Alkebulan Privacy Policy

1. Data controller

The controller of your data is OD CORE AFRIQUE BF SARL, which publishes and operates the platform. Tond Thinga FZE LLC is a co-holder of the rights in the platform with OD CORE AFRIQUE BF SARL.

Their legal notice:

• OD CORE AFRIQUE BF SARL, a Société à Responsabilité Limitée (limited liability company), whose registered office is at Sector 17, Section DV, Lot 10, Plot 01, Ouagadougou — BP 129, Ouagadougou, Burkina Faso, registered with the RCCM under number BF-OUA-01-2026-B13-13414, IFU (tax identification number) 00320069E.
• Tond Thinga FZE LLC, Free Zone Entity (FZE LLC), Ajman, United Arab Emirates, Registration Number 2621920983888, CWS-1V-229079, 26th Floor, Amber Gem Tower, Ajman.

2. Data we collect

We collect the data you give us and the data generated by your use of the platform:

• Account: last name, first name, e-mail address, phone number and password, which we never store in plain text; gender, date of birth, country and profile photo when you provide them; your acceptance of the Terms, of this policy and of marketing communications.
• Orders and delivery: delivery addresses, recipient, content and history of your orders, returns, disputes and delivery tracking; your location, only when you allow location access.
• Payments and BulanPay: balance and operations of your wallet, top-ups, payments, pay-in-instalments plans, the score produced by the automated assessment that determines your access to this payment method and its ceiling, payment proofs you send, and the mobile money number used.
• Identity verification for BulanPay: the identity document and the photo of yourself (selfie) you send, and the information in the file, including your nationality.
• Sellers and partners: information about the shop or the company, application file, subscription plan, catalogue, sales and payouts.
• Messages and content: messages exchanged with sellers and in the order chat, reviews, product questions, requests to customer service and messages written to the app’s assistant.
• Device and usage: device type, operating system, app version, notification token, IP address, browser, login sessions, pages and features used, technical logs and error reports.
• Camera, microphone and face recognition: after your permission, the camera and microphone are only used to take a photo (product, identity document) or to run a voice search. If you enable face recognition to log in, it stays on your device: we receive no biometric data.

3. Why we use your data

We use your data to:

• create and manage your account, log you in and secure your session;
• process your orders, payments, deliveries, returns and disputes;
• enable sellers to sell and pay them their share of sales;
• provide BulanPay: keep your wallet, verify your identity, assess your access to pay-in-instalments, and prevent fraud and money laundering;
• send you messages related to your account and your orders: confirmation codes, notifications, e-mails and SMS;
• with your consent, tell you about our offers;
• with your consent, on the web shop and the showcase website, measure the effectiveness of our advertising and choose who to show it to on Meta’s services;
• assist you when you contact our customer service;
• detect and fix errors, measure the use of the platform to improve it, and prevent abuse;
• comply with our legal obligations and respond to requests from authorised authorities.

4. Legal bases

Each processing operation relies on one of the following bases:

• performance of the contract formed by the Terms: account, orders, payments, delivery, seller space and assistance;
• compliance with legal obligations: identity verification, prevention of fraud and money laundering, accounting, responses to authorities;
• our legitimate interest in securing and improving the platform: technical logs, error tracking, prevention of abuse;
• your consent: marketing communications, location, camera, microphone and notifications, as well as Meta’s advertising pixel on the web shop and the showcase website. You can withdraw it at any time, by writing to us, in your device settings or, for the pixel, through the “Manage cookies” link at the bottom of the page, without affecting what has already been done.

5. Who receives your data

Your data is only accessible to the people who need it, and we do not sell it. It is passed on:

• to the seller concerned: the order information needed to prepare it;
• to the partner delivery companies of your country and their couriers, or to the freight forwarder of an international shipment: your name, your delivery address, your phone number and the parcel information;
• to other users: the reviews and comments you publish;
• to authorised members of our team — customer service, operations, finance, administration —, according to their role;
• to our processors, only for the tasks described below;
• to administrative or judicial authorities, when the law requires it.

6. Our processors

We use the following providers, which process data on our behalf:

• Hostinger International Ltd: hosting of our servers, the database and private documents (identity documents, payment proofs).
• Amazon Web Services: storage of images published on the platform, such as product photos and photos attached to reviews.
• Cloudflare (R2 service): storage of the encrypted backups of the database and files, private documents included.
• Senfenico: processing of mobile money payments and top-ups.
• Resend: sending e-mails, including login codes and notifications.
• SMSBUS: sending SMS confirmation codes. The provider that sends an SMS, SMSBUS or Twilio, depends on the country of the phone number.
• Twilio Inc. (United States): sending SMS confirmation codes. Twilio only receives the phone number, the message text or the code, the language of the message and, for a code, whether it was validated or cancelled.
• Expo: routing notifications to your phone, through Apple’s or Google’s notification service depending on your device.
• Google: the fonts of the showcase website (Google Fonts), which your browser loads by sending your IP address to Google.
• Meta Platforms Ireland Limited (Ireland): the advertising pixel of the web shop and the showcase website, loaded only with your consent, which measures the effectiveness of our advertising and makes it possible to choose who to show it to. Meta also uses this data on its own behalf, under its own privacy policy.
• Sentry: tracking errors in the app and on the servers. An error report contains technical information and, in the app, the identifier, e-mail address and name of your account.

