1. Who is responsible, and what we collect
HackFlix Ltd (company code 106781104, 8 KG 7 Ave, Kacyiru, Kigali) is the controller of your personal data. Taji, the platform our billing runs on, processes it for us under a written agreement.
- Account and contact: name, email, phone, company, address, TIN. Used to open and run your account and send invoices and notices. Legal basis: contract.
- Orders and billing: services, domains, invoices, payments, wallet. Used to deliver what you buy and keep accounts. Legal basis: contract; legal duty (tax and accounting records).
- Domain registrant data: the contact details on each domain. Registries require them. Legal basis: contract; registry rules.
- Payments: MoMo number, payment references, last four card digits. Used to take and match payments. Legal basis: contract.
- Sign-in and security: sign-in times, device names, a hashed form of your IP address. Used to keep your account safe and stop fraud. Legal basis: legitimate interest.
- Support: tickets, emails, call notes. Used to answer you. Legal basis: contract; legitimate interest.
We never collect your MoMo PIN or your full card number. We do not sell your data or use it for advertising profiles.
2. Who we share it with, where it is kept, and for how long
- Taji platform: runs our billing, client area and support. Servers with Hetzner in Germany.
- InTouchPay and Paypack: MTN MoMo and Airtel Money payments. Rwanda.
- Flutterwave: card payments on its own secure page. Nigeria.
- ResellersPanel (LiquidNet US LLC): the hosting and domains we resell through it. United States.
- Openprovider, Porkbun and domain registries: registering and renewing domains. The Netherlands, the United States and each registry's country.
- Resend: sending our emails. United States.
- Backblaze: encrypted backups. European Union.
- Cloudflare: DNS and protecting our websites. Worldwide network.
- Tax authority, courts, police: only when the law requires it. Rwanda.
Transfers outside Rwanda. Some recipients keep data outside Rwanda. We transfer it only as Law 058/2021 allows, with contracts that protect it.