Privacy Notice
This notice explains how Gewape Cloud Rwanda Limited handles personal data in GewapeSign.
Our role
For the documents an organization sends, and the people it asks to sign them, that organization decides what is processed and why; we process that data on its behalf. For GewapeSign user accounts, we are responsible for the data.
What we process
- Account details: name, work email, organization, role, password (stored only as a one-way hash) and sign-in records.
- Documents you upload, and the fields, signatures and initials added to them.
- Signer details needed for the audit record: name, email, the time of each step, network address and browser.
- Messages we send on your behalf: signing requests, reminders and completed copies.
Where it is stored
GewapeSign runs in our own data center facilities in Rwanda. Documents and records are stored in Kigali, with backups kept in Rwanda.
No tracking
GewapeSign has no advertising, analytics or tracking scripts, and the application does not contact outside services from your browser. We use only the cookies needed to keep you signed in and to protect forms.
Who else sees it
Only the people the sender chooses, and Gewape staff who need it to run the service. Staff do not open an organization’s documents without that organization’s permission, except where the law requires it.
How long we keep it
Documents and audit records are kept for as long as the organization keeps them in its account. When an account is closed, its data is deleted unless the law requires us to keep it longer.
Our registrations and roles
Gewape Cloud Rwanda Limited is registered with the National Cyber Security Authority (NCSA), Data Protection and Privacy Office, as a data controller (registration No. 001/0130/1225) and a data processor (registration No. 002/0018/1225), issued 16 December 2025 and valid until 16 December 2027. For documents an organization sends through GewapeSign, that organization is the data controller and we process the data on its behalf as its data processor. For account, billing and website data, we are the data controller.
Your rights
Under Rwanda’s Law No 058/2021 on the protection of personal data and privacy, you can ask to access, correct or delete your personal data, or object to its use. If you signed a document sent by an organization, contact that organization first; we will help it respond. You can reach us at support@gewapesign.com and you may complain to the National Cyber Security Authority.
Security
Connections are encrypted, organizations’ data is kept apart from each other’s, and every completed document is sealed so changes can be detected.