Privacy Policy — DossiersFaciles
This Policy is established in accordance with Law No. 2024/017 of 23 December 2024 on the protection of personal data in Cameroon and with the requirements of the application stores (Apple App Store, Google Play). It is subject to change; any substantial modification is notified within the application.
Version: 1.0 Last updated: 2026-06-04 Effective date: 9 July 2026
Preamble
This Privacy Policy (hereinafter the "Policy") informs the users of the DossiersFaciles platform (hereinafter "DF" or "the Platform") of the conditions of collection, processing, retention and sharing of their personal data. It forms an integral part of the General Terms of Use (hereinafter "Terms"), available at https://dossiersfaciles.xcales.net/cgu-en.html. The terms defined in the Terms (Client, Facilitator, Mission, Payment provider, Messaging) retain the same meaning here.
Article 1 — Data controller
The data controller is the company identified in the Legal notices of the Terms: Services Conseils Stampy Technologies Inc.
- Point of contact for personal data matters / Data protection officer: support@dossiersfaciles.xcales.net
- Contact: support@dossiersfaciles.xcales.net
Article 2 — Legal framework
DF processes personal data in accordance with, among others:
- Law No. 2024/017 of 23 December 2024 on the protection of personal data in Cameroon;
- Law No. 2010/012 of 21 December 2010 on cybersecurity and cybercrime;
- Law No. 2010/021 of 21 December 2010 governing electronic commerce (obligations to retain transaction and evidentiary data) and the anti-money laundering and counter-terrorism financing obligations applicable to Facilitators in their capacity as payment beneficiaries.
The competent authority for data protection is the Personal Data Protection Authority established by Law No. 2024/017. ANTIC (the National Agency for Information and Communication Technologies) remains competent for cybersecurity matters only, and not as the data protection authority.
Article 3 — Data collected
DF applies the principle of minimization: only the data necessary for each purpose is collected.
3.1 All users
| Category | Data | Mandatory |
|---|---|---|
| Identification | Phone number (+237) | Yes (authentication key) |
| Preferences | Application language | No |
| Technical | Device identifier, system and application version, model | Yes (security) |
| Declarative location | City and neighborhood entered | Yes (matching) |
| Connection log | Dates, times, IP address | Yes (security) |
| Support | Exchanges with support | No (at the user's initiative) |
At this stage, as authentication relies exclusively on the phone number and a one-time code, DF does not collect an email address.
3.2 Clients
| Category | Data | Mandatory |
|---|---|---|
| Identity | Legal first and last name to appear on the document | Yes (for the Mission) |
| Mission | Type of procedure, information to be entered, delivery location, uploaded documents | Yes (for the Mission) |
| Payment | Mobile Money number, transmitted to the Payment provider and not stored in cleartext by DF | Yes (for payment) |
| Rating | Ratings and comments left for Facilitators | No |
| Delivery evidence | Photos taken at collection and handover | Yes where applicable |
3.3 Facilitators (sensitive data)
Given their capacity as payment beneficiaries, identity verification is mandatory. The matching selfie and the identity document constitute biometric and sensitive data within the meaning of Article 19 of Law No. 2024/017. Their processing relies on a specific consent, separate from acceptance of the Terms, and is subject, where applicable, to the prior authorization of the Data Protection Authority.
| Category | Data | Mandatory |
|---|---|---|
| Legal identity | First name, last name, National Identity Card number | Yes |
| Sensitive biometric data | Photograph of the National ID Card (front, back), matching selfie | Yes |
| Payment | Verified Mobile Money number for withdrawals | Yes (anti-fraud) |
| Zone | City and neighborhood of activity | Yes (matching) |
| Activity | Missions completed, ratings received, balance and ledger entries | Generated by use |
3.4 Data not collected
DF does not collect the address book, personal SMS or emails, precise background geolocation, or browsing history outside the Platform. No advertising identifier is used.
Article 4 — Purposes and legal bases
| Purpose | Legal basis | Data |
|---|---|---|
| Account creation and management | Performance of the contract (Terms) | Identification, technical |
| Matching and performance of Missions | Performance of the contract | Identification, location, Mission, evidence |
| Payments and escrow | Performance of the contract | Mobile Money number, amounts |
| Facilitator identity verification | Legal obligation + specific consent (sensitive data) | Legal identity, biometric data |
| Retention of transactions | Legal obligation (anti-money laundering, electronic commerce) | Ledger, transactions |
| Security and fraud prevention | DF's legitimate interest | Connection log, IP, device identifier |
| Rating and quality | DF's legitimate interest | Ratings, comments |
| Support | Performance of the contract | Support exchanges |
| Aggregated statistics | DF's legitimate interest | Anonymized data |
| Transactional notifications | Performance of the contract | Phone number |
| Marketing communications | Consent (opt-in) | Preferences |
Article 5 — Retention periods
DF retains data for the period strictly necessary for each purpose or required by law.
| Category | Period |
|---|---|
| Account data | Duration of the account's activity |
| Documents uploaded by the Client | Duration of the Mission, deleted within 15 days following closure, except in the event of an ongoing dispute |
| Delivery evidence photos | Retained for 5 years under anti-money laundering obligations (CEMAC Regulation No. 01/CEMAC/UMAC/CM) |
| Facilitator's identity document and biometric data | Duration of the account's activity, then 5 years after its closure (CEMAC anti-money laundering obligations) |
| Financial transactions and ledger entries | Retained for 10 years in anonymized form (OHADA accounting obligations) |
| Audit logs | Retained for 12 months for security and governance purposes, then purged |
Upon account deletion (Article 8.3), identifying data is erased or anonymized within 30 days, subject to data covered by a legal retention obligation. Fingerprints (hashes) of the phone number and of the identity document may be retained in order to prevent the fraudulent recreation of accounts.
