Last updated: 14 October 2026
Who we are
Xendly Exchange is operated by Xendly CORP Ltd, a company registered in Rwanda. We are responsible for the personal data described here. You can reach us at support@xendlylabs.com.
What we collect
Your account: name, email address and phone number, from your Xendly account.
Identity verification: a photo of your ID document, a selfie and a short liveness check, the details read from your document (name, date of birth, document number, nationality), and the result of a screening against sanctions, politically exposed persons and adverse media lists.
Orders: the currencies and amounts you exchange, the mobile money number or bank account you pay from and are paid to, and the status of each order.
Technical data: your IP address, device and browser information, collected for security and fraud prevention.
Why we use it
To run your account and carry out the exchanges you ask for.
To verify who you are and screen against sanctions and watchlists. Rwandan anti-money-laundering law requires this before we can exchange money for you.
To prevent fraud, including stopping one identity from being used on several accounts.
To contact you about your orders and your account. We do not send marketing without your consent, and we never sell your data.
Who we share it with
Didit, our identity verification provider, processes your ID document, selfie and screening on our behalf.
Payment providers (Xendly Pay, MTN Mobile Money, Airtel Money and partner banks) receive what they need to move your money.
Authorities and regulators, when the law requires it, for example a request from the Financial Intelligence Centre or a court order.
Some of these providers process data outside Rwanda. Where they do, we only use providers that protect it to the standard Rwandan data protection law requires.
How long we keep it
We keep identity and transaction records for as long as Rwandan anti-money-laundering law requires after your account closes. Other data is deleted or anonymised once it is no longer needed for the purposes above.
Your rights
Under Law No 058/2021 on the protection of personal data and privacy, you can ask for a copy of your data, ask us to correct it, object to how we use it, or ask us to delete it. We may have to keep records the law requires us to keep.
Write to support@xendlylabs.com. If you are not satisfied with our answer, you can complain to the National Cyber Security Authority (NCSA).
Security
Data is encrypted in transit, access is limited to staff who need it, and identity documents are held by our verification provider rather than copied into our own systems.
Changes
If we change this policy we will update the date above, and tell you by email before a significant change takes effect.