Générale CIThis policy explains exactly what Générale CI does with your data. It is written in
application of Ivorian Law No. 2013-450 of 19 June 2013 on the protection of personal
data, whose article 28 requires that you be informed at the point of collection.
It describes the service as it actually works. Where a feature exists but is **not yet
switched on**, we say so rather than let you believe otherwise.
Who is responsible for your data
The data controller is ETS APAMA (ÉTABLISSEMENT APAMA), Sole proprietorship (individual trader registered in her own name), trade
register (RCCM) No. CI-ABJ-02-2007-A10-01226, Yopougon Niangon Cité Marine, Abidjan, Côte d'Ivoire.
Contact for any question or to exercise your rights:
ETS APAMA undertakes to complete the prior formalities required by articles 5 to 7 of Law No. 2013-450 with ARTCI, and to publish the reference of the certificate on this page as soon as it is issued.
The data we collect
We collect only what is needed to run the service (article 16: data must be *adequate,
relevant and not excessive*).
To create and maintain your account
- Your phone number — this is your identifier: without it, no order can be delivered to
you and no payment attached to you.
- Your name, your password (stored in hashed form, never in clear text), your profile
picture if you add one.
- Your chosen language and display preferences.
- The date on which you accepted our terms, and the version accepted.
To deliver to you
- Your delivery addresses, the commune, and the GPS coordinates of the delivery point.
- Your orders: items, amounts, payment method, status, history.
- Proof of delivery: the confirmation code and, where applicable, a photograph taken by
the courier. In the event of a refusal or a return, the photograph and the reason entered by
the courier.
If you are a courier, we additionally process your real-time GPS position while you
are on duty (and only then), your assignments, and your safety alerts (SOS) with the
associated position.
For your payments
- The payment method chosen, the amount, the transaction status, the payment session
reference.
- Your Wave number when you request a withdrawal.
- Your Générale CI wallet: credits, promotional codes used, referrals, affiliate earnings.
We never see your Wave secret code, and we store no bank card data. Payment takes place at
Wave, not with us.
What you publish
Short videos, comments, live chat messages, reviews and ratings, photographs of your items if
you are a seller. This content is public by nature: it is visible to other users.
If you sell
- Your shop information: name, logo, cover image, description, opening hours.
- For identity verification: the identity documents you upload (front/back, or a PDF
document). They serve only to verify that you are who you say you are before we let you
collect money.
- Your sales, your balance, your withdrawal requests, your invoices.
Identity documents are the most sensitive data we hold. They can be consulted only by the
staff responsible for verification, are never published, never passed to another user, and
are destroyed according to the schedule set out below.
How you use the application
- Your searches (including photographs sent for an image search), the items viewed,
favourited or added to the basket.
- Your exchanges with the assistant: the text, image or voice recording you send it.
- Technical logs: date and time of requests, IP address, device type, application version,
errors encountered.
- Your notification token (provided by Apple or Google), which allows a notification to be
sent to your device without ever revealing your identity with them to us.
What we do not collect
We collect no sensitive data within the meaning of article 21 of the Law: racial or ethnic
origin, political opinions, religious or philosophical beliefs, trade union membership, sexual
life, genetic or health data. Collecting such data is in fact a criminal offence. **Do not
publish such information** in your listings, your reviews or your videos.
Nor do we collect your contacts, your calendar, or your location while the application is
closed — except for couriers on duty, who are informed of this and switch themselves online.
Why we use them, and on what basis
Article 14 of the Law sets consent as the principle, with exceptions including performance
of the contract to which you are a party.
| What we do | Why | Basis (art. 14) |
|---|---|---|
| Create your account, sign you in | Identify you reliably | Performance of the contract |
| Process and deliver your orders | This is the very purpose of the service | Performance of the contract |
| Collect payment and issue refunds | Pay the seller, refund you | Performance of the contract |
| Verify sellers' identity | Protect buyers from fraud | Legal obligation and legitimate interest |
| Notifications about your orders | Tell you about an event concerning you | Performance of the contract |
| Engagement notifications (new items, live sales) | Bring you back to the service | Consent, revocable at any time |
| Commercial and promotional messages | Offer you deals | Prior consent (art. 22) |
| Recommendations and item ranking | Show you what interests you | Legitimate interest |
| Assistant and image search | Help you find a product | Performance of the contract, at your request |
| Security, fraud and abuse prevention | Protect the service and its users | Legitimate interest |
| Audience statistics | Improve the service | Consent (see trackers) |
Commercial prospecting: your agreement comes first. Article 22 of Law No. 2013-450
prohibits direct prospecting aimed at a person who has not consented to it beforehand,
and punishes it by one to five years' imprisonment and a fine of 1,000,000 to 10,000,000
FCFA. You may refuse commercial messages at any time under Profile → Notifications, free
of charge (art. 30), without this degrading the rest of the service in any way. Messages
relating to your orders are not prospecting: they continue to be sent.
Automated decisions
Item ranking and recommendations are computed automatically. They have no legal effect on
you. In accordance with article 25 of the Law, no decision producing an effect on you —
refusal of sale, blocking, sanction — is taken solely on the basis of automated processing: a
human being is always involved.
