will only process Customer personal data for the purposes described in the Business Subscription Agreement and this Policy, and according to the documented instructions of the Shop (including those given through the Bulzz dashboard settings).

We will not use Customer data for our own independent marketing to Customers unless we act as a separate controller with an appropriate legal basis and transparent information to the data subject.

7. Security and sub-processors

Bulzz implements appropriate technical and organisational measures for security (access controls, encryption where appropriate, logging and monitoring), and uses sub-processors under written contracts with data protection obligations aligned to Rwanda's law. A list of key sub-processors will be provided on request.

8. Data subject rights support

Bulzz assists Shops in responding to access, rectification, erasure, restriction, objection and portability requests, and handling complaints related to Customer data processed via Bulzz.

Where Customers contact Bulzz directly, we will either handle the request (if we are controller) or forward the request to the relevant Shop (if the Shop is controller).

9. Breach notification and cooperation

In the event of a personal data breach affecting Customer data, Bulzz will:

  • Notify the Shop without undue delay;
  • Provide available information about the nature of the breach, affected data, and steps taken or proposed;
  • Cooperate with the Shop to meet any legal obligations to notify the supervisory authority and data subjects.

10. International transfers

Bulzz may rely on cloud infrastructure or service providers located outside Rwanda. We will ensure that transfers comply with Rwanda's Law No. 058/2021, including the use of approved standard contractual clauses or other valid mechanisms, and any guidance issued by the supervisory authority.

11. Your rights and contact

Shop owners and staff have the same data subject rights listed in the Customer Privacy Policy (access, rectification, erasure, restriction, objection, portability, etc.).

To exercise your rights or for any questions:
Bulzz Ltd
Email: operations@bulzz.com
Address: KG 588, Kigali, Rwanda

You can also lodge a complaint with the National Cyber Security Authority – Data Protection & Privacy Office if you are unsatisfied with our response.

Questions about your data? operations@bulzz.com  —  We aim to respond within 30 days.