Personal data protection

Should the French and English versions of this document diverge, the French version prevails.

1. Who processes your data

Data controller

AFRICA DIGITAL SOLUTIONS (AFRIDISOL)

Registered office

Quartier Hédzranawoé Sagboville, rue derrière la Pharmacie Saint Pierre, préfecture du Golfe

Data protection officer

published when the service opens

Contact

donnees@kobri.app

APDP filing reference

published when the service opens

The licensed payment service provider under whose licence Kobri operates is also a data controller for the data it collects under its own regulatory obligations (customer due diligence, anti-money laundering).

2. What data, and why

The ten-year periods correspond to the retention obligations applicable to transaction data and customer due diligence records. They will be confirmed with the compliance department of the licensed provider.

3. What we do not do

• We do not sell or rent your data to third parties.
• We do not use your data for advertising, and we do not carry out commercial profiling.
• This website sets no analytics or advertising cookies. It contains no third-party trackers.
• Your ID document number is never stored in the clear: it is encrypted, and the fingerprint used to detect duplicates cannot be reversed.
• Your photos go through no automated facial recognition: a person looks at them, and every time they do is logged.

4. Your rights

Law No. 2024/017 grants you the following rights:

• Access — obtain a copy of the data concerning you.
• Rectification — correct inaccurate information.
• Erasure — the “right to be forgotten”, within the limits of legal retention duties.
• Portability — receive your data in a reusable format.
• Objection to profiling — refuse a decision based on automated processing.

To exercise these rights, write to donnees@kobri.app. We respond within thirty days. Proof of identity may be requested, solely to prevent a third party from accessing your data.

Some erasure requests cannot be granted: accounting entries and transaction data must be retained under legal obligations. Where that is the case, we tell you precisely which ones and why.

5. Security

• Encryption in transit (TLS) and encryption at rest for identity documents and selfies. Every access to a file is logged, and shown in the file itself.
• PIN protected by a memory-hard derivation function, combined with a server-side secret held outside the database.
• Tamper-evident, hash-chained log of sensitive actions: any retroactive change is detectable.
• PIN required for every outgoing operation, verified by the server.

6. Processors and transfers outside Cameroon

Certain technical services (hosting, push notifications) are provided by suppliers that may be established outside Cameroon. Such transfers are governed by contract and, where the law requires it, subject to APDP authorisation.

7. Complaints

If our response does not satisfy you, you may refer the matter to the Personal Data Protection Authority (APDP). You may also write to us directly at contact@kobri.app.