Privacy Policy

This English version is a translation provided for convenience. The policy is written in French, and the French version prevails in case of any difference between the two.

This policy explains which personal data Nkap Express processes when you use the platform, why, who it is shared with, how long it is kept and how to exercise your rights. It is addressed to the members of the platform. It supplements the terms of use.

It applies Cameroonian Law No. 2024/017 of 23 December 2024 on the protection of personal data and Law No. 2010/012 of 21 December 2010 on cybersecurity and cybercrime. If you are in the European Union (for example in France or Belgium), the General Data Protection Regulation (GDPR) also applies.

1. In short #

• We collect what is needed to open your account, verify your identity, carry out your exchanges and comply with the law.
• We do not sell your data. We do no advertising and no tracking, and only measure the site audience with your consent (section 10).
• The other member of an exchange sees your public profile and, if you are the one receiving the Western payment, your receiving details. They never see your account email or phone number, or your ID document.
• The law requires us to keep some data for several years after your account is closed (anti-money laundering, accounting).
• For any question or request about your data: contact@nkap-express.com.

2. Data controller and contact #

The data controller is KB Corporation, which operates Nkap Express.

For any question about your data, to exercise your rights or to report a problem, write to contact@nkap-express.com. We have not appointed a data protection officer: this address is the single point of contact.

3. Data we collect #

Ads and offers contain no free text, and there is no messaging between members. The only free text you can write on the platform is in a dispute (description, notes). The data we process is listed below.

3.1 Sign-up and account #

• Email address, password (we only keep a hash of it, never the password itself), display name, country of residence (optional).
• The languages on your profile (French by default) and, if you sign up with Google, the address of your Google profile photo.
• Your account status and your verification level.
• Sign-in methods linked to your account and the date your email was verified.
• Your preferences: notifications by event and by channel, members you have blocked.
• If you turn on two-factor authentication: the secret of your authenticator app (encrypted) and the date it was turned on.

Sign-in by phone and WhatsApp messages are not active. We will update this policy before opening them.

3.2 Signing in with Google #

If you choose to sign in with Google, we ask Google for access to your basic identity (“openid email profile”). Google sends us:

• your Google identifier;
• your email address and whether or not it is verified;
• your name;
• the address of your Google profile photo.

We receive neither your Google password, nor your contacts, nor any other data from your Google account.

3.3 Identity verification #

To publish an ad or answer one, you must have your identity verified. We collect:

• the issuing country and the type of your ID document;
• its number (encrypted);
• an image (photo or PDF) of the front, of the back if you add it, and a photo of yourself (selfie);
• the date of submission, the member of our team who reviewed the file, the date and the decision, with the reason in case of refusal.

Verification is done by a member of our team, not by recognition software. The information visible on your document, including your date of birth, is therefore seen by that person.

3.4 Payment accounts #

To send or receive money, you save payment accounts. Depending on the method chosen, we collect:

These details are encrypted. We never store a bank card number. When you delete a payment account, it is no longer displayed or used, but we keep it for the period set out in section 7, as it may be linked to past operations.

3.5 Exchanges, wallet and disputes #

• Ads and offers: direction of the exchange, countries, amounts, validity period, payment methods.
• Transactions: parties, reference, amounts, rate, fees, statuses and history, reason for cancellation.
• Western receiving details of the person receiving the Western payment: copied and encrypted into the transaction when the agreement is reached.
• Payments: tranches, references and statuses sent by the payment providers, and the network agent who handled the tranche, where applicable.
• Proofs of payment you upload: the file, its name, its type and its size.
• Nkap wallet and withdrawals: balances, movements, withdrawal requests and their outcome, your answer when an agent has paid you a withdrawal (received or contested).
• Ratings: the rating from 1 to 5 that you give or receive after a closed exchange.
• Disputes: reason, description, notes and files uploaded by the parties and by our team, decision, appeal.
• Messages from support and internal notes from our team about your account, for example during a dispute or a verification.

3.6 Security and logging #

• Sessions: IP address, browser (user agent), dates of creation, last use, expiry and revocation. We only keep a hash of the session token.
• Date of last sign-in.
• Audit log: successful sign-ins, failed attempts (with the email address entered), sensitive actions (identity verification, decisions, suspensions…), with the IP address and the browser.
• Verification codes sent by email: we only keep a hash of them and the number of attempts.
• Server technical logs: request method and address, IP address.

3.7 Notifications and device #

• Notifications: title, text, link and data of each notification shown in the app and sent by email or push notification.
• Push subscription: if you allow notifications in your browser, the subscription address provided by your browser’s push service and its technical keys.
• Storage on your device: see section 10.

4. Why we use it #

For members located outside the European Union, this processing rests on the same grounds, under the conditions laid down by Cameroonian Law No. 2024/017 of 23 December 2024 on the protection of personal data.

