Leasing an apartment means handing over real personal information: your name, your phone number, your identification, where you live. This page sets out exactly what we collect, why, who processes it on our behalf, how long it stays, and what you can ask us to do with it. It describes what this website and our systems actually do, not a generic template.
Who we are
T & M Luxury Apartments operates the apartments at KK 776 St, Rebero, Kigali, Rwanda, and this website. We decide what personal information is collected here and why, which makes us the data controller for it.
Anything in this policy can be raised with us at tmluxuryapartmentsrw@gmail.com or +250 796 177 227.
What we collect
When you send a booking request: your name, phone number, email address, the apartment and lease term you chose, your move-in date and duration, and anything you write in the special requests field.
When you create an account: your name and email address, a hashed password or a Google sign-in, and, if you switch it on, two-factor authentication details. We never see your password in readable form.
When you contact us or leave feedback: your name, your contact details, the content of your message or rating, and the date it was sent.
When you become a tenant: the information needed for the lease and its administration, including identification, payment references and the signed move-in inspection checklist.
Automatically, as you use the site: your IP address and basic request data, used for rate limiting and security. Where product analytics is switched on, we also collect pseudonymous usage events about which pages are viewed and which actions are taken.
We do not ask for, and you should never send us, card numbers or full bank details through this website. Rent is paid by transfer to the account named on your signed agreement.
Why we use it, and on what basis
To answer your request and hold an apartment for you (steps taken at your request before entering a contract).
To prepare, sign and administer a lease, collect rent, handle maintenance requests, and return deposits (performance of that contract).
To keep accounts and tenancy records for as long as Rwandan law requires (a legal obligation).
To secure the site and our systems: rate limiting, fraud prevention, and an audit log of sensitive administrative and authentication actions (our legitimate interest in running the service safely).
To understand how the site is used and improve it (our legitimate interest), using pseudonymous analytics rather than identifying individuals.
To send you a marketing message, where we ever do, and only with your consent, which you can withdraw at any time.
Who processes it for us
We do not sell your personal information, and we do not share it for anyone else's marketing. We do use service providers who process it on our instructions:
- Neon, the PostgreSQL database holding bookings, accounts and tenancy records
- Vercel, for hosting and delivery of this website
- Resend, for sending transactional email such as booking confirmations and password resets
- Upstash, for the short-lived request counters used in rate limiting
- Cloudinary and Cloudflare R2, for storing images and documents uploaded to the site
- Inngest, for running background jobs such as reminder emails
- PostHog, for product analytics, where it is enabled
- Google, only if you choose to sign in with a Google account
Some of these providers operate outside Rwanda, so your information may be processed abroad. We use providers that offer appropriate safeguards and contractual protections for that transfer.
We also disclose information where the law requires it, or where it is necessary to establish, exercise or defend a legal claim.
How long we keep it
Booking requests that do not become a tenancy: up to twelve months, so we can pick up a conversation you return to.
Tenancy and payment records: for the tenancy and then for as long as Rwandan accounting and limitation rules require.
Account details: while your account is open. Ask us to close it and we delete or anonymise what we are not required to keep.
Support messages and feedback: up to twenty-four months.
Security and audit logs: up to twelve months.
Feedback used to improve our service is aggregated and anonymised, so it stops being about you.
Your rights
Under Rwanda's law on the protection of personal data and privacy, you can:
- Ask what we hold about you, and get a copy
- Have inaccurate information corrected
- Ask us to delete information we no longer have a reason to keep
- Object to, or ask us to restrict, a particular use
- Withdraw consent where the use rests on consent
- Ask for your information in a portable form
- Complain to Rwanda's supervisory authority for data protection
Write to tmluxuryapartmentsrw@gmail.com to exercise any of these. We respond within one month, and we may ask you to confirm your identity first so we do not disclose your information to someone else.
Keeping it safe
Traffic to this site is encrypted in transit. Passwords are stored only as salted hashes, never in readable form, and accounts can be protected with two-factor authentication. Administrative access is restricted by role, and sensitive administrative and authentication actions are written to an audit log.
No system is perfectly secure. If a breach ever affects your personal information and is likely to put your rights at risk, we will notify you and the supervisory authority as the law requires.
Children
This site is intended for adults. We do not knowingly collect personal information from children, and a lease is only entered into with an adult. If you believe a child has given us information, contact us and we will delete it.
Changes to this policy
We update this page when what we do changes. The date at the top of the contents list tells you when it was last revised. It currently reads 22 August 2026.
Where a change materially affects how we use information you have already given us, we will tell you directly rather than rely on you noticing this page.