Privacy Policy
Last updated: August 20, 2026
KaziData is a labour market intelligence platform operated by Curricula Ltd (“we”, “us”), a company registered in Rwanda.
This policy explains what personal data we collect, why, and what rights you have. It covers the KaziData website and platform.
We process personal data in accordance with Law No. 058/2021 of 13/10/2021 relating to the protection of personal data and privacy of the Republic of Rwanda.
1.Summary
KaziData analyses organisations, occupations and skills — not individuals.
We collect job postings published openly by employers, and education data supplied by institutions. Our outputs are aggregate: how many vacancies exist in a sector, which skills employers request, how curriculum compares to demand.
The only personal data we hold in volume is the account information of the staff at our customer organisations who log in to use the platform.
2.Who is responsible for your data
For your account and for data you give us directly, Curricula Ltd is the data controller.
For institutional data processed on behalf of a customer — curriculum content, aggregate graduate outcomes — that institution is the data controller and we act as a data processor under a written agreement.
3.What we collect
3.1 Platform users
If you have an account:
- Name, work email, job title
- The organisation you belong to and your role within the platform
- Login times, IP address, pages and reports accessed
- Any content you enter, including notes and saved analyses
3.2 Website visitors
- Pages visited, referring page, approximate location from IP address, browser and device type
- Anything you submit through a contact or demo form
3.3 Job postings
Collected from publicly accessible sources. A posting typically contains job title, employer name, location, required skills, experience level, salary where published, and posting and closing dates.
This is organisational data. Section 4 explains how we handle the occasional posting that contains personal information.
3.4 Institutional data
Supplied by customer institutions under agreement: programme and curriculum content, and aggregate graduate outcome figures — for example, the employment rate for a programme cohort.
We do not receive or hold individual student records.
4.How we collect job postings
Because automated collection is central to KaziData and unusual enough to warrant explanation, we set out our practice in full.
What we collect
Only job postings published openly and accessible without authentication, payment, or circumvention of any access control.
How we collect
- We respect
robots.txton every source - We identify our collector honestly in the user agent, with a contact address
- We rate-limit requests and do not parallelise against a single source
- We do not collect from sources whose terms prohibit automated access. Where a source declines automated collection, we either seek written permission or exclude that source entirely
What we do not collect
- Applicant data, CVs, or any information about people applying for advertised roles
- Content behind a login, paywall, or access control
- Data from social or professional networks whose terms prohibit it
Personal data within postings
A posting occasionally names a contact person or includes a direct personal email address. We treat that as personal data. It is removed during normalisation and does not appear in any platform view, report or export.
If you believe a posting containing your personal data has been collected and you want it removed, email info@curricula.tech. We will remove it.
5.Why we process data, and on what basis
| Purpose | Legal basis |
|---|---|
| Providing the platform to your organisation | Performance of a contract |
| Managing your account and access | Performance of a contract |
| Collecting publicly published job postings | Legitimate interest in labour market research, balanced against the limited privacy impact of organisational data |
| Producing aggregate analytics | Legitimate interest; contract with our customers |
| Security, fraud prevention, service integrity | Legitimate interest; legal obligation |
| Responding to enquiries | Consent, or pre-contractual steps at your request |
| Marketing emails | Consent, withdrawable at any time |
| Publishing aggregate research | Legitimate interest — no individual is identifiable in published outputs |
6.Who we share it with
We do not sell personal data.
We share it only with:
- Your organisation — administrators can see the accounts and activity within their own tenant
- Service providers who host and operate our infrastructure, under written agreements restricting them to our instructions. These currently cover cloud hosting, database, email delivery and error monitoring
- AI model providers, where a feature requires it — for example, classifying a job title against an occupation code. These calls run under terms prohibiting training on our data
- Authorities, where legally required
We may publish aggregate, de-identified statistics — for example, the share of Rwandan job postings requesting a given skill. No individual is identifiable in such outputs.
7.Tenant isolation
Each customer organisation's data is isolated. Queries are scoped by organisation at the database layer, not only in the interface.
One institution cannot see another institution's curriculum data, graduate outcomes, or user accounts. Aggregate market data drawn from public job postings is shared across all customers; customer-supplied data never is.
8.Where data is stored
Our infrastructure is hosted with providers whose facilities may be located outside Rwanda. Where personal data is transferred outside Rwanda, we do so under contractual safeguards requiring an equivalent standard of protection, consistent with Law No. 058/2021.
We can supply the current list of processors and hosting locations on request.
9.How long we keep it
| Data | Retention |
|---|---|
| Account and login records | Duration of the account, plus 12 months |
| Website enquiry records | 24 months from last contact |
| Customer-supplied institutional data | Term of the agreement, then deleted or returned within 90 days |
| Job postings and derived analytics | Retained indefinitely as a research archive. Any personal data within is removed at normalisation |
| Billing and tax records | As required by Rwandan law |
10.Your rights
Under Rwandan data protection law you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Erase your data where no lawful basis exists for us to keep it
- Object to processing based on legitimate interest
- Restrict processing while a dispute is resolved
- Portability — receive your data in a structured, machine-readable format
- Withdraw consent where consent is the basis
- Complain to the National Cyber Security Authority, Rwanda's supervisory authority for data protection
Email info@curricula.tech. We respond within 30 days.
11.Cookies
We use:
- Essential cookies — session management and security. These cannot be disabled without preventing login.
- Analytics cookies — aggregate usage measurement to improve the product.
We do not use advertising or cross-site tracking cookies.
12.Security
We protect data through encryption in transit and at rest, role-based access control, tenant isolation enforced at the query layer, audit logging of administrative actions, and access restricted to staff who need it.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the supervisory authority as required by law.
13.Children
KaziData is a professional tool for institutional and government users. It is not directed at anyone under 18, and we do not knowingly collect their data.
14.Changes
We may update this policy. Material changes will be announced here and, where we hold your contact details and the change affects you, by email.
15.Contact
info@curricula.tech
Curricula Ltd (trading as KaziData)
Kigali, Rwanda
You may also complain to the National Cyber Security Authority (NCSA), Rwanda.