Privacy Notice
The Governance Meridian
Version 1.2. Effective 7 October 2026.
This notice explains what personal data I collect through The Governance Meridian, why I collect it, where it is kept, how long I keep it, and how you can change your mind. It is written to meet Law No 058/2021 of 13 October 2021 relating to the protection of personal data and privacy.
1. Who is responsible for your data
The data controller is Baliyat Johnson, an independent practitioner based in Kigali, Rwanda, trading as The Governance Meridian. The company registration with the Rwanda Development Board is not yet complete, so I am the controller in my own name.
| Controller | Baliyat Johnson, trading as The Governance Meridian |
| Based in | Kigali, Rwanda |
| Study questions and withdrawals | study@governancemeridian.com |
| Enquiries | advisory@governancemeridian.com |
| Telephone | +250 799 907 172 |
| Registration | Application to register as a data controller submitted to the National Cyber Security Authority, Data Protection and Privacy Office |
I have not designated a separate data protection officer. Any question about this notice comes to me directly.
2. What this notice covers
Three activities, and nothing else.
- The 2026 East African AI and Data Governance Readiness Study. Short in-person interviews at the ISACA Rwanda Chapter Annual Conference on 5 and 6 October 2026. From 7 October the study continues remotely, by a fifteen minute call (phone, WhatsApp or Teams) or by written answers sent by email. Fieldwork closes on 30 October 2026.
- The findings sign-up on the study page, governancemeridian.com/p/readiness-study.
- The contact form on the website, governancemeridian.com.
3. What I collect, and why
| Activity | What I collect | Why |
|---|---|---|
| Study interview, call or written answers | Name, job role, organisation, organisation type, sector and country. Your answers to five questions about how your organisation manages AI and data governance. For a call, the phone number or account you want me to call. For written answers, your email address and the answers you send. | To produce an anonymised baseline of AI and data governance readiness, and to send you your own one-page snapshot if you ask for it. |
| Findings sign-up | Your email address, and your name if you choose to give it. | To send you the study findings when they are written. |
| Contact form | Your name, organisation, email address and your message. | To reply to your enquiry. |
I do not ask for, and do not want, any sensitive personal data as the Law defines it. The study questions are about organisations, not about people. If something personal comes up in conversation, I record what was said about the organisation and leave the person out.
I do not record audio. Calls are not recorded either. I take notes while we talk. I do not use your data for marketing, I do not sell it, and I do not use it to make any automated decision about you.
4. The legal basis: your consent
Everything in this notice rests on your consent.
- At an interview or on a call, I explain the study and ask for your consent before the first question. I record that you agreed.
- For written answers, the email with the questions explains the study and links to this notice. Sending your answers back is your consent. You can leave out any question.
- Being quoted by name is a separate consent. I ask for it separately, and if you agree I send you the exact wording to confirm in writing before anything is published.
- On the website, you consent by choosing to fill in and send the form. Nothing is collected until you press the button.
5. How to withdraw your consent
You can withdraw at any time, and it is as easy as agreeing was. Withdrawing does not affect anything done lawfully before you withdrew.
| If you took part in | What to do | What happens |
|---|---|---|
| A study interview, call or written answers | Tell me at the time, or email study@governancemeridian.com afterwards with your name and organisation. | I delete your response and reply to confirm it has been done. Your answers are left out of the findings. |
| A named quote | Email study@governancemeridian.com. | Before publication, the quote is removed. After publication, your name is removed from any version I control. |
| The findings sign-up | Email study@governancemeridian.com, or reply to any email I send you. | I delete your details and send you nothing further. |
| The contact form | Email advisory@governancemeridian.com. | I delete your details and your message. |
Once your summary has been sent and your response deleted, there is nothing left that identifies you. The anonymised totals in the published findings cannot be traced back to you, so there is nothing further to withdraw.
6. Who sees your data
I do. Nobody else sees your individual answers. Two service providers process data on my behalf.
| Provider | What it does | Where |
|---|---|---|
| Lovable (Lovable Cloud) | Hosts the website and stores what you send through the findings sign-up and the contact form. | United States |
| Zoho Corporation (Zoho Mail) | Business email. Used to receive written answers, to send each participant their own snapshot, and to answer enquiries. | United States |
If we speak on WhatsApp or Teams, the call runs through that service under your own account with it. I use it only to talk to you. Your answers are never typed into it or sent through it.
The published findings are anonymous and reported in aggregate. A name or organisation appears only where that person has given the separate consent described in section 4.
