Privacy policy

Last updated 11 November 2026

Article 1. Purpose and scope

This privacy policy (the Policy) explains how ExpatCloud (the Platform) collects, processes and protects users' personal data.

It applies to all personal data processing related to use of the Platform, including its administration and client portals.

The Policy is drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (GDPR).

Article 2. Data controller

The controller within the meaning of Article 4(7) GDPR is:

Name: E-Business Afrika
Solutions architect: Ir. Roland MANTAMA
Data protection officer (DPO) contact: contact@ebafrika.com
Website: www.ebafrika.com

Article 3. Categories of data collected

We may collect the following personal data to provide the service:

Identification data: first and last names, email address, telephone number and role in the organisation.
Technical connection data: IP address, browser type and version, operating system, sign-in timestamps and session identifier.
Document data: uploaded files, associated metadata (title, description, category and tags) and version history.
Audit log data: a chronological, immutable record of actions on the Platform, including viewing, downloading, editing and deleting. Records include the identity of the person who took the action, their source IP address and the timestamp.

Article 4. Purposes and legal bases for processing

Providing the digital archiving service. Performance of a contract (Article 6(1)(b) GDPR).
Authentication and access control. Performance of a contract (Article 6(1)(b)) and a legitimate interest in system security (Article 6(1)(f)).
Traceability and compliance audits. Legal obligation (Article 6(1)(c)) and legitimate interest (Article 6(1)(f)).
Service improvement and performance analysis. Legitimate interest (Article 6(1)(f)), subject to a balancing assessment of the rights of data subjects.
Compliance with legal and regulatory obligations. Legal obligation (Article 6(1)(c)).

Article 5. Security measures

In accordance with Article 32 GDPR and the recommendations of ISO/IEC 27001:2022, the controller applies the following technical and organisational measures:

Encryption at rest: AES-256-GCM encryption for all stored files and sensitive data.
Encryption in transit: TLS 1.3 for all communications between the client and the server.
Integrity checks: a SHA-256 fingerprint is computed and verified for each version of an archived document.
Access control: role-based access control (RBAC) follows the principle of least privilege, with strict isolation of each client's data in a multi-tenant environment.
Immutable audit log: a complete and irreversible record of operations on the Platform.
Periodic integrity checks: archived files are checked automatically at regular intervals. Discrepancies trigger an alert.
Data protection by design (Article 25 GDPR). Safeguards are incorporated into the specification of each feature.

Article 6. Retention period

Personal data is retained only for as long as necessary for the purposes set out in Article 4 of this Policy, unless the law requires a longer period.

Retention periods are set by policies the Platform administrator can configure. At the end of the retention period, the relevant data and documents are securely destroyed. A signed, timestamped certificate of destruction records the operation.

Audit log data is retained in accordance with applicable legal obligations and cannot be deleted early.

Article 7. Rights of data subjects

Articles 15 to 22 GDPR provide the following rights:

Access (Article 15). Ask whether personal data concerning you is being processed. If it is, obtain access to the data and information about the processing.
Rectification (Article 16). Correct inaccurate personal data or complete incomplete data.
Erasure (Article 17). Request deletion of personal data, subject to GDPR exceptions, including legal retention obligations and evidentiary needs.
Restriction of processing (Article 18). Restrict processing in the circumstances set out in Article 18 GDPR.
Data portability (Article 20). Receive personal data you provided in a structured, commonly used and machine-readable format, and transmit it to another controller.
Objection (Article 21). Object at any time to processing based on legitimate interests on grounds relating to your particular situation.

How to exercise your rights. Email your request to contact@ebafrika.com. The controller undertakes to respond within one month. This may be extended by two months if requests are complex or numerous, in accordance with Article 12(3) GDPR.

Complaints. You may lodge a complaint with a competent supervisory authority (Article 77 GDPR).

Article 8. Cookies and tracking technologies

The Platform uses a strictly necessary authentication cookie to keep users signed in, within the meaning of Article 5(3) of Directive 2002/58/EC, as amended (ePrivacy Directive).

The website address determines whether the ExpatCloud website appears in English or French.

No cookies are set for advertising, behavioural analysis or profiling. No data is shared with advertising networks or third parties for commercial purposes.

Article 9. International data transfers

Personal data is transferred to a third country or international organisation only if it is covered by a European Commission adequacy decision under Article 45 GDPR or by appropriate safeguards under Article 46 GDPR, such as standard contractual clauses or binding corporate rules.

Article 10. Processors

The controller may engage processors within the meaning of Article 4(8) GDPR solely for Platform hosting and technical infrastructure.

Each processor is bound by a contract that meets Article 28 GDPR requirements, including confidentiality, security of processing and assistance with requests to exercise data subject rights.

Article 11. Changes to the Policy

This Policy may change. If a material change affects data subjects' rights, they will receive a notice in the Platform at least 15 days before the new provisions take effect.

The last update date appears at the top of this document.

Article 12. Contact

For questions about this Policy or to exercise the rights described in Article 7, contact:

E-Business Afrika, Data protection officer
Email: contact@ebafrika.com
Website: www.ebafrika.com