LEGAL, PRIVACY & COMPLIANCE
Privacy Policy & Security Standards
Last updated: June 2026. NelsiusPay is committed to bank-grade transparency, data protection under CEMAC regulations and GDPR standards, and strict ring-fencing of merchant funds.
1. Collection of Personal & Business Data
- Identification details: Legal name, first name, corporate email address, and active telephone numbers.
- Corporate verification documents: Commercial registry (RCCM), Tax Identification Number (NIF), and proof of company location.
- Identity verification (KYC): Valid national ID, passport, or resident permit for designated account owners.
- Technical transaction logs: IP addresses, device user-agents, geolocation headers, and cryptographic signature logs strictly collected for anti-fraud telemetry.
2. Lawful Basis & Purposes of Data Processing
- Executing payment orders, USSD push notifications, card authorizations, and real-time merchant settlement.
- Automated fraud prevention, prevention of fake SMS scams, and behavioral transaction scoring.
- Compliance with legal AML/CFT (Anti-Money Laundering & Combating Financing of Terrorism) obligations under COBAC and CEMAC regulations.
- Dispatching transactional notifications, PDF tax invoices, API status alerts, and customer receipts.
3. Data Retention & Cryptographic Protections
- All payment data in transit is encrypted using TLS 1.3 / SSL with high-grade AES-256 GCM cipher suites.
- Sensitive data, API secrets, and 4-digit Transaction PINs are salted and hashed using Argon2id/Bcrypt; they are never readable by staff.
- Raw credit card numbers are tokenized by PCI-DSS Level 1 certified partner vaults; NelsiusPay servers never store unencrypted PAN numbers.
- Audit trails and transaction records are securely retained for 5 to 10 years in compliance with banking statutory laws.
4. Merchant Rights & Data Protection Officer (DPO)
- Right of access: You may obtain a complete machine-readable copy of your profile and transaction history at any time.
- Right of rectification: You can update your business address, phone number, and beneficiary accounts directly from the dashboard.
- Zero data commercialization: NelsiusPay NEVER sells, rents, or monetizes merchant or customer personal data to third-party ad networks.
- Dedicated compliance desk: Our Data Protection Officer (DPO) responds within 48 hours to all GDPR/APDP requests at dpo@nelsiuspay.com.
Data Protection Officer (DPO) & Compliance Desk
For regulatory inquiries, rights exercises or audit certificates :
dpo@nelsiuspay.com • compliance@nelsiuspay.comEmail DPO