Privacy Policy

Higa Lux Rwanda (“Higa Lux”, “we”) operates a quality assurance, directory and booking platform for accredited Rwandan hospitality businesses. We are the data controller for the personal data described below. Our data protection contact is privacy@higalux.rw.

• Account details — your name, email address, phone number and password (stored only as a bcrypt hash, never in readable form).
• Reservation details — the property and package booked, dates, number of guests, the contact details you give for the stay, and any special requests you write.
• Payment records — the amount, currency, the mobile money number or card gateway used, and the reference our payment provider returns. Full card numbers and mobile money PINs never reach our servers; they are handled by the payment provider.
• Reviews and ratings — what you write, the scores you give and the display name you choose.
• Anti-abuse data — when you submit a public rating or newsletter sign-up we store a salted SHA-256 hash of your IP address. We do not retain the address itself, and the hash cannot be reversed to recover it.

We set one cookie, lux_token. It holds your signed session so you stay logged in, is marked HttpOnly and SameSite=Lax, is transmitted only over HTTPS in production, and expires after seven days. We do not use advertising or cross-site tracking cookies.

• To create and secure your account, and to keep you signed in.
• To take reservations, collect payment and issue booking vouchers.
• To show a partner the bookings, guest contact details and reviews for their own listing.
• To run quality assurance audits and publish certification badges.
• To send the newsletter, if and only if you asked for it.
• To detect and block spam, fraud and abuse of the platform.

We share the minimum necessary with the hospitality partner you booked (your name and contact details, so they can host you), with our payment providers (MTN MoMo and Flutterwave) to process a transaction, and with our hosting and database providers who store the data on our behalf. We do not sell personal data, and we do not share it for advertising.

Account and reservation records are retained while your account is open and for as long afterwards as Rwandan tax and accounting rules require. Reviews remain published for as long as the listing exists. Anti-abuse IP hashes are retained for a rolling period and then deleted. Newsletter records are kept until you unsubscribe.

You may ask us to give you a copy of your data, correct it, delete it, or stop using it for a particular purpose, and you may withdraw consent to marketing at any time. Write to privacy@higalux.rw and we will respond within the period set by Rwandan law. You also have the right to lodge a complaint with the National Cyber Security Authority, Rwanda's supervisory authority for data protection.

Traffic is served over HTTPS, passwords are hashed with bcrypt, sessions are signed with a secret unique to each environment, and administrative functions are restricted by role. No system is perfectly secure; if a breach affects your data we will notify you and the supervisory authority as the law requires.