PREAMBLE

This policy reflects the commitments made and implemented by DC/BR in the context of its activities for the responsible use of partners' and users' information. It is governed by Law No. 2013-450 of June 13, 2020 on the protection of personal data.

I. PRINCIPLES OF INFORMATION COLLECTION

1. Types of Information

As part of DC/BR's services, the following data is collected:

• Personal identification data
• Professional life data
• Location data
• Phone number
• Mobile data
• Image

​    2. ​​​​Purpose of Collection

DC/BR commits to using the personal information collected in the course of its activities solely for the purposes of their management and to comply with legal and regulatory obligations.

It further commits to ensuring their confidentiality in accordance with the rules set out by Law No. 2013-450 of June 19, 2013 on the protection of personal data.

The collection and processing carried out are intended, in particular, for the management of users' financial activities, the establishment of proof of transactions and agreements, user relationship management, risk management, fraud prevention, management of payment incidents, prospecting and conducting commercial promotions, statistical and asset studies, and compliance with legal and regulatory obligations — notably regarding operational risk management, anti-money laundering, counter-terrorism financing, prevention of the proliferation of weapons of mass destruction, and the specific processing of any incident, false or irregular declaration aimed at preventing fraud, or any other purpose related to DC/BR's activities.

II. CONFIDENTIALITY COMMITMENT

1. Information Security

DC/BR implements organizational, software, legal, technical, and physical means to ensure the confidentiality and security of your personal data. These measures guarantee the availability, confidentiality, and integrity of your data.

Access to your personal data is strictly limited to authorized employees and agents, who are bound by a confidentiality obligation. However, the collected data may be shared with subcontractors contractually responsible for carrying out tasks necessary for the proper functioning of services and the effective management of your relationship with DC/BR.

It is important to note that, in the performance of their services, subcontractors have only limited access to your data and are contractually obligated to use it in compliance with applicable personal data protection legislation.

A permanent and ongoing intrusion testing and alert program is conducted to ensure the reliability of personal data protection measures at the relevant service levels.

2. Data Retention Period

Retention periods vary depending on the nature of the data, the purpose of processing, or legal and regulatory requirements.

In accordance with personal data protection law, data retention is governed by a principle of useful retention. Therefore, this information should "be kept for a period that does not exceed the time necessary for the purposes for which it was collected."

3. Data Transfer

Your data is not transferred outside the WAEMU zone. Should this occur, your data will be transferred in strict compliance with applicable regulations.

Any transfer outside the registered country of the head office would occur strictly to the extent necessary for the proper functioning of the service. Such transfer will be made to a country whose personal data protection legislation has been recognized as providing a level of protection equivalent to the Ivorian law on personal data protection.

4. Disclosure of Personal Data

Your personal data may be shared with DC/BR's internal entities for purposes such as improvement, monitoring, statistics, or risk management, based on compliance with legal and regulatory obligations or legitimate interests such as fraud prevention or securing the network or information system.

In order to fulfill certain purposes mentioned in this Policy, DC/BR may (on a non-systematic basis) share your personal data with:

• Service providers who provide services on its behalf;
• Financial, tax, administrative, criminal, judicial, local or foreign authorities, arbitrators or mediators, law enforcement authorities, government agencies or public bodies to which DC/BR or any DC/BR member is required to disclose data;
• Certain regulated professions such as lawyers, notaries, and auditors, when specific circumstances require it (litigation, audit, etc.).

III. RIGHTS OF INDIVIDUALS

DC/BR's Rights

DC/BR has the right to use all user information within the strict scope of its activity. It may not use this data for other needs or purposes without the user's express authorization.

However, DC/BR cannot be held responsible for the reliability of personal data relating to third parties transmitted by the user. Likewise, it cannot be held responsible for personal data transmitted by the user in the course of using the service, namely personal data contained in documents saved by the user.

Customers' Rights

In accordance with the law, you may exercise your rights with all DC/BR entities that process your data. These rights are as follows:

• Right of access: You may at any time obtain information regarding the processing of your personal data as well as a copy thereof;
• Right of rectification: If you believe that your personal data is inaccurate or incomplete, you may request that it be amended accordingly;
• Right to erasure: You may request the deletion of your personal data, to the extent permitted by law;
• Right to restriction of processing: You may request the restriction of the processing of your personal data;
• Right to object: You may object to the processing of your personal data for reasons relating to your particular situation. You also have the absolute right to object at any time to your data being used for commercial prospecting purposes or for profiling purposes, where such profiling is linked to commercial prospecting;
• Right to withdraw consent: If you have given your consent to the processing of your personal data, you may withdraw it at any time;
• Right to data portability: Where permitted by law, you may request the return of personal data you have provided or, where technically feasible, its transfer to a third party.

In order to exercise your rights, you must specify your last name, first name, email address, and user ID. You must attach to the request any element that allows your identity to be verified with certainty.