1. Data controller
- Registered office: Îlot
- 23 112, Parcelle : A, Maison : Inconnu Inconnu, ATLANTIQUE, ABOMEY-CALAVI, ABOMEY-CALAVI, AITCHEDJI,, Abomey-Calavi
The processing of your personal data was declared to the Personal Data Protection Authority (APDP) under number ____________. At the point of collection we provide you with all the information listed in Article 415 of the Digital Code: the identity and address of the data controller, the purposes pursued, the categories of data, the recipients, the retention period, the existence of transfers outside Benin and how to exercise your rights.
2. Guiding principles
- We only collect data strictly necessary for our declared purposes;
- We do not collect sensitive information (health, political opinions, religious beliefs, trade union membership);
- We do not retain your data beyond the period required for the purpose pursued;
- We do not sell your personal data to third parties for commercial purposes;
- You have the right to access, rectify, object to, restrict, port and erase your data.
3. Data collected
The data we collect depends on how you use the Site:
| Context | Data collected | |
|---|---|---|
| Account creation | Name, email address, password (stored as a hash), account creation date, email verification status | |
| Order placement | Name, telephone number, delivery address, order contents, amounts, promotional code applied | |
| Payment | Telephone number, payment method, transaction reference, amount debited, provider fees, payment status | |
| Invoicing | Invoice number, verification identifier, PDF file path | |
| Customer review | Rating given, comment, date, moderation status | |
| Newsletter | Email address, subscription date, subscription status | |
| Chat and support | Name, email address (optional), message, conversation identifier, topic | |
| Product request | Name, email address, telephone number, message, product requested | |
| Audience measurement | Pages viewed, events, referrer, technical browsing information | |
| Security and fraud prevention | Browser fingerprint, irreversibly hashed IP address (HMAC-SHA256), normalised addresses, number of accounts created per device | Server connection logs: IP address, URL requested, timestamp |
4. Purposes and legal bases
| Purpose | Legal basis | Data concerned |
|---|---|---|
| Account creation and management | Performance of the contract | Identity, email address, password |
| Order processing and delivery | Performance of the contract | Identity, contact details, address, order contents |
| Payment execution and security | Performance of the contract | Telephone number, payment method and reference |
| Invoicing and tax obligations | Legal obligation | Identity, address, amounts, transactions |
| Fraud and abuse prevention | Legitimate interest | Device fingerprint, hashed IP address, order history |
| Customer service and complaints | Performance of the contract | Identity, contact details, correspondence |
| Newsletter dispatch | Consent | Email address |
| Audience measurement and Site improvement | Consent | Browsing data |
| Exercise of data subject rights | Legal obligation | All data relating to you |
Processing is necessary for performance of the contract when you order from the Site. It relies on your consent for the newsletter and audience measurement, and on our legitimate interest in protecting the Site against fraud. You may withdraw consent at any time.
5. Recipients
Your data is accessible only to the internal departments that need it: commercial management, customer service, IT and accounting. We do not transfer your data to third parties for commercial purposes.
Your data is processed by a small number of external providers, who act on our behalf and on our instructions. They may not use your data for their own purposes and may not disclose it to third parties.
The following providers are involved in the purposes described below:
- a payment provider, which processes your name, email address, telephone number and the transaction amount in order to settle your order;
- an authentication service, if you choose to sign in with your Google account;
- an email delivery service, which receives your email address and the content of the messages we send you;
- our host, OVH, which hosts the Site on servers located in the European Union and processes your technical connection data.
The complete and current list of our processors, with the detail of the categories of data each one handles, is held at our registered office and is provided to you on simple written request sent to support@vanterraglobal.com.
The Site is hosted by OVH, a French company subject to the GDPR (see the "Hosting" section). Certain providers involved in translating our content and in fraud prevention are established outside Benin; they process your data under our responsibility.
6. Retention periods
| Type of data | Retention period |
|---|---|
| User account | For as long as the account is active, then 3 years after last activity |
| Order and invoicing data | 10 years (tax and accounting obligations) |
| Payment evidence | 10 years (tax limitation period) |
| Newsletter | For as long as consent is maintained |
| Customer service correspondence | 3 years after last contact |
| Security and anti-fraud data | 3 years |
| Server connection logs (IP address, URL, timestamp) | À configurer (voir logrotate nginx) |
| Audience measurement | 13 months maximum |
| Strictly necessary cookies | Duration of the session |
7. Data security
We implement appropriate technical and organisational measures to protect your data against loss, unauthorised access, disclosure, alteration or destruction:
- Encryption of exchanges between your browser and our servers (HTTPS);
- Storage of passwords as non-reversible hashes;
- Session cookies inaccessible to scripts (httpOnly) and protected against replay (SameSite);
- Internal access control over customer data, restricted to authorised departments;
- Daily encrypted backups of the database;
- Delivery of images through a network with controlled access.
In the event of a data breach likely to result in a high risk to your rights and freedoms, we notify the Personal Data Protection Authority under the conditions laid down in Book V of the Digital Code.
8. Your rights
In accordance with Articles 437 to 451 of Book V of the Digital Code, you have the following rights over your personal data:
- Right of access — obtain confirmation that processing exists and receive a copy of the data;
- Right to rectification — have inaccurate or incomplete data corrected;
- Right of inquiry — obtain information about the processing of your data;
- Right to object — object, on grounds relating to your particular situation, to processing based on legitimate interest or consent;
- Right to restriction — request temporary restriction of processing;
- Right to portability — receive your data in a structured, machine-readable format;
- Right to erasure — obtain deletion of your data, in particular on deletion of your account;
- Right to be forgotten — have data relating to you removed from our systems;
- Right to compensation — obtain compensation for harm suffered in the event of a breach of your rights.
To exercise any of these rights, send your request, together with proof of identity, to our Data Protection Officer:
- Post: Îlot
- 23 112, Parcelle : A, Maison : Inconnu Inconnu, ATLANTIQUE, ABOMEY-CALAVI, ABOMEY-CALAVI, AITCHEDJI,, Abomey-Calavi
We undertake to respond to your requests within 30 days of receipt. You may also delete your account at any time from your personal area, or by asking us to do so.
9. Complaints and recourse
In accordance with Article 448 of the Digital Code, if you consider, after contacting us, that your rights are not being respected, you may lodge a complaint with the Personal Data Protection Authority:
Filing a complaint is free of charge. This step is without prejudice to effective judicial recourse against the data controller or its processor (Article 450 of the Digital Code) and to an action for compensation (Article 451).
10. Changes to this policy
This policy may be updated to reflect legal or technical changes. The last revision date is shown at the bottom of the page. In the event of a substantial change, we will notify you prominently on the Site.