Article 6 — Recipients and processors
6.1 Internal access
The data is accessible only to authorized DF personnel, strictly within the limits of their duties (support, identity verification, dispute arbitration, governance). All access is recorded in an audit log.
6.2 Processors
DF uses technical providers, bound by contract to comply with this Policy:
| Processor | Role | Data location |
|---|---|---|
| Supabase (database and file host) | Hosting and storage | Outside Cameroon (cloud infrastructure) |
| SMS delivery provider | One-time codes | Cameroon |
| Licensed payment provider | Payments and escrow | Cameroon |
| Technical diagnostics tool (Sentry), where applicable | Anonymized technical metrics | Outside Cameroon (cloud infrastructure) |
DF does not sell its users' personal data.
6.3 Authorities
DF may disclose data to the competent Cameroonian authorities upon a legally founded request or requisition. Any disclosure is recorded.
Article 7 — Transfers outside Cameroon
As certain processors may host data outside Cameroon (Article 6.2), such transfers constitute cross-border transfers within the meaning of Articles 19 and 32 of Law No. 2024/017 and are subject to the prior authorization of the Data Protection Authority. DF governs these transfers through contractual commitments and appropriate security standards.
DF governs these transfers through appropriate contractual safeguards and seeks, as necessary, the authorization of the Data Protection Authority, as part of the compliance process provided for by law (deadline of 23 June 2026).
Article 8 — Rights of data subjects
In accordance with Law No. 2024/017, the user has the following rights, exercisable via the contact in Article 11.
8.1 Access and rectification
The user may obtain communication of their data and request its rectification. Most information can be modified from the settings; certain modifications (for example the phone number) require a new verification.
8.2 Objection and restriction
The user may object to processing based on legitimate interest or consent, in particular marketing communications and anti-fraud profiling (with human review in the event of a contested decision, a 14-day appeal provided for in the Terms). The objection cannot apply to processing necessary for the performance of the contract or required by law.
8.3 Erasure
The user may delete their account from the settings. The terms and timeframes are set out in Article 5. Certain data remains retained under legal obligations.
8.4 Portability
The user may export their data in a structured, machine-readable format from the application.
8.5 Withdrawal of consent
For processing based on consent (in particular marketing communications and the processing of the Facilitator's biometric data), the user may withdraw their consent at any time. Withdrawal does not affect the lawfulness of prior processing; with respect to the data necessary for identity verification, withdrawal may prevent the continuation of Facilitator activity.
8.6 Complaint
The user may lodge a complaint with the Personal Data Protection Authority.
DF responds to requests to exercise rights within 30 days, extendable once in the event of a complex request, with reasoned information.
Article 9 — Security
DF implements appropriate technical and organizational measures: encryption in transit (TLS), encryption at rest of sensitive data, strengthened authentication and logging of internal team access, the principle of least privilege, regular backups, and staff awareness.
Article 10 — Data breach
In the event of a personal data breach, DF informs the Data Protection Authority without delay after becoming aware of it and, where the breach is likely to result in a high risk to the rights and freedoms of individuals, informs the affected users without delay, in accordance with Law No. 2024/017.
Article 11 — Contact
- Personal data / exercise of rights: support@dossiersfaciles.xcales.net
- General support: +237 680 503 635 (WhatsApp), support@dossiersfaciles.xcales.net
- Complaint: Personal Data Protection Authority established by Law No. 2024/017. This authority is being set up (legal deadline of 23 June 2026); its official contact details will be specified once it is constituted.
Article 12 — Minors
The Platform is reserved for persons aged 18 or over. DF deletes without delay any account that appears to have been created by a minor.
Article 13 — Cookies and trackers
The mobile application does not use third-party cookies or advertising trackers. The internal administration interface uses essential technical cookies (authentication, CSRF protection), to the exclusion of any behavioral or advertising tracker.
Article 14 — Notices relating to application stores
In accordance with the requirements of the Apple App Store and Google Play:
- the categories of data collected are set out in Article 3;
- DF does not track its users across third-party applications or sites and does not use any advertising identifier;
- account deletion is accessible directly within the application (Profile, Settings, Privacy), in accordance with the requirements of Google Play.
Article 15 — Modification of the Policy
DF may modify this Policy to reflect legal, technical or processing developments. Any substantial modification is notified within the application at least 30 days before it takes effect.