— Privacy

Privacy policy

Last updated: June 30, 2026 · Compliant with GDPR (EU) 2016/679 and BCEAO/UEMOA regulation

⚠ Template pending legal review. This policy is a technical starting point inspired by CNIL templates and BCEAO obligations on identity-data processing. Before official publication, have it reviewed by a DPO and legal counsel specialized in personal data and eKYC. The French version is the legally authoritative one.

1. Data controller

bantou — [legal name to be completed] — acts as data controller for data collected via the site bantou.ai.

For the eKYC demonstrations (subdomains ekyc.bantou.ai), bantou acts as a processor within the meaning of Article 28 GDPR, on behalf of the client entities that remain data controllers.

2. Data Protection Officer (DPO)

DPO contact: dpo@bantou.ai [mailbox to create or redirect]

3. Data collected and purposes

Data	Purpose	Legal basis	Retention
Email (form / mailto)	Respond to your request	Legitimate interest (art. 6.1.f)	3 years after last exchange
Server logs (IP, user-agent, date)	Security, abuse prevention	Legitimate interest + legal obligation	12 months max
Identity data (eKYC demos)	Testing the verification flow	Explicit consent (art. 7) + legitimate interest	30 days for public demos · contractual for clients
Biometric data (liveness)	Anti-spoofing demo	Explicit consent (art. 9.2.a)	30 days for demos · contractual

4. Special categories of data — eKYC

The eKYC service processes official identity data (ID cards, passports) and biometric data (liveness selfie, facial comparison). These categories fall under Article 9 GDPR and the BCEAO/UEMOA regulation on anti-money-laundering and counter-terrorist financing (AML/CTF).

Explicit consent required before any capture, in accordance with art. 9.2.a GDPR.
No real identity data may be submitted to the public demos. The demos are strictly reserved for fictitious data or contractually agreed test data.
Encryption at rest and in transit (TLS 1.2+ and AES-256).
Immutable traceability of accesses (timestamped logging).

5. Recipients and processors

Your data is not shared with any third party for commercial purposes. Current technical processors:

Hetzner Online GmbH (Germany) — infrastructure hosting.
Brevo (France) — transactional email relay only (sending replies).
Anthropic, Inc. (United States) — AI API for internal code generation. No client data is sent to this API.

6. Transfers outside the EU

For processors located outside the EU (Anthropic), transfers are governed by the European Commission's Standard Contractual Clauses (SCCs).

7. Your rights

In accordance with Articles 15 to 22 of the GDPR, you have the following rights:

Access to your data (art. 15)
Rectification (art. 16)
Erasure / right to be forgotten (art. 17)
Restriction of processing (art. 18)
Portability (art. 20)
Objection (art. 21)
Withdrawal of consent at any time (art. 7.3)

To exercise these rights: dpo@bantou.ai with a copy of your ID. Response within 1 month (extendable to 2 months).

You also have the right to lodge a complaint with the CNIL: cnil.fr/fr/plaintes or with the supervisory authority of your country of residence.

8. Cookies

The site bantou.ai uses no tracking cookies or third-party analytics. Only cookies strictly necessary for operation may be set (session, preferences). No consent is therefore required (CNIL, 2020 guidelines).

9. Security

bantou implements appropriate technical and organizational measures:

TLS 1.2+ (TLS 1.3) on all traffic, HSTS, strict CSP, X-Frame-Options DENY.
AES-256 encryption at rest for biometric and identity data.
Strict multi-tenant isolation (PostgreSQL row-level security).
Regular audits (code reviews, SCA scans, penetration tests).

10. Changes

This policy may be updated to reflect changes in regulation or in our services. The date of the last update is shown at the top. In the event of a substantial change, users will be informed by any appropriate means.