Privacy notice
Your data, in Spain and in Rwanda
A Rwandan company file contains passports, addresses and ownership details. This notice explains what we collect, why, where it goes, and the rights you have under European and Rwandan law.
Who is responsible
The controller is Voixa Consultors S.L., CIF B24744351, Barcelona, Spain, operating the Voixa Rwanda brand. You can reach us about your data through the contact form.
What we process and why
- Enquiries. Name, email, country of residence and the plan you describe, to answer you and prepare a quote. Legal basis: steps taken at your request before a contract (Art. 6(1)(b) GDPR).
- Client files. Passports, addresses, ownership charts, company documents, police clearance certificates and similar documents needed to register companies, apply for permits and open bank accounts. Legal basis: performance of the contract (Art. 6(1)(b)).
- Identity checks. Information required by Spanish anti-money-laundering law (Law 10/2010 of 28 April) and by the Rwandan institutions and banks we file with. Legal basis: legal obligation (Art. 6(1)(c)).
- Accounting records. Invoices and payment data. Legal basis: legal obligation under Spanish tax and commercial law.
We do not use your data for advertising, and we do not sell it.
Where your data goes
Your data is handled in Spain by Voixa Consultors S.L. When a filing is made in Rwanda, the documents needed for it are shared with our licensed partner firms in Kigali and with the Rwandan institutions concerned, such as the Office of the Registrar General at RDB, the Rwanda Revenue Authority, the Rwanda Social Security Board, the Directorate General of Immigration and Emigration and, for an account, the bank you choose. Many filings pass through Irembo, the government services portal.
Rwanda has no adequacy decision from the European Commission. Transfers are made because they are necessary to perform the contract you asked for (Art. 49(1)(b) GDPR) or under standard contractual clauses with our partners. Once in Rwanda, personal data is protected by Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy, supervised by the National Cyber Security Authority (NCSA).
Some company data becomes public by law. Rwanda keeps a companies register, and beneficial owners holding 25% or more are declared to the Registrar General under Law N° 019/2023. We tell you before filing which details will appear on a public record.
How long we keep it
- Enquiries that do not lead to an engagement: up to 12 months.
- Client files and identity checks: for the periods required by anti-money-laundering, tax and commercial law, which can be ten years after the end of the relationship.
- Documents held by Rwandan institutions follow Rwandan retention rules; company and tax records in Rwanda are kept for ten years.
Your rights
You may ask for access to your data, rectification, erasure, restriction, portability, or object to processing, by writing to us through the contact form. Some data cannot be erased while the law requires us to keep it. You may complain to the Spanish Data Protection Agency (AEPD). For data held in Rwanda, Law N° 058/2021 gives you comparable rights, exercised through us or directly with the controller in Rwanda.
Security
Documents are exchanged through secure channels, kept with restricted access, and shared with partners only to the extent a filing needs them. We ask clients not to send documents by email before an engagement is signed.
Cookies
This website uses no advertising or analytics cookies. A browser may store small technical preferences locally; they never leave your device.
Sources: DLA Piper, Data Protection Laws of the World, Rwanda; Hogan Lovells, key features of the Rwandan data protection law; PwC Rwanda, cross-border data transfer alert.