Privacy policy

1. Identity of the data controller

Cartflox, published by Aurabana, is the controller of your personal data.

Contact details:
• Company name: Aurabana
• Address: Abidjan, Côte d'Ivoire
• Contact: https://cartflox.com/en/contact
• Phone: +225 07 03 32 46 74

2. Data collected

We collect the following data when you use the Cartflox platform:

• Identification data: full name, email address, phone number
• Payment data: mobile money numbers (processed securely, never stored in plain text)
• Browsing data: IP address, browser type, pages visited, session duration
• Business data: company name, SIRET/RCCM registration number, industry
• Transaction data: payment history, amounts, currencies, statuses

Bank card data is never stored on our servers and is processed directly by our PCI DSS certified partners.

3. Purposes of processing

Your data is collected and processed for the following purposes:

• Providing the payment service and managing your merchant account
• Preventing fraud and financial crime (legal obligations)
• Compliance with applicable WAEMU (UEMOA), BCEAO and local regulations
• Communications about your account (transaction notifications, security alerts)
• Improving our services and personalising the user experience
• Accounting and tax obligations
• Marketing and commercial communications (with your explicit consent)

4. Legal basis for processing

Each processing activity relies on a legal basis:

• Performance of the contract: processing necessary to provide the service
• Legal obligation: processing required by financial regulation (KYC/AML)
• Legitimate interest: fraud prevention, platform security
• Consent: marketing communications (can be withdrawn at any time)

5. Data retention

Your data is kept for the following periods:

• Active account data: for the entire duration of the contractual relationship
• Transaction data: 10 years (financial regulatory obligation)
• Login logs: 12 months
• Marketing data: 3 years after the last active contact
• KYC data: 5 years after the end of the relationship (AML/CFT obligation)

Once these periods expire, your data is deleted or anonymised.

6. Data recipients

Your data may be shared with:

• Our payment processing providers (Orange Money, Wave, MTN MoMo, Airtel Money, etc.)
• Our hosting providers and technical partners (bound by compliant data processing agreements)
• Competent authorities upon lawful request (BCEAO, Ministry of Finance, etc.)
• Our audit and compliance partners

We never sell your personal data to third parties for commercial purposes.

7. Your rights

Under the applicable regulations, you have the following rights:

• Right of access: obtain a copy of your personal data
• Right to rectification: correct inaccurate data
• Right to erasure: request the deletion of your data (subject to legal obligations)
• Right to restriction: limit how your data is used
• Right to portability: receive your data in a structured format
• Right to object: object to certain processing activities
• Right to withdraw your consent at any time

To exercise your rights, contact us via https://cartflox.com/en/contact
We undertake to respond within 30 days.

8. Data security

We implement robust technical and organisational measures:

• 256-bit SSL/TLS encryption for all transmissions
• AES-256 encryption of sensitive data at rest
• PCI DSS Level 1 compliance
• Two-factor authentication (2FA) for merchant accounts
• Regular security audits by independent third parties
• Incident management policy and notification within 72 hours in the event of a breach

9. Cookies and trackers

Cartflox uses cookies that are essential to the operation of the service (session, security) and analytics cookies (with your consent). See our Cookie policy for more details.

10. International transfers

Some of our providers may be established outside Côte d'Ivoire. In that case, we make sure appropriate safeguards are in place (standard contractual clauses, recognised certifications) to protect your data during these transfers.

11. Changes

We may update this policy at any time. You will be informed by email or by a notification on the platform in the event of a substantial change. The date of the last update is shown at the bottom of the page.

12. Contact and complaints

For any question about the protection of your data:

Contact: https://cartflox.com/en/contact
Phone: +225 07 03 32 46 74
Address: Abidjan, Côte d'Ivoire

You also have the right to lodge a complaint with the data protection authority applicable in your country of residence.