Litt+ Privacy Policy
Last update: 16 October 2025
Litt+ Rwanda Ltd (“LITTPLUS”), a company duly incorporated under Rwandan law and registered with the Rwanda Development Board (RDB) under company code 122979783, developed and runs the Litt+ application (“Application”) and the www.littplus.com website (“Website”).
This privacy policy (“Privacy Policy”) applies to each natural personal using the Application (“User”) or visiting the Website (“Visitor”) regarding the process processing of their personal data in accordance with Law No. 058/2021 of 13/10/2021 relating to the Protection of Personal Data and Privacy and applicable (“Regulation”).
This Privacy Policy supplements and is incorporated into the general conditions (“General Conditions”) that apply to the services (“Services”) offered by Litt+ and available on this link:
Use of the Application and navigating the Website require your acceptance of the General Conditions and this Privacy Policy.
Capitalized terms not defined in this Privacy Policy shall have the meanings assigned to them in General Conditions or Regulation.
Article 1 – Definitions
Article 2 – Modification of this Privacy Policy
This Privacy Policy may be amended to reflect changes to the Services or applicable laws and regulations.
LITTPLUS will notify you of any changes to the Privacy Policy at least thirty (30) days before they take effect, using the email address you provided on the Site.
We encourage you to review this Privacy Policy regularly.
The most recent update to this Privacy Policy was made on: (to be completed).
Article 3 – Identity and contact of the Data Controller
The Data Controller is the person or entity that, alone or jointly with others, determines the purposes and means of the Processing.
For all Processing activities described in this Privacy Policy, the Data Controller is LITTPLUS.
Article 4 – Categories of processed Personal Data
While providing the Services, LITTPLUS may collect and process the following Personal Data:
- Identity information: First name, surname, username, profile picture.
- Contact information: Phone number, email address, postal address.
- Financial information: Bank account number, credit/debit card details, mobile money account number.
- Geolocation data: GPS data.
- Connection and usage data: IP address, connection logs (timestamps, session data), navigation data (cookies, pages visited, clicks).
- User-generated content: Texts (Car description), comments, uploaded files (Photos), and other content provided by users.
Article 5 – Legal ground and purposes of processing Personal Data
LITTPLUS is committed to processing your Personal Data in accordance with applicable laws and regulations. No Personal Data is collected without your knowledge, nor is it used for purposes of which you have not been informed.
The processing of your Personal Data by LITTPLUS is based on the following legal grounds:
| Legal ground | Categories of Personal Data | Purposes |
|---|---|---|
| Consent | • Profile picture • User-generated content • Geolocation • Cookies (Marketing/advertising cookies) |
• Enhancing social features like comments for reviews • Enhancing the user experience by using the User's location to connect them with the nearest available Cars |
| Contractual necessity | • First name, surname, username, phone number, email address, physical address • Financial information: Bank account number, credit/debit card details, mobile money account number |
• Creating and managing your user account, communicating with you regarding your account and the Services, verifying your identity to prevent fraud or unauthorized access, personalizing your experience • Processing your financial information as necessary for the performance of the contract with you |
| Legitimate interest | • Connection and usage data: IP address, connection logs (timestamps, session data), navigation data (Pages visited, clicks) • Cookies (Strictly necessary such as authentification, security); (Functional cookies such as preferences, UX); (Analytics cookies such as Google Analytics, Matomo) |
• Processes connection and usage data to ensure the proper functioning, security, and optimization of the Services. This includes enabling access to the platform, maintaining system security, detecting and preventing fraud or unauthorized activity, analyzing technical performance, and improving the user experience |
Article 6 – Retention Periods for Your Personal Data
The retention period for your Personal Data is determined based on the purposes pursued by LITTPLUS.
