Privacy Policy
YOUR INFORMATION, RESPECTED
Jaq & Saiba respects the intimacy of personal information. This notice explains what we collect, why we use it, who may receive it, how long we keep it, and the choices and rights available to you.
Data controller: Jaq & Saiba LTD, trading as Kalamelu, of Gorora, Niboye, Kicukiro, Kigali, Rwanda. Questions or requests: +250 788 320 665. Effective date: August 2026.
INFORMATION WE MAY COLLECT
Identity and contact: name, phone number, email, delivery address, social-media handle (when you contact us there).
Order and payment: items, size, amount, channel, transaction reference, reconciliation status. We don't ask for or store PINs, passwords, or one-time codes.
Fit information: measurements, preferences, alteration notes, and, only where genuinely necessary and consented, fitting photographs.
Delivery: recipient details, location, courier or station, dispatch and handover status.
Community & affiliate: application, public profile links, event participation, content, referrals, commissions, conduct records.
Website: IP address, device or browser data, pages viewed, approximate location, cookie or analytics identifiers.
Correspondence: feedback, return evidence, customer-service records.
WHY WE USE INFORMATION
To take and fulfil orders (contact, order, payment, delivery, fit information) under contract or the steps leading to one. For customer care and returns (order, correspondence, photos, remedy records) under contract, legal obligation, or legitimate interest. For payment reconciliation (transaction reference, amount, payer or account details) under contract and legal obligation. For marketing and community news (name, contact, preferences) under consent or another permitted basis. For affiliate and event administration (application, referrals, content, payment, attendance) under contract, consent, or legal obligation. For security and improvement (technical, fraud, and usage information) under legitimate interest or consent where required.
SHARING INFORMATION
We may share only what's reasonably necessary with approved delivery partners, payment providers and banks, website/hosting/analytics suppliers, professional advisers, and public authorities where lawfully required. Each provider receives information for a defined purpose under suitable confidentiality and data-protection terms. We do not sell personal information. If a supplier stores or accesses data outside Rwanda, we use the approvals, safeguards, and contractual measures required by applicable law before the transfer.
RETENTION & SECURITY
We keep information only as long as needed for the stated purpose, legal and accounting requirements, dispute handling, and legitimate record-keeping. We use proportionate access controls, backups, secure devices, staff practices, and supplier checks. No system can promise absolute security, but we take our responsibility seriously.
As a guide: customer account details are kept until account deletion plus 30 days; order history for 5 years from the order date; payment records for 5 years from the transaction date; marketing consent records until consent is withdrawn plus 30 days; customer support records for 2 years from case closure; anonymised website analytics for 6 to 12 months; return and exchange records for 3 years from completion; inactive customer accounts are cleared after 2 years of inactivity; and records required by a legal or regulatory matter are kept until that matter is fully resolved.
YOUR CHOICES & RIGHTS
Subject to applicable law, you may ask about our use of your data, request access or a copy, correct inaccurate data, object or withdraw consent where relevant, request restriction, deletion, or portability where available, and complain to the competent authority. Withdrawing consent doesn't undo lawful processing already completed. Send a request to our contacts. We may need to verify your identity before acting. We'll respond within the period required by law.
COOKIES, COMMUNICATIONS & CHILDREN
We use only essential cookies before consent. A consent manager will appear before optional analytics or advertising tags activate. Marketing messages require a clear opt-in record, with an easy unsubscribe option on every message. This website and affiliate program aren't directed to children; we'll set and publish the age threshold and obtain guardian authorisation where legally required. We'll update this notice when practices materially change, show the new effective date, and provide additional notice when required.
Jaq & Saiba respects the intimacy of personal information. This notice explains what we collect, why we use it, who may receive it, how long we keep it, and the choices and rights available to you.
Data controller: Jaq & Saiba LTD, trading as Kalamelu, of Gorora, Niboye, Kicukiro, Kigali, Rwanda. Questions or requests: +250 788 320 665. Effective date: August 2026.
INFORMATION WE MAY COLLECT
Identity and contact: name, phone number, email, delivery address, social-media handle (when you contact us there).
Order and payment: items, size, amount, channel, transaction reference, reconciliation status. We don't ask for or store PINs, passwords, or one-time codes.
Fit information: measurements, preferences, alteration notes, and, only where genuinely necessary and consented, fitting photographs.
Delivery: recipient details, location, courier or station, dispatch and handover status.
Community & affiliate: application, public profile links, event participation, content, referrals, commissions, conduct records.
Website: IP address, device or browser data, pages viewed, approximate location, cookie or analytics identifiers.
Correspondence: feedback, return evidence, customer-service records.
WHY WE USE INFORMATION
To take and fulfil orders (contact, order, payment, delivery, fit information) under contract or the steps leading to one. For customer care and returns (order, correspondence, photos, remedy records) under contract, legal obligation, or legitimate interest. For payment reconciliation (transaction reference, amount, payer or account details) under contract and legal obligation. For marketing and community news (name, contact, preferences) under consent or another permitted basis. For affiliate and event administration (application, referrals, content, payment, attendance) under contract, consent, or legal obligation. For security and improvement (technical, fraud, and usage information) under legitimate interest or consent where required.
SHARING INFORMATION
We may share only what's reasonably necessary with approved delivery partners, payment providers and banks, website/hosting/analytics suppliers, professional advisers, and public authorities where lawfully required. Each provider receives information for a defined purpose under suitable confidentiality and data-protection terms. We do not sell personal information. If a supplier stores or accesses data outside Rwanda, we use the approvals, safeguards, and contractual measures required by applicable law before the transfer.
RETENTION & SECURITY
We keep information only as long as needed for the stated purpose, legal and accounting requirements, dispute handling, and legitimate record-keeping. We use proportionate access controls, backups, secure devices, staff practices, and supplier checks. No system can promise absolute security, but we take our responsibility seriously.
As a guide: customer account details are kept until account deletion plus 30 days; order history for 5 years from the order date; payment records for 5 years from the transaction date; marketing consent records until consent is withdrawn plus 30 days; customer support records for 2 years from case closure; anonymised website analytics for 6 to 12 months; return and exchange records for 3 years from completion; inactive customer accounts are cleared after 2 years of inactivity; and records required by a legal or regulatory matter are kept until that matter is fully resolved.
YOUR CHOICES & RIGHTS
Subject to applicable law, you may ask about our use of your data, request access or a copy, correct inaccurate data, object or withdraw consent where relevant, request restriction, deletion, or portability where available, and complain to the competent authority. Withdrawing consent doesn't undo lawful processing already completed. Send a request to our contacts. We may need to verify your identity before acting. We'll respond within the period required by law.
COOKIES, COMMUNICATIONS & CHILDREN
We use only essential cookies before consent. A consent manager will appear before optional analytics or advertising tags activate. Marketing messages require a clear opt-in record, with an easy unsubscribe option on every message. This website and affiliate program aren't directed to children; we'll set and publish the age threshold and obtain guardian authorisation where legally required. We'll update this notice when practices materially change, show the new effective date, and provide additional notice when required.