Sub-processors
Last updated: [EFFECTIVE DATE]
Third parties that may process personal data on our behalf, under the Data Processing Agreement.
We give at least `[NOTICE PERIOD — e.g. 30]` days' notice before adding or replacing a sub-processor. [Describe how — e.g. "email to your account address; subscribe at [URL]".]
Current sub-processors
[COMPLETE THIS TABLE WITH YOUR ACTUAL PROVIDERS BEFORE PUBLISHING. The rows below reflect the technologies the platform uses today and are placeholders for the specific vendors you contract with.]
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
[HOSTING PROVIDER] | Application hosting and compute | All platform data | [REGION] |
[DATABASE PROVIDER] | Managed PostgreSQL — merchant, transaction and ledger records | All platform data | [REGION] |
[REDIS PROVIDER] | Rate limiting and caching | IP addresses, request counters | [REGION] |
[EMAIL PROVIDER] | Transactional email — verification, password reset, notifications | Merchant email address and name | [REGION] |
[ERROR MONITORING] | Error and performance monitoring | Technical logs; may incidentally include IP and user id | [REGION] |
[KYC PROVIDER] | Identity verification and sanctions screening | Merchant identity documents and details | [REGION] |
Independent controllers (not sub-processors)
These are not processors acting on our instructions. They are regulated entities that determine their own purposes and are bound by their own legal obligations. We cannot instruct them, and a payment cannot happen without them.
| Party | Role | Data shared |
|---|---|---|
| MTN Mobile Money Cameroon | Payment provider | Payer MSISDN, amount, currency, reference |
| Orange Money Cameroon | Payment provider | Payer MSISDN, amount, currency, reference |
[SETTLEMENT BANK] | Settlement of merchant balances | Merchant name, bank account, settlement amount |
| ANIF and competent authorities | Regulatory reporting | As required by law |
Notes
- Where a sub-processor is located outside Cameroon and the CEMAC region, an appropriate transfer mechanism must be in place. See DPA §12.
- We impose data-protection obligations on each sub-processor equivalent to those we owe you, and remain fully liable for their performance.
- To object to a new sub-processor, write to
[PRIVACY EMAIL]within the notice period.
[COMPANY LEGAL NAME] · [PRIVACY EMAIL]