Privacy Policy
What personal data this site collects, why we hold it, how long we keep it, and the rights you have over it.
1. Data controller
Roha Labs is the controller for personal data collected through this website. Our identification details and contact address are set out in the Legal Notice.
Where we process personal data on behalf of a client as part of a platform we operate or maintain for them, that client is the controller and we act as a processor. Those arrangements are governed by our Data Processing Agreement rather than this policy.
2. What we collect
Information you give us — when you submit the contact form or email us, we receive your name, email address, phone number if you provide one, and whatever you choose to write in your message.
Information collected automatically — our hosting provider records standard server data such as IP address, browser and device type, pages requested and timestamps. This is used to serve the site, keep it secure and diagnose faults.
We do not sell personal data, and we do not use it to build advertising profiles.
3. Why we use it, and on what basis
- To answer your enquiry and discuss a possible engagement — on the basis of steps taken at your request prior to entering a contract
- To deliver a project we have agreed — on the basis of performing that contract
- To keep the site available, secure and working correctly — on the basis of our legitimate interest in operating it
- To meet accounting, tax and other obligations — on the basis of legal obligation
6. International transfers
We are based in Ethiopia and our infrastructure providers operate globally, so your data may be processed outside your country. Where we transfer personal data originating in the European Economic Area, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.
7. How long we keep it
Enquiries that do not lead to an engagement are kept only as long as needed to deal with them and for a reasonable period afterwards. Records relating to a project are kept for the life of the engagement and for as long as accounting and tax rules require. Server logs are kept for a short period for security and diagnostics.
8. Your rights
Subject to the law that applies to you, you may ask us to:
- Confirm what personal data we hold about you, and give you a copy
- Correct data that is wrong or incomplete
- Delete data we no longer have grounds to keep
- Restrict or object to a particular use of your data
- Provide your data in a portable form, or transfer it
- Withdraw consent, where our use of the data rests on consent
Write to us to exercise any of these. If you are in the European Economic Area or the United Kingdom and you believe we have handled your data improperly, you may also complain to your national supervisory authority.
9. Security
We use encryption in transit, access control on the systems that hold personal data, and the principle of least privilege for our own staff. No system is perfectly secure, but we take these obligations seriously and design for them from the start.
10. Changes to this policy
If we change how we handle personal data, we will update this page and revise the date shown above.