Privacy Policy
How KYA SMS (published by CC AFRICA) collects, uses and protects your personal data.
Last updated : January 17, 2025
Introduction
This Privacy Policy describes how CC AFRICA ("we"), publisher of the KYA SMS platform available at kyasms.com, collects, uses, shares and protects the personal data of users and customers ("you").
As a Value Added Service (VAS) licensed by ARCEP in Benin, we process your data in accordance with the Benin Digital Code (Law No. 2017-20 of 20 April 2018) and under the supervision of the Personal Data Protection Authority (APDP). For our Nigerian subsidiary, we also comply with the Nigeria Data Protection Act (NDPA 2023). For international customers, our practices are aligned with the EU GDPR.
By using our services, you accept the practices described in this policy.
Data Controller
The controller of your personal data is:
- Company
- CC AFRICA
- Headquarters
- Cotonou, Bénin
- Subsidiary
- CC-AFRICA GLOBAL BUSINESS HUB — 3, Oriomi-Sokori, Abeokuta, Ogun, Nigeria
- Data Protection Officer (DPO)
- [email protected]
Data we collect
We only collect data necessary to provide and improve our services:
Identification and account data
- Name, company name
- Email address and phone number
- Login credentials (hashed password, API keys)
- Sender ID and company information
Service usage data
- Sending metadata (recipient numbers, timestamp, delivery status, operator, cost)
- Content of messages sent (processed on your behalf — see "Our role")
- Campaign history, statistics and API call logs
Billing data
- Billing details
- Transaction and top-up history
- Payment method (full card details are handled by our payment providers, never stored by us)
Technical data
- IP address, browser and device type
- Connection and security logs
- Cookies and similar identifiers
Purposes and legal bases
We process your data for the following purposes, each based on a legal basis:
| Purpose | Legal basis |
|---|---|
| Provide and perform the service (SMS, OTP, API) | Performance of contract |
| Account management and customer support | Performance of contract |
| Billing and accounting | Legal obligation |
| Security, fraud and abuse prevention | Legitimate interest |
| Service improvement and statistics | Legitimate interest |
| Marketing communications | Consent |
| Compliance with legal and regulatory obligations | Legal obligation |
Our role: controller or processor
For your account data (identification, billing, usage), KYA SMS acts as the data controller.
For the content of the SMS you send and the numbers of your own recipients, you are the data controller and KYA SMS acts as a processor, handling this data only on your instructions to route your messages.
International transfers
Your data may be processed in Benin, Nigeria and by our hosting providers, which may be located outside your country. The very operation of the SMS service involves transmission to operators in the destination country.
When data is transferred outside Benin, we implement appropriate safeguards (contractual commitments, security measures) in accordance with the Benin Digital Code and, where applicable, GDPR standard contractual clauses.
Data retention
We keep your data only as long as necessary for the purposes pursued:
| Category | Retention period |
|---|---|
| Account data | Duration of the contract, then 3 years |
| SMS logs and metadata | 12 months (deliverability, disputes, security) |
| Billing documents | 10 years (accounting obligation) |
| Security / connection logs | 12 months |
| Marketing data | Until consent is withdrawn |
Data security
We implement technical and organizational measures to protect your data:
- Encryption of communications (HTTPS/TLS) and sensitive data
- Hosting in certified data centers (ISO 27001)
- Strict access control and least-privilege principle
- Two-factor authentication (2FA) and scoped API keys
- Monitoring, logging and regular backups
Your rights
In accordance with the Benin Digital Code and the GDPR, you have the following rights:
- Right of access to your data
- Right of rectification
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to portability
- Right to object
- Right to withdraw consent at any time
Children's data
Changes to this policy
We may update this policy to reflect legal or service changes. Any significant change will be indicated on this page, with the date above updated. We invite you to review it regularly.
Contact us
For any questions regarding this policy or your personal data: