Privacy Policy

1. Introduction

The University of Rwanda (UR) Management Information System (MIS) is committed to protecting the privacy and personal data of all its users, in compliance with the Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy of the Republic of Rwanda and other applicable regulations.

This Privacy Policy describes how we collect, use, store, and protect your personal information when you use the MIS platform.

2. Data Controller

The University of Rwanda is the data controller for all personal data processed through the MIS. For questions regarding data processing, contact the IT Department or the Data Protection Officer through the channels indicated on the Support page.

3. Personal Data We Collect

We collect and process the following categories of personal data:

• Identity data: Full name, employee ID, student number, national ID number
• Contact data: Email address, phone number
• Professional data: Academic rank, department, qualifications, employment status
• Academic data: Teaching allocations, workload records, marks and assessment results, supervision records, research outputs, study leave records
• System data: Login timestamps, IP addresses, activity logs for security and audit purposes

4. Purpose of Data Processing

Your personal data is processed for the following purposes:

• Academic workload management and allocation
• Marks processing, grading, and transcript generation
• Academic staff promotion and career development
• Study leave management and tracking
• Research output tracking and reporting
• Institutional reporting and compliance with national education regulations
• System security, audit trails, and fraud prevention

5. Legal Basis for Processing

We process personal data based on:

• Contractual necessity: Processing required to fulfill the employment or enrollment contract between you and the University
• Legal obligation: Compliance with Rwandan law, including the Law governing the University of Rwanda and HEC regulations
• Legitimate interest: Ensuring efficient academic administration, institutional accountability, and quality assurance

6. Data Sharing

Your personal data may be shared with authorized personnel within the University (Heads of Departments, Deans, College Principals, Registrar) strictly on a need-to-know basis and in accordance with their administrative responsibilities. Data may also be shared with:

• The Higher Education Council (HEC) as required by national education regulations
• Government agencies when required by law
• External examiners and evaluation committees for promotion processes

We do not sell or share your personal data with third parties for commercial purposes.

7. Data Retention

Personal data is retained for as long as necessary to fulfill the purposes described above, and in accordance with the University's records retention policy and Rwandan law. Academic records may be retained indefinitely as part of the University's institutional archives.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, role-based permissions, activity logging, and regular security reviews.

9. Your Rights

In accordance with Rwandan data protection law, you have the right to:

• Access your personal data held in the system
• Rectification of inaccurate or incomplete data
• Erasure of data that is no longer necessary (subject to legal retention requirements)
• Restriction of processing in certain circumstances
• Object to processing based on legitimate interest
• Lodge a complaint with the relevant supervisory authority

To exercise your rights, please contact the IT Department or the Data Protection Officer through the Support page.

10. Changes to This Policy

This Privacy Policy may be updated periodically. Users will be notified of material changes through the system. The latest version is always available on this page.