Privacy Policy

1. Who We Are

Bridge Corporation operates Baobab, a Banking-as-a-Service (BaaS) platform licensed under COBAC (PSP/2024/001) in the CEMAC region and registered with BaFin (DE-12345678) in Germany. Our registered address is available at baobab-bridge.org.

For GDPR purposes, Bridge Corporation is the data controller. Our Data Protection Officer can be reached at dpo@baobab-bridge.org.

2. Data We Collect

Category	What we collect	Why
Identity	Full name, date of birth, nationality, government ID	KYC / AML / regulatory compliance
Contact	Phone number, email address, residential address	Account creation, notifications, security alerts
Financial	Wallet balance, transaction history, bank account details	Core payment services
Device	Device fingerprint, IP address, browser/OS info	Fraud prevention, security alerts
Location	Country detected from IP (not GPS)	Regulatory compliance, currency routing
Usage	Features used, screens viewed, interaction patterns	Service improvement, fraud detection
Communications	Chat messages sent within Baobab Chat & Pay	Delivering the messaging service
Biometric (optional)	Face photo (selfie for KYC only)	Identity verification — not stored beyond verification

3. Legal Basis for Processing (GDPR)

• Contract performance — processing your transactions and operating your wallet
• Legal obligation — KYC, AML, fraud reporting, OFAC/sanctions screening
• Legitimate interest — fraud detection, security, product improvement
• Consent — marketing communications (you can withdraw any time)

4. How We Use Your Data

• Processing payments, transfers, and currency exchanges
• Verifying your identity and preventing fraud
• Screening against OFAC/UN/EU sanctions lists
• Sending security alerts (e.g. new device login notifications)
• Providing AI financial coaching and spending insights
• Complying with financial regulations in 195 countries
• Improving and personalising the app experience

5. Data Sharing

We never sell your data. We share it only with:

• Payment partners — MTN Mobile Money, Orange Money, CamPay, NotchPay, Stripe, Wise (for transaction processing)
• KYC providers — identity verification partners under strict data processing agreements
• Regulatory authorities — COBAC, BaFin, national financial intelligence units as legally required
• Cloud infrastructure — encrypted storage on EU/US servers with sub-processors bound by GDPR Standard Contractual Clauses

6. International Transfers

Your data may be processed in countries outside your residence. Where we transfer data from the EEA, we use Standard Contractual Clauses (SCCs) approved by the European Commission. For transfers from Cameroon and CEMAC countries, we follow COBAC data localisation requirements.

7. Data Retention

Data type	Retention period
Transaction records	10 years (regulatory requirement)
KYC documents	5 years after account closure
Account data	Duration of account + 5 years
Security/device logs	2 years
Marketing preferences	Until consent withdrawn
KYC selfie photos	Deleted after verification (max 90 days)

8. Your Rights

Depending on your jurisdiction, you have the right to:

• Access — request a copy of all data we hold about you
• Rectification — correct inaccurate data
• Erasure — "right to be forgotten" (subject to legal retention requirements)
• Portability — receive your data in a machine-readable format
• Restriction — limit how we process your data
• Object — opt out of certain processing (e.g. marketing)
• Withdraw consent — at any time for consent-based processing

Exercise your rights from Profile → Privacy & Data Rights inside the app, or email privacy@baobab-bridge.org. We respond within 30 days as required by GDPR.

9. Security

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Two-factor authentication (2FA) available and encouraged
• New device login alerts sent by email automatically
• Spending limits and transaction monitoring for fraud detection
• Regular independent security audits
• OFAC and UN sanctions screening on all transactions

10. Cookies & Tracking

The Baobab web app uses only strictly necessary cookies for session management. We do not use third-party advertising trackers. We use anonymous usage analytics to improve the app experience. You can manage cookie preferences in the cookie banner on first visit.

11. Children's Privacy

Baobab is not intended for users under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact us immediately at privacy@baobab-bridge.org.

12. Changes to This Policy

We will notify you of material changes via email and in-app notification at least 30 days before they take effect. Continued use of Baobab after that date constitutes acceptance.

13. Regulatory Supervision & Complaints

Baobab operates under the supervision of:

• COBAC — Commission Bancaire de l'Afrique Centrale (Cameroon / CEMAC)
• BaFin — Federal Financial Supervisory Authority (Germany / EU)

If you are unsatisfied with our response to a privacy complaint, you have the right to lodge a complaint with your national data protection authority (e.g. CNIL in France, ICO in the UK, BfDI in Germany).