Privacy Policy

Invictus (“Invictus”, “we”, “us”, or “our”) is a multi-tenant loan management platform and a product of ScriptyLabs Inc (scriptylabs.com), operated in the Republic of Rwanda. We are committed to protecting your personal data and respecting your privacy.

This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you visit this website or request a demo, in accordance with Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy and its implementing instruments.

For the purposes of this law, Invictus acts as a data controller in respect of the personal data described below.

We may collect the following categories of personal data:

• Contact and identification data — your name, company name, email address, and phone number when you request a demo or contact us.
• Institution data — your business type and number of staff, used to tailor a demonstration to your institution.
• Message content — any information you choose to include in a message to us.
• Technical data — limited information such as your device, browser, and pages visited, collected to operate and secure the website.

We do not knowingly collect, through this website, the personal data of the customers of financial institutions. Such data is processed only within the Invictus platform under a separate agreement with each institution.

We process personal data only where we have a lawful basis to do so. In most cases we rely on your consent, which under Article 6 of Law N° 058/2021 must be freely given, specific, informed, and unambiguous. You may withdraw your consent at any time.

We may also process data where necessary for our legitimate interest in responding to your enquiry, or to comply with a legal obligation. All processing follows the principles set out in Article 37 of the law — lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and security.

• To respond to your demo requests and enquiries;
• To arrange and conduct a private product demonstration;
• To communicate with you about our services;
• To operate, maintain, and secure this website; and
• To comply with applicable laws and regulatory obligations.

We do not sell your personal data, and we do not use it for automated decision-making that produces legal effects concerning you.

Under Law N° 058/2021, you have the following rights in respect of your personal data:

• Right of access — to obtain the personal data we hold about you (Article 18);
• Right to object — to object to the processing of your data (Article 19);
• Right to restriction — to restrict processing in certain circumstances (Article 22);
• Right to erasure — to request deletion of your data (Article 23);
• Right to rectification — to correct inaccurate or incomplete data (Article 24).

When we collect your data, we provide the information required under Article 42 — including our identity, the purposes of processing, the recipients, and your right to withdraw consent. To exercise any right, contact us at demo@invictus.rw.

We may share personal data with:

• Trusted service providers who process data on our behalf, under appropriate confidentiality and data-processing terms;
• Competent public authorities, where required by law; and
• National systems we integrate with, only where you or your institution have authorised such processing.

Any data processor acting on our behalf is bound to process personal data only on our documented instructions.

Where personal data is shared or transferred outside Rwanda, we do so in accordance with Article 48 of Law N° 058/2021 — only where adequate protection is ensured, with appropriate safeguards, and, where required, with the authorisation of the supervisory authority.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, as required by Article 47 of the law. These include role-based access controls, encryption, audit trails, and tenant isolation across the platform.

In the event of a personal data breach, we act in accordance with Article 43 and Article 44 of Law N° 058/2021 — notifying the supervisory authority and, where the breach is likely to result in a high risk to your rights and freedoms, informing affected data subjects without undue delay.

We retain personal data only for as long as necessary for the purposes for which it was collected, in line with Article 50 (storage of personal data) and Article 52 (retention of personal data) of the law. When data is no longer required, we securely delete or anonymise it.

This website uses only essential cookies necessary for its operation and security. We do not use cookies for advertising. You can control cookies through your browser settings.

The supervisory authority for personal data protection in Rwanda is the National Cyber Security Authority (NCSA), acting through the Data Protection and Privacy Office, whose duties and powers are set out in Article 27 and Article 28 of Law N° 058/2021.

If you believe your data protection rights have been infringed, you may lodge a complaint with the supervisory authority. We encourage you to contact us first so we can address your concern.

We may update this Privacy Policy from time to time. The “last updated” date above reflects the most recent revision. Material changes will be communicated through this website.

To exercise your rights or ask about this Privacy Policy, contact us:

• Email: demo@invictus.rw
• Phone: +250 780 226 666
• Address: Kigali, Rwanda