Politique de confidentialité

Last updated: 26 September 2026

Privacy Policy

Last updated: September 26, 2026

This Privacy Policy explains how Essono Group SARL collects, uses, protects, and stores personal data on the Laureats.cm platform, accessible from laureats.cm, its sub-domains, web applications, and custom event domains.

Essono Group SARL acts as the data controller in accordance with Cameroonian Law No. 2010/012 of December 21, 2010 on cybersecurity and cybercrime, and adheres to recognized international data protection standards for users accessing the platform worldwide.

1. Data Controller

Personal data processing is operated by:

Essono Group SARL
Registration: RCCM CM-NSI-01-2026-B12-0728
Registered Office: Yaoundé, Republic of Cameroon
Contact Email: [email protected]

2. Information We Collect

We limit our collection to information strictly required to record votes, secure financial transactions, and administer campaigns.

2.1. Voters

  • Mobile Money Payments: Mobile telephone number entered to initiate the direct debit with the telecom operator (MTN or Orange), transaction amount, operator reference, and timestamp.
  • Card Payments: Email address (mandatory for purchase receipts and banking verification), billing country, timestamp, and 3-D Secure authentication status. Complete payment card numbers are handled directly by the certified PCI-DSS payment aggregator and never touch our servers.
  • Third-Party Sign-In (when required by a campaign): Account identifier, name, and email address shared by Google or Apple during OAuth sign-in. If you use Apple’s Hide My Email service, the masked private relay email address generated by Apple is recorded.
  • Technical Connection Data: IP address, Cloudflare-detected country of connection, browser user-agent, and session identifiers, used exclusively for security monitoring and rate-limiting.

2.2. Organizers

  • Account Details: Business email address, securely hashed password, and organization or company name.
  • Payout Details: Verified Mobile Money phone numbers or bank account details approved during onboarding to receive campaign payouts, along with necessary verification documents.
  • Invited Team Members: Email addresses of collaborators invited to manage specific campaign modules.

2.3. Candidates and Applicants

  • Approved Candidates: Public name, candidate number, category, biography, and portrait photograph publicly displayed on voting pages and promotional materials.
  • Candidate Applicants (open calls): Full name, portrait photo, bio, personal email address, and Cameroonian mobile phone number. These private contact details are accessible solely to the Campaign Organizer to evaluate the application and are never displayed publicly.

3. Purposes and Legal Bases for Processing

Data is processed under the following lawful grounds:

  • Contract Performance: Allocating votes to the live leaderboard, generating payment receipts, disbursing payouts to organizers, and managing user accounts.
  • Legal and Financial Compliance: Maintaining an immutable ledger of financial transactions, substantiating tax filings on platform commissions, and preventing financial fraud.
  • Legitimate Interests: Protecting infrastructure against automated bots and denial-of-service attacks, verifying payment anomalies, and resolving disputes.
  • Consent: Processing candidate applications submitted through open forms, and voluntary authentication through Google or Apple sign-in.

4. Handling of Photos and Media Files

To safeguard candidate privacy and maintain optimal performance:

  1. Every image uploaded to the Platform is automatically stripped of all embedded metadata (specifically smartphone GPS location tags and hardware identifiers) by our processing pipeline.
  2. Photographs are resized, converted into modern open formats (WebP / AVIF), and stored on isolated object storage infrastructure.

5. Data Recipients and Service Providers

We do not sell, rent, or trade personal data to third parties for advertising purposes. Data is disclosed only to trusted technical service providers necessary for our operations:

  • Campay: Aggregation and processing of Mobile Money and payment card transactions.
  • Cloudflare: Content delivery network (CDN), Web Application Firewall (WAF), DDoS mitigation, DNS services, and secure image storage (Cloudflare R2).
  • Resend: Delivery of transactional emails (voting receipts, application confirmations, password resets).
  • Campaign Organizers: Access to data needed to track their contest (aggregated voting metrics, candidate submissions awaiting review). Organizers never have access to voters' full payment credentials or private phone numbers.

6. Retention Periods

We retain personal data only for as long as necessary to fulfill the operational purpose:

  • Failed or Expired Payment Orders: Automatically purged from our active database within 24 hours.
  • Confirmed Votes and Transaction Ledger: Kept permanently in an immutable append-only ledger for 10 years to satisfy legal, tax, and audit evidentiary requirements.
  • Rejected Candidate Applications: The candidate's photograph, phone number, and application details are permanently deleted within 30 days of the rejection notice.
  • Organizer Account Data: Retained for the lifetime of the active account, then archived for 5 years after the final campaign closure for legal defense purposes.
  • Server Access Logs: Retained for up to 90 days for network security purposes, then overwritten.

7. Data Security

Essono Group SARL implements appropriate physical and digital safeguards:

  • End-to-end encryption in transit via HTTPS (TLS 1.3).
  • Database isolation on private Docker networks not exposed to the public Internet.
  • Passwords hashed with robust, salted cryptographic algorithms.
  • Mandatory two-factor authentication (TOTP) for platform administrators.
  • Append-only audit logging for all administrative operations.

8. Your Rights

Subject to applicable law, you have the right to:

  • Access: Request confirmation of whether your data is being processed and obtain a copy.
  • Rectification: Request the correction of inaccurate or incomplete information.
  • Erasure: Request the deletion of your personal data, provided it is not required to be maintained under statutory accounting obligations.
  • Objection & Withdrawal: Object to processing based on legitimate interests, or withdraw consent previously granted for candidate applications.

To exercise these rights, submit your written request to: [email protected]. We respond to verified requests within 30 days.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect operational or legal updates. Any material changes will be signaled by updating the date at the top of this document.