Privacy Policy

This policy describes how personal data is processed for users of the Peercel mobile application and the www.peercel.com website. It is written in accordance with Regulation (EU) 2016/679 (GDPR) and the equivalent laws of the African countries where the service is offered, including the APDP in Côte d'Ivoire, the CDP in Senegal and the NDPR in Nigeria.

It is published at a stable URL and versioned in our code repository: every change goes through review and leaves a dated record.

Data controller and contact

The data controller is NIDEN IT SAS, a French simplified joint-stock company with its registered office at 51 rue du Pré Brochet, 95110 Sannois, France.

• Postal address: NIDEN IT SAS, 51 rue du Pré Brochet, 95110 Sannois, France.
• Contact for any question about personal data, including requests to exercise your rights: privacy@send.peercel.com.
• General contact: contact@send.peercel.com.

Peercel has not appointed a data protection officer: the service meets none of the mandatory designation criteria of Article 37 GDPR. Privacy requests are handled by the team reachable at the address above, which replies within one month.

You may lodge a complaint with the French data protection authority (CNIL, 3 place de Fontenoy, 75007 Paris) or with the data protection authority of your country of residence.

Data collected by the mobile application

The table below is the reference description of our processing activities. It is what must match, point by point, the Data safety declarations on our Google Play listing and the Privacy Nutrition Labels on our App Store listing.

Peercel does not collect: your contacts, your calendar, health data, political or religious opinions, sexual orientation, or any biometric data. No data is sold, rented or transferred to third parties for advertising purposes.

Mapping to the Google Play and App Store forms

The declarations made to the stores describe exactly the processing set out in the table above. Here is the mapping, category by category.

All data travels encrypted (TLS). You can request the deletion of your account and your data from the Delete my account page, without installing the application.

Processors and transfers outside the European Union

Peercel relies on the following processors. Each is bound by a data processing agreement compliant with Article 28 GDPR.

Judicial or administrative authorities may receive certain data upon a valid legal request. No other sharing takes place.

Your rights and how to exercise them

You have the following rights over your personal data.

• Access and portability — obtain a copy of your data in a machine-readable format. The app offers a full export from your profile; you can also request it at privacy@send.peercel.com.
• Rectification — correct inaccurate data. Most fields can be edited directly in your profile.
• Erasure — request the deletion of your data. The procedure is described on the Delete my account page and does not require installing the app.
• Restriction and objection — request that processing be frozen, or object to processing based on our legitimate interest.
• Withdrawal of consent — where processing relies on your consent, withdraw it at any time, without affecting processing already carried out.
• Complaint — refer the matter to the CNIL or to the data protection authority of your country.

Any request sent to privacy@send.peercel.com receives a reply within one month, extendable by two months for complex requests, in which case you are informed. We may ask for proof of identity where there is reasonable doubt about who is making the request.

Some rights have limits: accounting records must be kept for ten years and anti-money-laundering data for five years; they cannot be erased on request.

Retention, deletion and anonymisation

Retention periods appear in the table in section 2. They follow three rules.

1. Account deletion. On a deletion request, the account is deactivated immediately: listings are withdrawn, sessions are closed, signing in is no longer possible.
2. Anonymisation at day 30. Thirty days later, an automated job permanently overwrites identifying data: first name, last name, email, phone, address and date of birth are overwritten, identity documents are erased, message content is replaced by a neutral placeholder. This thirty-day window is deliberate: it allows a request made in error to be reversed, and an ongoing dispute or payment to be settled, before the data disappears.
3. What remains after anonymisation. Financial records are kept for ten years under our accounting obligations, and audit logs for five years under our regulatory obligations, without directly identifying data. Ratings received by the people you dealt with remain, detached from your identity, so their reputation is not distorted.

If a delivery is under way, if funds are still in escrow or if a dispute is open, the deletion is recorded but its execution is deferred until the situation is settled. You are informed of this in the support request opened by your confirmation.

Security

Passwords are stored hashed and are never readable by our team. Traffic between the app and our servers is encrypted in transit (TLS). Message text is encrypted at rest. Access by our team members to production data is individually attributed and recorded in a tamper-evident audit trail.

We will never ask you for your password, or for a one-time code, by email, by phone or in the app's messaging.

Updates to this policy

This policy is a versioned document: every change is reviewed and dated before publication, and the date of the last update appears at the top of the page.

Where a substantial change occurs — a new purpose, a new processor outside the European Union, a longer retention period — users are informed in the application before it takes effect.