1. Who we are
The controller of your data is KONTILO SARL, a limited liability company with share capital of 100 000 FCFA, registered with the Douala RCCM under number CM-DLA-01-2025-B12-00966 (NIU M072517870171G), with its registered office at Bastos, lieu-dit Résidence de l’ambassadeur de Centrafrique, Yaoundé, Cameroon.
Kontilo is a fintech: neither a bank nor a licensed payment institution. We help SMEs in Cameroon pay their suppliers abroad. You pay for each payment by transfer into the bank account of KONTILO SARL held at CCA Bank (Crédit Communautaire d’Afrique); the conversion and sending abroad are then carried out with our payment partners.
For any question about your data: hello@kontilo.com. Our data protection officer is the manager, Donatien Migue Tsawo, who can be reached at the same address.
Our processing is subject to the prior formalities set out in Law No. 2024/017 of December 23, 2024 on the protection of personal data in Cameroon, with the Personal Data Protection Authority (APDP).
2. The data we collect
When you visit the site or request access
- Name, work email, company, phone or WhatsApp (optional).
- Range of amounts paid to suppliers and regions of your suppliers.
- Technical data: IP address, device and browser type, pages viewed.
When you open an account (company verification)
- The company’s RCCM and tax registration certificate (NIU), proof of the company’s address.
- For each director and each beneficial owner holding 10% or more: identity, ID document, proof of address.
- A recent bank statement, to show the origin of funds.
When you pay a supplier
- The supplier’s invoice and the beneficiary’s bank details.
- The amounts, currencies, dates and status of each payment.
- Exchanges with our team (emails, messages, calls).
3. Why we use it
- Carrying out your payments
- Necessary to perform our contract with you.
- Verifying your company, assessing its risk level, screening for sanctions
- Legal obligation: CEMAC anti-money laundering and counter-terrorist financing regulations, and exchange control regulations, which require every transfer abroad to be justified.
- Securing the service and preventing fraud
- Legitimate interest in protecting our customers and our service.
- Responding to your access request, sending you our news
- Your request; for news and marketing, only your prior consent, which you can withdraw at any time.
- Measuring site traffic
- Your consent, which you can withdraw at any time.
Assessing your company’s risk level is required by regulation. We make no decision with legal effects on you based solely on automated processing: a payment refusal is always reviewed by our compliance team.
4. Who we share it with
We neither sell nor rent your data. We share it only with:
- CCA Bank, which holds the bank account of KONTILO SARL into which you transfer your FCFA, and therefore sees your transfers.
- Our exchange and settlement partners (including Borderless, Yellow Card, HoneyCoin, Walapay and Yativo), which need the payment and beneficiary information to carry it out.
- Our technical service providers (hosting, identity verification, sending notifications), bound by contract and by confidentiality: Persona, Google Cloud and Twilio.
- The authorities (ANIF, COBAC, judicial authorities), when the law requires us to.
5. Transfers outside Cameroon
Paying a supplier abroad involves transmitting some data outside Cameroon: the payment and beneficiary data, to our settlement partners and to the supplier’s bank. Some of our technical providers may also be located abroad.
Law No. 2024/017 makes these transfers subject to the prior authorisation of the APDP and to an adequate level of protection at the recipient. We limit the data transmitted to what is strictly necessary and govern it by contract.
6. Retention periods
- Company verification file
- 10 years after the end of the relationship
- Payments, invoices and related checks
- 10 years after the payment
- Access requests not followed up
- 3 years after the last contact
- Technical connection logs
- 12 months
The 10-year periods arise from CEMAC anti-money laundering regulations, in particular Regulation No. 01/16/CEMAC/UMAC/CM of April 11, 2016. During this period, we cannot erase this data, even at your request; we delete or anonymise it at the end of the period.
7. Security
- Data encrypted at rest (AES-256) and in transit (TLS).
- Access restricted to team members who need it, according to their role.
- Every access to files is logged.
- Regular backups and a tested recovery procedure.
In the event of a breach of your data, we inform the APDP and the people concerned without delay, as required by Law No. 2024/017, and tell you what measures have been taken.
8. Your rights
At any time, you can:
- access your data and obtain a copy;
- have it corrected if it is inaccurate;
- request its erasure, subject to our legal retention obligations;
- object to processing, including profiling, within the limits of our legal obligations;
- withdraw your consent to marketing or traffic measurement at any time;
- request the portability of the data you have provided to us;
- give instructions on what happens to your data after your death.
Write to us at hello@kontilo.com. We reply within one month at the latest. We may ask you to prove your identity. If you are not satisfied with our reply, you can refer the matter to the Personal Data Protection Authority (APDP).
9. Cookies
The site needs no cookies to work: your choice about traffic measurement is simply stored in your browser. Traffic measurement cookies (Google Analytics) are only set with your consent, which you can withdraw at any time with the “Manage cookies” link at the bottom of the home page.
Kontilo is reserved for businesses: we do not knowingly collect data about minors.
10. Changes and contact
We may update this policy, for example when launching a new service. The update date is shown at the top of the page; in the event of a significant change, we will notify you by email.
KONTILO SARL · Bastos, lieu-dit Résidence de l’ambassadeur de Centrafrique, Yaoundé, Cameroon · hello@kontilo.com · +237 6 95 81 92 00