Privacy policy

WANYIYIN S.A. ("WANYIYIN" or "the Controller") treats the protection of its users' personal data as fundamental. This Privacy Policy describes, transparently and in full, how WANYIYIN collects, uses, stores, shares and protects your personal data.

• The General Data Protection Regulation (GDPR) of the European Union, which applies in particular to diaspora members living in the EEA
• Loi n°2017-20 of 20 April 2018 establishing the Digital Code of the Republic of Benin
• ECOWAS Directive C/DIR/1/08/11 on personal data protection in West Africa
• Any other national regulation applicable in the countries where we operate

Data controller

WANYIYIN S.A.

Registered office

Cotonou, Republic of Benin

Data protection officer

contact@wanyiyin.com

Identity and profile data:

• First name and surname
• Date of birth, to confirm you are of age
• Gender (self-declared)
• Photographs published on your profile (minimum 1, maximum 6)
• Personal description, interests, occupation, languages spoken
• Ethnic origin and mother tongue (self-declared and optional)
• Religion and level of practice (self-declared and optional)
• The kind of relationship you are looking for

Identity verification (KYC) data:

• A copy of an official identity document (national ID card, passport or residence permit)
• A selfie taken during verification
• The yes-or-no result of the check: only this result is kept once the check is complete

Contact and authentication data:

• Mobile phone number: your main identifier, stored encrypted
• Email address, optional, for communications and account recovery
• Password, hashed irreversibly: WANYIYIN never knows it in plain text

Technical and transaction data:

• Connection IP address, device identifier, operating system and app version
• Approximate location (city or district): never real-time location, and never at street-address level
• History of token purchases (amount, date, pack bought) and the payment method used
• Full card details are never stored by WANYIYIN: they are handled by PCI-DSS certified processors

Legal bases for processing:

Performance of the contract

KYC verification, profile management, matching, messaging, token transactions

Legitimate interest

Improving the algorithm, preventing fraud, platform security, detecting abusive behaviour, aggregated statistics

Explicit consent

Processing of sensitive data (ethnic origin, religion, gender), all self-declared and optional

Legal obligation

Keeping transaction data in line with accounting and tax obligations

Vital interests

Passing information to the authorities where a report indicates someone is in danger

Matching service

Kept for as long as the account is active, then deleted within 30 days of closure

KYC verification

Identity document deleted within 72 hours; verification status kept for the life of the account

Improving the algorithm

Aggregated, anonymised data kept without time limit; individual data kept for 36 months after the last login

Fraud prevention

Blocklist of accounts suspended for serious fraud kept for 5 years after suspension

Transactions and billing

Accounting records kept for 10 years in line with Beninese legal obligations

Marketing communications

Until consent is withdrawn or the account is deleted, whichever comes first

Security logs

Kept for 12 months for intrusion detection purposes

Technical providers: WANYIYIN uses third parties for data hosting, PCI-DSS certified payment services, sending SMS and push notifications, and analytics tools. These providers act as processors and are bound by contract to strict data protection clauses.

Other users: depending on your settings, the following are visible: your first name, your photographs once mutually unblurred, your description, your age range and whatever else you have chosen to make public. Your phone number, email address and KYC information are never shared.

Competent authorities: WANYIYIN may have to disclose data at the order of a competent judicial, administrative or police authority. Where that happens, only the data strictly needed to answer the request is passed on.

International transfers: some data may be transferred outside Benin, in particular to European Union countries. These transfers are covered by appropriate legal mechanisms (standard contractual clauses, adequacy decisions) guaranteeing an equivalent level of protection.

Right of access

To confirm whether data about you is being processed and to receive a full copy of it in a readable format

Right to rectification

To have any inaccurate or incomplete personal data about you corrected

Right to erasure

To have your personal data deleted, under the conditions provided by law (the "right to be forgotten")

Right to portability

To receive your data in a structured, commonly used, machine-readable format

Right to object

To object to processing on grounds relating to your particular situation, in particular for marketing purposes

Right to restriction

To ask for processing of your data to be temporarily suspended, in the cases provided by law

Withdrawal of consent

To withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand

Post-mortem instructions

To set out instructions on how your data should be handled after your death

To exercise any of these rights, send a written request to contact@wanyiyin.com stating what you are asking for and attaching a copy of a document proving your identity. WANYIYIN replies within a maximum of one (1) month, which may be extended by two (2) months where the request is particularly complex.

If our answer does not satisfy you, you may refer the matter to Benin's data protection authority (APDP) or, for European citizens, to the CNIL or the supervisory authority of your country of residence.

• Encryption in transit (TLS 1.3) and at rest (AES-256) for all sensitive data
• Irreversible password hashing (bcrypt with a random salt)
• Separation of the development, test and production environments
• Access restricted to authorised staff only, on a least-privilege basis
• Strong authentication (2FA) for any access to production data systems
• Regular penetration tests and security audits by independent providers
• A data breach management procedure meeting legal requirements
• A business continuity and disaster recovery plan

In the event of a data breach likely to create a high risk to the rights and freedoms of the users concerned, WANYIYIN undertakes to notify them within a maximum of seventy-two (72) hours of becoming aware of it, and to inform the competent supervisory authority.

The site and the app use session cookies and similar technologies (pixels, advertising identifiers) for technical operation (authentication, sessions), performance analysis and improving the user experience, and personalising the service.

On this site, no cookie beyond those strictly necessary is placed before you consent through the preferences banner. You can change your choices at any time from your browser settings, and from the dedicated section in the app settings.

WANYIYIN may change this Privacy Policy at any time, in particular to reflect legal, regulatory or technical developments. Any substantial change is notified by push and/or email at least thirty (30) days before it takes effect. The version in force is always available from the app.