Your Personal Data is retained for the following periods:
| Purpose | Category of Personal Data | Retention period |
|---|---|---|
| Performance of Services | • Identification and user verification data • Financial data • Communication data |
Five (5) years from the termination of the General Conditions |
| Claims management | • Communication data • Identification and user verification data • Financial data |
Five (5) years from the termination of the General Conditions |
| Payment history management | • Financial data • Identification and user verification data |
Five (5) years from the termination of the General Conditions |
| Communication management | • Communication data | Two (2) years from the termination of the General Conditions |
| Website and Application browsing | • Identification and user verification data | Six (6) months from the termination of the General Conditions |
| Website and Application performance analysis and improvement | • Navigation data | Six (6) months from the termination of the General Conditions |
Article 7 – Your Rights Regarding Your Personal Data
In accordance with applicable regulations, you have the following rights regarding your Personal Data:
| Your right | Description |
|---|---|
| Right of Access | You have the right to know whether your Personal Data is being processed and to obtain access to such data in a comprehensible format. |
| Right to rectification and erasure | You have the right to request the rectification of inaccurate or incomplete information about you. You also have the right to request the erasure of your Personal Data in the following cases: • The data is no longer necessary for the purposes for which it was collected • You withdraw your consent, where processing is based on consent • The erasure is required by a legal obligation |
| Right to restriction of processing | You have the right to request the restriction of the processing of your Personal Data. |
| Right to object to processing | You have the right to object at any time. However, exercising this right may prevent LITTPLUS from continuing to provide you with the Services. |
| Right to data portability | You have the right to obtain your Personal Data in a structured, commonly used, and machine-readable format. You may also request that your data be transmitted directly to another Data Controller, where technically feasible. |
You may exercise these rights by contacting us:
- By email at the following address: contact@littplus.com
Article 9 – Recipients of your Personal Data
Your Personal Data will not be transmitted for commercial or advertising purposes without your prior explicit consent.
However, this Personal Data may be processed by the following parties:
- Internal teams of LITTPLUS;
- Authorized third parties, as defined below.
9.1. Internal recipients of your Personal Data
The recipients of your Data within LITTPLUS include employees responsible for the IT department, administrative services, or the handling of user claims and requests.
LITTPLUS implements strict access control measures to ensure that only those employees whose duties require access to your Personal Data are authorized to process it.
9.2. External recipients of your Personal Data
Your Personal Data may also be disclosed to certain entities expressly authorized by law, including the following (“Authorized Third Parties”):
- Judicial authorities, in the context of legal proceedings, investigations, or judicial inquiries;
- Administrative authorities, including duly authorized tax or financial authorities; and
- Where applicable, LITTPLUS processors, namely:
- Google Inc. (Google Analytics (Website analytics), Firebase Analytics (Application analytics)).
- Amazon AWS (Stocking of images).
- Fly.io (Servers).
Article 10 – Security of your Personal Data
Your personal information is treated with the highest level of security. Here’s what we do to keep it safe:
- Encryption: Your data is encrypted both when stored (databases) and when transmitted online (TLS/HTTPS).
- Password Protection: User passwords are securely hashed and salted using industry-standard methods (e.g., bcrypt, Argon2).
- Access Control: Only authorized LITTPLUS employees and approved service providers can access your personal data.
- Breach Notification: If your data is ever at risk, we will notify you within 72 hours, in line with legal requirements.
Article 11 – Use of Cookies
Cookies are small data files stored on your device to remember your activity and preferences on the LITTPLUS website or app. They help improve and personalize your experience.
Cookies may be placed by LITTPLUS or by third-party partners. Third-party cookies require your prior consent, except for those strictly necessary for the service. LITTPLUS and its partners are co-responsible for these cookies, but any further processing by partners is their own responsibility.
The complete list of cookies set by LITTPLUS and its third-party partners, along with their purposes, is provided below.
Article 12 – Transfer of Personal Data Outside Rwanda
LITTPLUS strives to keep your Personal Data within Rwanda. Your Personal Data is stored on servers located in Rwanda whenever possible.
However, if your Personal Data needs to be shared or transferred outside Rwanda, LITTPLUS will do so only in compliance with Article 48 of the Rwandan Data Protection Law, which permits transfers under the following conditions:
- With your explicit consent;
- With prior authorization from the supervisory authority, upon demonstrating appropriate safeguards for the protection of your Personal Data; or
- When the transfer is necessary:
- For the performance of a contract between you and LITTPLUS, or to implement pre-contractual measures at your request;
- For the performance of a contract concluded in your interest between LITTPLUS and a third party;
- For the establishment, exercise, or defense of a legal claim;
- To protect your vital interests or those of another person when you are unable to give consent;
- For compelling legitimate interests pursued by LITTPLUS, provided these interests are not overridden by your rights and freedoms, the transfer is limited, and appropriate safeguards are in place;
In all cases, LITTPLUS undertakes to inform you of any processing involving the transfer of your Personal Data outside Rwanda.
Article 13 – Complaints to the Rwanda Data Protection Office
You have the right to lodge a complaint with the Rwanda Data Protection Office (DPO-Rwanda) if you believe that your Personal Data has been processed in violation of applicable data protection laws. Complaints can be submitted through the following channels:
- Via the DPO-Rwanda’s online complaint portal: dpo.gov.rw