I do not add any analytics, advertising or tracking to the website, and I set no cookies of my own. Cloudflare, which delivers the site, may run automated security checks to block bots. The site loads its typefaces from Google Fonts, so your browser connects to Google to fetch them. I receive nothing from either.
7. Where your data is kept
- Interview and call answers are captured on one device and never synced to any cloud service. Each evening the day's responses are moved to encrypted storage held in Kigali and cleared from the device.
- Written answers arrive by email, so they sit in the Zoho Mail mailbox until I have copied them into the same encrypted storage in Kigali. The email is then deleted.
- Findings sign-ups and contact form messages are stored by Lovable on servers in the United States.
- Email sent and received through Zoho Mail is held on Zoho's servers in the United States.
The Law requires authorisation for personal data to be transferred or stored outside Rwanda. I have declared both providers and both countries on my registration application, and I have asked the National Cyber Security Authority about the authorisation route.
8. How long I keep it
| Data | Kept until |
|---|---|
| Study responses, names and contact details | Your snapshot has been sent: by 13 October 2026 for conference interviews, and by 6 November 2026 for everyone who takes part after it. Then deleted. |
| Written answers in the mailbox | Copied into encrypted storage in Kigali. Then deleted from the mailbox. |
| Summary emails in the mailbox | Delivery is confirmed. Then deleted. |
| Record of consent to a named quote | For as long as the quote is published, as evidence that you agreed to it. |
| Findings sign-up details | The findings have been sent to you. Then deleted. |
| Contact form enquiries | Your enquiry has been dealt with. Then deleted, unless it leads to working together, in which case it becomes part of the records of that engagement. |
| Anonymised findings | Kept. They contain no personal data. |
9. How your data is protected
- The capture device has a passcode and screen lock, and is locked to the capture tool while an interview or call is in progress. At the conference it ran in airplane mode.
- The phone, the laptop and the backup media are fully encrypted. The backup stays in Kigali.
- No audio recording is made, in person or on a call. Notes only.
- Email travels encrypted in transit. A data processing agreement has been requested from Zoho and is pending the provider's review.
10. Your rights
Under Law No 058/2021 you have the right to:
- withdraw your consent at any time (Article 8)
- know what data I hold about you, why, who it has gone to, and whether it has left Rwanda, and to have a copy (Article 18)
- object to processing that causes you loss, sadness or anxiety (Article 19)
- receive your data in a usable form (Article 20)
- not be subject to a decision made solely by automated processing (Article 21). I make no such decisions.
- have processing restricted (Article 22)
- have your data erased (Article 23)
- have inaccurate data corrected (Article 24)
To use any of these rights, email study@governancemeridian.com or advisory@governancemeridian.com. I will answer within 30 days, and usually much sooner.
If you are not satisfied with my answer, you can complain to the National Cyber Security Authority, Data Protection and Privacy Office, at dpo.gov.rw.
11. Changes to this notice
If anything here changes, I will update this notice and the version date at the top. If a change affects something you have already agreed to, I will tell you directly before it applies to your data.
Annex: where this notice appears on the website
The consent and withdrawal routes above are already live on the website. The wording below is quoted exactly as it appears on 7 October 2026.
Study page: governancemeridian.com/p/readiness-study, in the body of the page
“Answers from conversations and calls live on one device, never in the cloud, and come off it at the end of each day. Written answers arrive by email and are deleted from the mailbox once I have copied them over. If you change your mind at any point, email study@governancemeridian.com and I will delete your response.”
Study page: Take part section, governancemeridian.com/p/readiness-study#take-part
“A fifteen minute call. Phone, WhatsApp or Teams, whichever suits you. I will reply with two times to choose from. Nothing is recorded.”
“Written answers by email. I will send you the five questions. A few sentences for each is plenty, in your own words.”
Study page: beneath the findings sign-up form (fields: Name, optional; Email; button: Send me the findings)
“Your details are stored with our website provider, Lovable Cloud, on servers in the United States. We use them only to send you the findings. If you change your mind at any point, email study@governancemeridian.com and I will delete them.”
Home page: beneath the contact form, governancemeridian.com
“Your details are stored with our website provider, Lovable Cloud, on servers in the United States. We use them only to reply to you, and delete them on request to advisory@governancemeridian.com.”
The business cards handed out at the conference carry a QR code that resolves to the study page, so every participant receives a route to this notice and to the withdrawal address.