7. Transfers outside Africa

Some of these providers are established or process data outside Africa: transfers outside Africa may therefore take place, including to the United States, where error reports sent to Sentry and SMS codes sent through Twilio are processed. With your consent, the data from Meta’s advertising pixel is received by Meta Platforms Ireland Limited, which may transfer it to Meta Platforms, Inc., in the United States. Backups are stored by Cloudflare in the European Union, after being encrypted on our servers.

These transfers only take place for the tasks described above, in compliance with the regulations applicable to the protection of personal data.

8. Retention period

We keep your data for as long as your account exists, and then for the applicable legal period.

When you delete your account, the data linked to your orders is anonymised. Data that the law requires us to keep, in particular data on payment operations and identity verification, is kept for the applicable legal period, and then deleted or anonymised.

Our encrypted backups are renewed over time: erased data disappears from them when they are renewed.

9. Your rights

To exercise your rights, write to us at alkebulan@dawngroup.shop. We may ask you to prove your identity before replying.

Under the conditions set by the regulations applicable to the protection of personal data, you can:

• access your data and obtain a copy of it;
• have inaccurate or incomplete data corrected; most of it can be changed directly in your profile;
• request the erasure of your data; you can also delete your account from the app settings;
• receive your data in a structured, machine-readable format, on written request to alkebulan@dawngroup.shop;
• ask a member of our team to review the automated assessment of your access to pay-in-instalments, by writing to alkebulan@dawngroup.shop;
• object to processing based on our legitimate interest, or request its restriction;
• withdraw your consent at any time, in particular to marketing communications and to Meta’s advertising pixel;
• lodge a complaint with the personal data protection authority competent in your country.

10. Security

We protect your data with appropriate technical and organisational measures: encrypted connections, passwords never stored in plain text, protected login sessions, a PIN and single-use confirmation codes for the wallet, staff access limited by role and logged, encrypted technical secrets, and encrypted backups outside our servers.

No system is infallible. In the event of a data breach likely to expose you to a risk, we will inform you, and the competent authority where the regulations require it.

11. Minors

You must be at least 13 years old to create an account, and at least 18 to use BulanPay. We do not knowingly collect data about a child under 13.

If you believe a child under 13 has given us data, write to us: we will close their account.

12. Cookies and local storage

Apart from Meta’s advertising pixel, loaded only with your consent and described in the next section, we use no advertising cookies and no third-party audience measurement tools. You can erase the data below from your browser or device settings; some features, such as login, will then stop working.

Our other storage is only the storage needed for the platform to work:

• on the web, secure login cookies, inaccessible to the page’s scripts, which keep your session;
• in the app and the web shop, the local storage of your device or browser, which keeps your profile, your cart, your addresses, your country and your display and notification preferences; your session is kept in your phone’s secure storage or, on the web, in the tab storage, erased when the tab is closed;
• on the showcase website, local storage, which remembers the language chosen, and tab storage, which keeps the draft of a partner application until it is sent or the tab is closed; this draft expires on its own;
• on the web shop and the showcase website, your browser’s local storage, shared by both sites, which keeps your choice about Meta’s advertising pixel, accepted or refused, and its date; this choice is valid for six months, after which we ask you again;
• visits to the showcase website are measured by a simple page-view counter, which records no data that could identify you.

13. Meta advertising pixel

On the web shop and the showcase website, and only if you accept it, we use the Meta pixel, an advertising tool provided by Meta Platforms Ireland Limited. It is used neither in the mobile app nor in the seller and partner space. On the partner application form page of the showcase website, it is neither loaded nor active, even with your consent.

The pixel is only loaded after your consent. A banner asks for it: you can accept or refuse, as easily one as the other. Your choice applies to both sites; your browser remembers it for six months, after which you are asked again. As long as you have not accepted, nothing is sent to Meta.

With your consent, the pixel sends Meta: the viewing of a page; the addition of a product to the cart, with its amount, its currency and the product identifier; a purchase, with its amount, its currency and the order identifier. Meta also receives the address of the page viewed, your IP address and the technical information of your browser. We pass on to Meta neither your name, nor your e-mail address, nor your phone number.

The pixel places its own cookies in your browser, in particular the “_fbp” cookie, which lets Meta recognise your browser from one visit to the next and for which Meta states a duration of 90 days. If you have a Facebook or Instagram account, Meta may link this data to your account.

This data is used to measure the effectiveness of our advertising and to choose who to show it to on Meta’s services. This processing is based on your consent. Meta also uses this data on its own behalf, under its own privacy policy, and Meta Platforms Ireland Limited may transfer it to Meta Platforms, Inc., in the United States.

You can withdraw your consent at any time through the “Manage cookies” link at the bottom of the pages of the web shop and the showcase website: from the moment you withdraw it, nothing more is sent to Meta. Withdrawal does not undo what Meta has already received; you can erase the cookies already placed from your browser settings.

14. Changes to this policy

This policy carries a version number and an effective date. We update it before any change to our processing, for example when a new service opens or a new provider is added.

In the event of a significant change, we inform you through the app or by e-mail, and we ask for your consent where the regulations require it.

15. Contact

For any question about your data or to exercise your rights: alkebulan@dawngroup.shop.

By post: OD CORE AFRIQUE BF SARL, Sector 17, Section DV, Lot 10, Plot 01, Ouagadougou — BP 129, Ouagadougou, Burkina Faso.