Privacy Notice

Cube Communications Ltd · Last updated September 2026

CUBE COMMUNICATIONS LTD

Who we are

Cube Communications Ltd, trading as Cube Africa Group, is a company incorporated in Rwanda under company code.

This notice explains how we handle personal data for which we are the data controller — that is, where we decide why and how it is used.

Where we deliver a convening for a client, the client is the data controller for delegate data and we act as their data processor. That processing is described in the privacy notice issued for the event concerned, not in this notice.

Contacting us about privacy

Our data protection contact is reachable at info@cubeafricagroup.com

Whose personal data we hold, and what we collect

Visitors to our website. IP address, browser and device information, pages visited and time stamps, and any details you submit through a contact or enquiry form — typically your name, organisation, email address and message.

Clients and prospective clients. Name, job title, organisation, business contact details, correspondence and meeting records, contract and payment records, and marketing preferences.

Suppliers, sub-contractors and freelance crew. Name, contact details, identification and accreditation details, tax and company registration details, bank details, qualifications and insurance certificates, and contract and payment records.

Subscribers and readers. Name, email address, organisation, country and communication preferences.

Job applicants. The information in your application — CV, qualifications, employment history, contact details and references.

Employees. Handled under our internal staff privacy notice, which is issued separately to employees.

Torus administrator users. Name, organisation, business contact details, account credentials and access logs, where we issue platform administrator accounts.

Why we use it, and our legal grounds

To respond to enquiries, prepare proposals and negotiate and perform contracts — performance of a contract, or steps taken at your request before entering one.
To deliver our services, manage projects and invoice — performance of a contract.
To meet tax, accounting, employment and regulatory obligations — legal obligation.
To send our publications, insights and event invitations — consent, which you may withdraw at any time.
To run and improve our website, understand how it is used, and keep our systems secure — legitimate interests, balanced against your rights.
To assess job applications — steps taken at your request before entering a contract, and our legitimate interest in recruiting.

Sharing

We share personal data with service providers who process it on our behalf under written terms, including AOS Ltd in Kigali, which hosts the Torus platform, and providers of cloud email and storage, customer relationship management, website hosting and accounting. We also share personal data with the Rwanda Revenue Authority, the Rwanda Social Security Board and other public authorities where the law requires, and with our auditors, insurers and legal advisers where necessary. We do not sell personal data.

A current list of the processors we use is available on request.

Where your personal data is held

The Torus platform is hosted in Rwanda, at the National Data Centre operated by AOS Ltd in Kigali. Some of our business systems — email and file storage, customer relationship management, website hosting and accounting — are provided by companies located outside Rwanda. Where personal data is transferred or stored outside Rwanda we do so in accordance with Articles 48 and 50 of the DPP Law and under written data processing terms with each provider.

How long we keep it

Enquiries that do not become projects: 24 months.
Client and supplier records: for the duration of the relationship and 10 years afterwards, to meet tax and limitation requirements.
Marketing contacts: until you unsubscribe, or after 24 months of no engagement.
Unsuccessful job applications: 12 months, unless you ask us to keep them longer.
Website analytics: 26 months.

How we protect it

We apply role-based access control, multi-factor authentication on all accounts, encryption in transit and at rest, device encryption, backup and recovery testing, staff confidentiality obligations, annual data protection training, and a documented breach response procedure including notification to the supervisory authority where required.

Your rights

Under the DPP Law you have the right to:

be informed about how your personal data is collected and used;
access the personal data held about you and obtain a copy of it;
have inaccurate or incomplete personal data corrected;
have your personal data erased where there is no lawful reason to keep it;
restrict or object to the processing of your personal data in certain circumstances;
receive your personal data in a structured, commonly used format, or have it transmitted to another organisation;
withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
object to a decision made about you solely by automated means where that decision produces legal effects or similarly significantly affects you; and
lodge a complaint with the supervisory authority.

To exercise a right, contact info@cubeafricagroup.com. We will respond within the period the law allows and may first ask you to verify your identity.

You may lodge a complaint with the National Cyber Security Authority through the Data Protection and Privacy Office, 21 KG Avenue, A&P Building, Ground Floor, Kacyiru, Gasabo, Kigali: toll free 9080, dpp@dpo.gov.rw, www.dpo.gov.rw.

Changes

We may update this notice. The current version is always published at www.cubeafricagroup.com and the date of the most recent update is shown at the top.