Effective date and last updated: 16 October 2026
This policy explains how Fosia Ltd (“Fosia”, “we”, “us”) collects and uses personal data on pay.fosiarw.com and through the Fosia Pay WordPress plugins (Fosia Pay Lite and Fosia Pay Pro). It is written to meet Rwanda’s Law No 058/2021 on the protection of personal data and privacy.
1. Who we are
Fosia Ltd, 1 KN 78 St, Kigali, Rwanda. Phone: +250 793 753 646. Email: infos@fosiarw.com.
Fosia Ltd is the data controller for the personal data described in sections 2.1 to 2.3 and 2.5 to 2.7. Data protection contact: infos@fosiarw.com.
2. What we collect and why
2.1 When you buy a license or download Fosia Pay Lite
- Data: name, email address, the billing details you enter at checkout, Mobile Money phone number, order details and IP address.
- Purpose: process your order, generate and email your license key, send your invoice, provide support and keep accounting records.
- Legal basis: performance of a contract with you; our legal obligations (tax and accounting).
2.2 When you pay by Mobile Money
Payments on this site are processed by PawaPay. Your phone number, the amount and the currency are sent to PawaPay to request the payment on your phone. We receive the payment status and a transaction reference. We never see or store your Mobile Money PIN.
2.3 When you activate and use a paid license (Fosia Pay Pro)
To check that your license is valid, the plugin on your website contacts pay.fosiarw.com when you activate it and then once a day. It sends:
- your license key and the domain of your website;
- technical information: PHP, WordPress, WooCommerce and plugin versions, the last PHP error message on the server, and the plugin’s webhook URL;
- the IP address and user agent of your server (logged with each request).
We use this to validate the license, link it to your site or sites, deliver updates and service messages shown in the plugin dashboard, and help with support. Legal basis: performance of a contract and our legitimate interest in preventing license misuse.
Fosia Pay Lite and Pro also fetch current plan prices from pay.fosiarw.com to show them in the plugin dashboard. No personal data is sent with that request.
2.4 Agency plan: central callback router
If you use the Agency callback router, PawaPay sends the payment notifications for your sites to pay.fosiarw.com, which forwards each one to the right site. These notifications can contain your customers’ transaction data (amount, currency, status, transaction reference and, depending on PawaPay, the payer’s phone number). For this data we act as a processor on your behalf: we only forward it to your site and do not use it for any other purpose. Technical logs of these notifications are kept no longer than our security logs (90 days).
2.5 When you book a call or contact us
The booking form on our Support page collects your name, email address, phone number, time zone and message. We use them to schedule and hold the call and to answer you. Legal basis: steps taken at your request before entering into a contract, or our legitimate interest in answering enquiries.
2.6 Customer account and reviews
If you create an account, we store your name, email address, password (encrypted) and order history. If you leave a product review, we store the name, email address and text you submit, and your IP address.
2.7 Website analytics, performance and security
We use the tools listed in section 4 to measure traffic, keep the site fast and protect it. Analytics cookies are only set after you give your consent (see section 6).
3. What we do not do
- We do not sell your personal data.
- We do not hold your funds or your customers’ funds. Payments go directly to the merchant’s own PawaPay account.
- The Fosia Pay plugins do not send your store’s orders or your customers’ data to Fosia, except the router notifications described in section 2.4 when you choose to use the Agency router.
4. Service providers
We use the following providers to run pay.fosiarw.com. Some of them only run on our own server and receive no personal data.
| Provider | What it does for us | Data involved | Where the data is processed |
|---|---|---|---|
| PawaPay (pawaPay Ltd) | Mobile Money payment processing for orders on this site | Phone number, amount, currency, transaction status | United Kingdom and the country of your Mobile Money operator |
| Hostinger (Hostinger International Ltd) | Hosting of pay.fosiarw.com and its database; Hostinger Reach (email and forms), onboarding tools and the AI assistant used by our administrators | All data stored on the site; data you submit through Reach forms | Hostinger data centres (company based in Cyprus) |
| WooCommerce and WooCommerce Analytics (Automattic) | Shop, cart, checkout, orders, customer accounts and store reports | Order and account data | Our server |
| WooCommerce PDF Invoices | Creates the PDF invoice for your order | Order and billing details | Our server |
| Checkout Field Editor | Manages the fields of the checkout form | The checkout details you enter | Our server |
| ARMember | Membership, login and account pages | Name, email address, login details | Our server |
| Hydra Booking | Call booking on the Support page | Name, email address, phone number, time zone, message | Our server |
| Google Site Kit (Google Analytics and Google Search Console) | Website statistics and search performance | IP address, pages visited, device information, analytics cookies (only after consent) | Google (United States and other countries) |
| Google Fonts | Font delivery | IP address | Google (United States and other countries) |
| Yoast SEO | Search engine optimisation (titles, descriptions, sitemaps) | No visitor personal data | Our server |
| LiteSpeed Cache | Page caching (no CDN) | Technical data only | Our server |
Each provider processes data under its own privacy policy. Some providers are located outside Rwanda, including in the European Union, the United Kingdom and the United States. When personal data is transferred outside Rwanda, we do so under the conditions set by Law No 058/2021 and rely on the safeguards these providers offer.
Services used by the plugin on your own website (you are the controller there): PawaPay (payments), open.er-api.com (exchange rates, currency codes only) and, only if you turn them on, Anthropic (AI assistant, with your own API key) and Telegram (sale notifications, with your own bot). Fosia does not receive this data.
5. How long we keep data
- Orders and invoices: as long as Rwandan tax and accounting rules require.
- Customer account data: until you ask us to delete your account, except the records we must keep by law.
- License check logs and security logs: 90 days.
- Support and booking messages: 24 months.
- Backups: up to 90 days.
6. Cookies
We use cookies that are necessary for the shop to work (cart, checkout, login and security). We ask for your consent before setting analytics cookies. You can withdraw your consent at any time; analytics cookies are then no longer set.
7. Your rights
Under Rwanda’s Law No 058/2021 on the protection of personal data and privacy, you have the right to:
- access the personal data we hold about you;
- have it corrected;
- have it deleted;
- object to its processing;
- receive it in a portable format.
To use these rights, email infos@fosiarw.com. We reply within 30 days. You can also complain to the data protection office of Rwanda’s National Cyber Security Authority (NCSA).
8. Security
The site uses HTTPS. Payment confirmations are cryptographically verified before an order is updated. Access to our admin area is restricted. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as required by law.
9. Children
Our products are for businesses. We do not knowingly collect data from children under 18.
10. Changes to this policy
We may update this policy. The date at the top shows the current version. Significant changes will be announced on the site or by email to license holders.
11. Contact
Fosia Ltd, 1 KN 78 St, Kigali, Rwanda. Phone: +250 793 753 646. Email: infos@fosiarw.com.