Privacy Policy

1. INTRODUCTION

SEBPAY AFRICA ("SEBPAY," "we") is committed to ensuring a high level of protection for personal data in accordance with international data protection standards, including in particular the principles of the GDPR, as well as the regulatory requirements applicable to financial services in Africa.

This policy is intended to provide transparent information about the data processing carried out as part of our services.

2. ROLE AND RESPONSIBILITY

SEBPAY AFRICA acts as:

• Data controller for user data
• Data processor for certain data processed on behalf of merchants

SEBPAY does not act as a depositary financial institution. SEBPAY acts as a technical entity subject to due-diligence obligations through its partners.

3. CATEGORIES OF DATA PROCESSED

3.1 Identification data (KYC)

• Last name, first name
• Phone number
• Email address
• Proof of identity
• Photo / biometrics

3.2 Business data (KYB)

• Company name
• Legal documents
• Ultimate beneficial owners (UBO)
• Directors

3.3 Financial data

• Transaction history
• Payment identifiers
• Mobile Money wallets
• IBAN or associated accounts

3.4 Technical and security data

• IP address
• Access logs
• Device used
• Connection data
• Approximate geolocation

3.5 Behavioral data

• Transaction analysis
• Risk scoring
• Anti-fraud models

4. PURPOSES OF PROCESSING

Data is processed for:

• provision of payment services
• identity verification (KYC/KYB)
• fraud prevention
• AML/CFT compliance
• management of disputes and chargebacks
• service improvement
• regulatory obligations

5. LEGAL BASES

Each processing activity relies on:

• performance of a contract
• legal obligations (AML/CFT)
• legitimate interest (security, fraud)
• consent (cookies, marketing where applicable)

6. DATA SHARING

Data may be shared with:

• partner banks
• payment partners
• Mobile Money operators
• KYC/AML providers
• cloud providers (AWS, etc.)
• regulatory authorities

No data is ever sold.

7. INTERNATIONAL TRANSFERS

Data may be transferred outside the country of residence to jurisdictions offering an adequate level of protection.

Safeguards are put in place:

• standard contractual clauses
• encryption
• access restrictions

8. DATA RETENTION

Retention periods:

• KYC data: up to 10 years
• transaction data: 5 to 10 years
• technical logs: 12 to 24 months

These periods may be extended in the event of a legal obligation or dispute.

9. DATA SECURITY

SEBPAY applies high standards:

• TLS/SSL encryption
• secure storage
• strict access control (RBAC)
• multi-factor authentication
• real-time monitoring
• regular audits

10. FRAUD DETECTION AND AUTOMATED DECISIONS

SEBPAY uses automated systems to:

• score risk
• detect anomalies
• block transactions

These decisions may be made without human intervention and may result in: transaction refusal, account suspension, or freezing of funds.

11. USER RIGHTS

Users have the following rights:

• right of access
• right to rectification
• right to erasure
• right to object
• right to restriction
• right to data portability

Certain requests may be refused for legal reasons (AML/CFT).

12. DATA PROTECTION OFFICER (DPO)

SEBPAY may appoint a DPO responsible for:

• overseeing compliance
• handling user requests
• liaising with the authorities

DPO contact: dpo@sebpay.africa

13. SUBPROCESSORS

SEBPAY uses subprocessors for:

• hosting
• KYC
• security

These subprocessors are contractually bound by strict obligations.

14. DATA BREACH

In the event of a data breach:

• notification to the competent authorities
• notification to users where necessary
• immediate remedial measures

15. COOKIES AND TRACKERS

Cookies are used for:

• technical operation
• security
• analytics

Users can configure their preferences.

16. LOGGING AND TRACEABILITY

SEBPAY retains logs for:

• internal audit
• regulatory compliance
• anti-fraud investigations

17. API AND DATA SHARING

Merchants using the API must:

• protect customer data
• not use data outside the legal framework
• comply with security standards

SEBPAY may suspend API access in the event of non-compliance.

18. MINORS

The services are strictly prohibited to minors.

19. CHANGES TO THIS POLICY

SEBPAY may amend this policy at any time. Notice will be provided where necessary.