Privacy Policy

Effective Date: October 17, 2025
Ruya Startup Studio | Quqnoos Investment Ltd

Information We Collect

When you apply to our programs or use our website, we collect:

Personal Information: Name, email, phone number, university affiliation
Application Data: Your responses to founder profiling and idea submission questions
Communication Records: Messages sent via WhatsApp, email, or our website
Technical Data: IP address, browser type, device information for website functionality

We may also collect limited sensitive information (such as national identification details or demographic data) where required by law or for due diligence purposes, and we will handle such data in compliance with applicable data protection laws.

How We Use Your Information

Our processing of personal information is based on one or more lawful grounds, including your consent, our legitimate interest in operating our programs, the performance of a contractual obligation, and compliance with applicable laws and regulations.

We use your information to:

Evaluate your application for the Zāfir program and other RSS initiatives
Contact you about your application status and program updates
Improve our selection process and program design
Comply with legal requirements in Afghanistan

We ensure that your data is processed fairly, lawfully, and transparently for specific, legitimate purposes and not retained longer than necessary

Information Sharing

We do not sell your personal information. We share information only with:

Quqnoos Investment Ltd entities: For investment evaluation and program delivery
University Partners: With your consent, to verify enrollment status
Legal Authorities: When required by Afghan law

Where we transfer or store personal information outside Afghanistan (for example, on cloud servers in other jurisdictions), we ensure that appropriate safeguards such as contractual data protection clauses or equivalent international standards are in place to protect your information.

All third parties that process data on our behalf (such as cloud service providers or communication platforms) are contractually bound to implement adequate security and confidentiality measures in line with international data protection standards.

Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption, secure access controls, and periodic security audits. Our systems adhere to internationally recognized information security standards such as ISO/IEC 27001.

While we strive to protect your information, no transmission or storage system is completely secure. In the event of a data breach, we will take immediate steps to mitigate the impact and, where required by law, notify affected individuals and relevant authorities.

Your Rights

You have the right to:

Access the information we hold about you
Request corrections to inaccurate information
Withdraw your application and request data deletion
Opt out of non-essential communications

In addition to the rights listed above, you may also have the following rights under applicable data protection laws:

• The right to object to or restrict certain types of processing.
• The right to data portability.
• The right to withdraw consent without affecting prior lawful processing.
• The right to lodge a complaint with a data protection authority in your jurisdiction.

We will respond to all data rights requests within a reasonable timeframe, typically within 30 days.

Data Retention

We retain your application data for 24 months after program completion or application withdrawal for record-keeping and program improvement purposes.We regularly review our data retention practices to ensure that personal information is not kept longer than necessary. Data is securely deleted or anonymized after the retention period unless required by law.

Data Controller and Contact for Data Protection

Ruya Startup Studio, operated by Quqnoos Investment Ltd, is the Data Controller responsible for the processing of personal data under this Policy.

For data protection inquiries or to exercise your rights, please contact our designated Data Protection Officer (DPO) at:
Email: privacy@ruyastartupstudio.com
Address: Quqnoos Investment Ltd, Kabul, Afghanistan

International Data Protection Compliance

We process and store personal data in compliance with international data protection frameworks, including the EU General Data Protection Regulation (GDPR) and equivalent standards where applicable.

We ensure that personal data transferred across borders is protected by adequate safeguards, and that all processing activities are conducted with transparency, accountability, and respect for individual privacy rights.

For privacy questions or to exercise your rights:

Email: yes@ruyastartupstudio.com
Phone: +93 799 781 502
Address: Quqnoos Investment Ltd, Kabul, Afghanistan

Changes to This Policy

Where material changes are made, we will notify users via email or website update at least 14 days before the new policy takes effect.

This policy is governed by the laws of Afghanistan.