We do not use your data for advertising or for commercial profiling. Limits, deadlines and automatic cancellations apply according to fixed rules known in advance. Identity verification, suspensions and dispute decisions are made by a member of our team.

5. Who has access to it #

5.1 The public and other members #

Your public profile is visible to everyone, even without an account:

• display name, profile photo, country, languages;
• verification level and “Verified” badge, sign-up date;
• reputation: number of closed exchanges, dispute rate, average Western payment time, average rating, number of ratings.

Your ads show your display name, your photo, your badge, your number of exchanges and your average rating. The ratings you leave appear with your display name.

5.2 The other member of an exchange #

During the negotiation, the other member sees your display name and the terms you offer.

After the agreement, the other member also sees:

• the amount and status of your payment tranches;
• the Western receiving details of the person receiving the Western payment (for example account holder and IBAN, or Interac address). If that is you, the other member needs them to pay you;
• the proofs of payment uploaded to the transaction. On your screenshots, hide anything that is not needed for the payment.

They never see your account email or phone number, your ID document, or the technical details of your payments (provider references, instructions, failure reasons, origin of funds).

5.3 Network agents #

If a payment or a withdrawal goes through an agent of the Nkap Express network:

• until the task is taken, agents only see the reference, the payment method, the amount and the date, with nothing that identifies you;
• the agent who takes the task sees your display name and the details of the payment account concerned (for example your mobile money number), as well as your answer (received or contested). Their first viewing is recorded;
• once the task is finished, they only see your first name and initials, and masked details.

Agents never see your email, your profile phone number or your ID document.

5.4 Our team #

Our staff access data according to their role (support, management, administration):

• in the internal tool, email, phone number and account details are masked by default;
• only administrators can see this data in full. To display your email, your phone number, the number of your document or the details of an agent task, they must give a reason, and this display is recorded;
• identity documents open through links valid for five minutes, and each viewing is recorded;
• an export of the member list requires approval by a second person, unless it is made by a super-administrator. Each export is recorded.

5.5 Payment providers #

Funds are collected and held through partner payment service providers (mobile money operators, payment aggregators) and, where applicable, the agent network. To carry out a payment or a withdrawal, we send the provider concerned what it needs: mobile money number, amount, currency, operation reference and, for a withdrawal, the operator. These providers process this data under their own legal obligations.

5.6 Mailtrap (sending emails) #

Our emails (verification codes, notifications) are sent by the Mailtrap service. It receives your email address and the subject and text of the message. Notifications are only sent to a verified address.

5.7 Google #

• If you sign in with Google, Google knows that you use Nkap Express and sends us the data listed in section 3.2.
• If your profile photo comes from Google, it is loaded from Google’s servers by the browser of each person who sees it. Google then receives that person’s IP address.

5.8 Browser push services #

A push notification goes through the service of your browser’s publisher (for example Google, Mozilla, Apple or Microsoft). It receives your subscription address and the title, text and link of the notification.

5.9 Our hosting providers #

Our servers and files are hosted by technical providers, in Cameroon and in other countries. They store the data on our behalf and may not use it for their own purposes.

5.10 The authorities #

We disclose data to judicial, administrative or financial authorities (including the competent financial intelligence unit) when the law requires us to or upon a lawful request. We only pass on what is requested and justified.

5.11 What we do not do #

We neither sell nor rent your data. We do not share it with any advertiser. We do not use any advertising or tracking tool; audience measurement, with Google Analytics, only happens with your consent (section 10).

6. Transfers outside Cameroon #

Your data may be processed outside Cameroon:

• our hosting providers are located in Cameroon and in other countries;
• Mailtrap, Google and browser push services are located outside Cameroon, notably in the United States;
• if you are in the European Union, your data leaves the Union to be processed in Cameroon and in the other hosting countries.

These transfers are necessary to provide the service you request: an exchange between two countries means that data travels between them. With our providers, we rely on their contractual data protection commitments. You can obtain the list of our hosting countries and of the safeguards used by writing to contact@nkap-express.com.

7. Retention periods #

Disputes are kept as long as the transaction they relate to, as they are part of it. At the end of these periods, the data is deleted or anonymised. A period may be extended if legal proceedings or a request from an authority are pending.

8. Security #

What we do:

• exchanges between your device and our servers are encrypted (HTTPS);
• passwords are stored as hashes (Argon2id). Verification codes and session tokens are also stored as hashes;
• your ID document number, your payment details, the receiving details of a transaction and your two-factor authentication secret are encrypted (AES-256-GCM);
• uploaded files (ID documents, selfies, proofs, dispute documents) are encrypted at rest and can only be accessed through signed links valid for a few minutes. Their type is checked from their content, with a maximum size of 8 MB;
• our team works on data masked by default. On-demand displays in full, viewings of ID documents and sensitive actions are recorded in an audit log that the application can neither modify nor erase;
• the most sensitive actions (banning, exporting the member list, balance adjustments, dispute decisions on large amounts) require approval by a second person, except when a super-administrator performs them personally;
• our team’s sessions close after 30 minutes of inactivity;
• the number of attempts is limited on sign-in routes and on verification codes.