How long we keep them
Article 16 prohibits keeping data longer than necessary. Here are our retention periods, and
the reason for each.
| Data | Period | Why this period |
|---|---|---|
| Account and profile | For the life of the account, then erased or anonymised within 30 days | Beyond that, no purpose remains |
| Orders, payments, invoices | 10 years | Accounting and tax obligations |
| Delivery addresses | Life of the account, or until you delete them | You reuse them from one order to the next |
| Identity documents (seller verification) | Destroyed 90 days after the decision; only the decision and its date are kept | The document serves no purpose once verification is done |
| Proof of delivery and return (photo, code) | 24 months | Covers the period during which a dispute may arise |
| Couriers' GPS position | 90 days | To reconstruct a contested assignment |
| Safety alerts (SOS) | 5 years | These may involve an accident at work |
| Published content (videos, reviews, comments) | Until deleted by you or by moderation | This is your material |
| Search and browsing history | 24 months | Beyond that, worthless for recommendation |
| Exchanges with the assistant | 12 months | Keeping the thread of a conversation, correcting errors |
| Technical and connection logs | 12 months | Security and incident investigation |
| Notification tokens | Until revoked, or 12 months unused | An unused token is a dead token |
| Refusal of prospecting | No limit | We must remember that you said no |
Some data outlives the deletion of your account where the law requires it (article 35): this is
the case for accounting records. The detail is set out on the
delete my account page.
Who receives your data
We never sell your data. It is passed on only to those who must receive it for the service
to work.
Other users
- The seller of an item you order receives your name, your phone number and your delivery
address — without which they can neither prepare nor arrange delivery of your parcel.
- The courier assigned to your delivery receives your name, your phone number and the
address.
- Your public content (reviews, videos, comments) is visible to everyone.
Our service providers
| Provider | What it does | What it receives | Where |
|---|---|---|---|
| Wave | Payments and payouts | Amount, reference, phone number | Côte d'Ivoire |
| Google / Firebase | Verification SMS, Android notifications | Phone number, device token | Outside CI |
| Apple | iOS notifications | Device token | Outside CI |
| Expo | Notification delivery | Device token, notification content | Outside CI |
| OpenAI | Assistant, image description | Your message, the image or audio sent | Outside CI |
| Gcore | Delivery of photos and videos | IP address, file requested | Worldwide network |
| HostHatch | Hosting of the service | All of the data | London, United Kingdom |
| Delivery partner | Carrying out deliveries | Name, phone number, address | Côte d'Ivoire |
The authorities
Upon a duly issued judicial request, or to report an offence of which we become aware.
Transfers outside Côte d'Ivoire
We must be clear about this. The server hosting Générale CI is located in
London, United Kingdom, and several of our providers (Google, Apple, OpenAI, Expo,
Gcore) process data outside Ivorian territory. Your data therefore leaves Côte d'Ivoire.
Article 1 of the Law defines a third country as any State that is not a member of ECOWAS: the
United Kingdom and the United States are such countries. Article 26 makes such a transfer
subject to two conditions: that the destination country ensures a sufficient or equivalent
level of protection, and that the data controller obtains the prior authorisation of the
data protection authority. Article 7 likewise lists such transfers among the processing
operations subject to authorisation.
ETS APAMA undertakes to complete the prior formalities required by articles 5 to 7 of Law No. 2013-450 with ARTCI, and to publish the reference of the certificate on this page as soon as it is issued. We will publish the reference obtained here.
What we do in the meantime to protect you: encryption of exchanges between your device and our
servers, access restricted to those who need it, minimisation of what is sent to each provider,
and encryption of the most sensitive data.
Your rights
Law No. 2013-450 grants you rights which we honour free of charge.
- To be informed (art. 28) — that is the purpose of this page.
- To access your data and know where it comes from (art. 29).
- To rectify anything inaccurate, incomplete or out of date (art. 31).
- To object to processing on legitimate grounds, and without having to give reasons
where prospecting is concerned (art. 30).
- To obtain erasure of your data and the cessation of its dissemination — the right to
digital oblivion (arts. 33 to 36). See delete my account.
- To retrieve your data in a structured, commonly used format, so as to transfer it
elsewhere (art. 38).
- Not to be subject to a purely automated decision evaluating you (art. 25).
How to exercise them
Write to info@generale-ci.com stating your request
and the phone number of your account. We may ask you to prove your identity — this protects you
against someone impersonating you.
We reply within 30 days. If we cannot act on your request, we tell you why. Requests that
are manifestly abusive by their number or repetitive character may be refused; in that case, it
is for us to demonstrate that abuse (art. 29).
If you are not satisfied
You may refer the matter to the Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI), the authority entrusted by Law No. 2013-450 with the duties of the personal data protection authority, which receives complaints, holds
investigative powers and may order the rectification, erasure or blocking of data processed in
breach of the Law.
Security
We take the measures required by articles 39 to 41: server access by cryptographic key only,
encrypted connections (HTTPS/TLS) across the whole service, passwords stored as a
non-reversible hash, digital product codes encrypted in the database, access partitioned
according to each person's role, and automatic blocking of repeated sign-in attempts.
No system is infallible. Should a breach of your data occur, we would inform you and the data
protection authority.
Minors
Générale CI is not intended for persons under 18 (Ivorian law treats as a minor any person
under eighteen). We do not knowingly collect their data. If you find that an account belongs to
a minor, write to us: we will close it and erase the associated data.
Advertising and audience measurement
Générale CI provides for advertising tools — catalogue feeds, measurement tags on sharing pages,
and transmission of conversion events to ad networks.
These tools are currently inactive. No third-party advertising tag is set and no event is
transmitted to an ad network unless and until you have given explicit agreement. How this is
intended to work, and what you would be consenting to, is described in our
Changes
This policy carries a version number and an effective date, both shown at the top of
the page. In the event of a significant change, we inform you in the application before it
takes effect. Successive versions remain available for consultation: we must be able to prove
which version you accepted, and you must be able to check it.