Your email, your phone number and your name are stored unencrypted in our database, which is protected by the measures above.

What you can do:

• choose a long password (at least 10 characters) that you do not use anywhere else;
• turn on two-factor authentication in your profile. It is required in any case to accept an exchange whose escrow exceeds a threshold, currently 1,000,000 FCFA;
• check the list of your active sessions and sign out of all your devices if you see an unknown session;
• write to us without delay at contact@nkap-express.com if you think your account has been compromised.

In the event of a data breach that poses a risk to you, we notify the competent authority and, where the law requires it, the people concerned.

9. Your rights and how to exercise them #

You have the right:

• of access: to know what data we hold about you and to obtain a copy of it;
• to rectification: to correct inaccurate or incomplete data;
• to erasure: to request the deletion of your data, within the limits of the legal periods in section 7;
• to object: to object to processing based on our legitimate interest, unless we have compelling grounds (for example security or the defence of legal claims);
• to restriction: to request that data be frozen while a challenge is being examined;
• to portability: to receive the data you have provided to us in a structured, machine-readable format;
• to withdraw your consent at any time, for processing that depends on it, without affecting what was done before;
• to lodge a complaint with the competent data protection authority: in Cameroon, the authority established by Law No. 2024/017; in the European Union, the authority of your country (for example the CNIL in France or the Data Protection Authority in Belgium); elsewhere, the authority of your country of residence. You can also write to us first: we will try to resolve the problem.

What you can do yourself in the app:

• change your display name and your country;
• add a sign-in method;
• delete a payment account;
• set your notifications by event and by channel, and withdraw permission for push notifications in your browser;
• see your active sessions and sign out of all your devices;
• block a member.

For everything else, write to contact@nkap-express.com. This applies in particular to closing your account, obtaining a copy of your data, changing your languages or removing your photo, correcting your email or information in your identity file, or objecting to processing.

• Verification of your identity: write from your account email address. Otherwise, we may ask you to prove that you are the account holder. We do not answer a request whose author cannot be identified.
• Time limit: we answer within one month of receiving the request. If the request is complex, this period may be extended by two months: we tell you so within the first month, with the reason.
• Closing the account: if an exchange or a dispute is in progress, or if your Nkap wallet has a balance, we must settle them with you first. After closure, we only keep the data the law requires us to retain, for the periods in section 7.
• Cost: exercising your rights is free, unless a request is manifestly unfounded or repetitive.

10. Cookies and local storage #

We use one cookie and a few storage items that the service needs to work and, only if you accept them, the audience measurement cookies described below.

Cookie

Local storage (localStorage and sessionStorage)

App cache

To run faster and partly offline, the app keeps a cache on your device of fonts (1 year) and some read responses, including ad details (7 days). Cached responses are erased when you sign out.

Audience measurement, with your consent

If you accept it in the “Audience measurement” banner, we use Google Analytics 4, provided by Google Ireland Limited, to count visits and understand how the site is used: pages viewed, referring site, device and browser type, approximate country or city. Google Analytics then sets the _ga and _ga_… cookies, kept for 13 months at most, and the measurement data is kept for 14 months at most. Google Analytics 4 does not record your IP address, and Google’s advertising features are not enabled. This data may be processed by Google outside Cameroon and the European Union, in particular in the United States.

Without your consent, Google’s script is not loaded and none of these cookies is set. Declining is as easy as accepting and changes nothing in your use of the service. You can change your mind at any time with the “Cookies” link at the bottom of the page: withdrawing erases the measurement cookies.

What we do not use

No advertising cookies and no third-party tracker apart from the audience measurement you accepted. Our fonts are hosted by us. Another exception, described in section 5.7: a profile photo coming from Google is loaded from Google’s servers.

Apart from audience measurement, all these items are strictly necessary for the service you request: they do not require your consent. You can erase them from your browser settings: you will then be signed out and your display preferences will be lost.

11. Minors #

Nkap Express is reserved for people who have reached the age of majority under the law of their country of residence. We do not ask for your age at sign-up, but the ID document required to exchange shows the date of birth, and our team refuses to verify a minor.

If we learn that a minor has opened an account, we close it and delete their data, except what the law requires us to keep. A parent or legal guardian can report it to us at contact@nkap-express.com.

12. Changes #

We may change this policy, for example when we add a feature or a provider, or when the law changes. The date of the last update appears at the top of the page. If a change significantly alters how your data is used, we notify you by email or in the app before it applies.

This policy is written in French. This English version is a translation: the French version prevails.