Privacy Policy

The controller responsible for processing personal data collected through the No Bindi Platform is:

For the purposes of the GDPR, No Bindi is the Data Controller of personal data belonging to users in the European diaspora. Where required by Article 27 of the GDPR, No Bindi will designate a Representative in the European Union, whose contact details will be published on this page.

This Policy applies to all personal data collected and processed by No Bindi in connection with the use of the Platform, including:

• The No Bindi mobile application (iOS and Android);
• The website and marketing website (www.no-bindi.com);
• Any other digital platforms or channels operated by No Bindi;
• Communications by email, push notifications or other contact channels.

This Policy applies to all Users regardless of geographic location, including residents in Guinea-Bissau, ECOWAS member states, the European Union and any other jurisdiction.

It should be read together with the Terms of Use and the Cookie Policy, which form part of the overall contractual agreement.

No Bindi collects personal data in different ways throughout your interaction with the Platform:

3.1 Data Provided Directly by the User

3.2 Automatically Collected Data

3.3 Data Received from Third Parties

In certain circumstances, No Bindi may receive data from external sources, including image storage services (uploaded image URLs) and aggregated analytics data (anonymised Platform behaviour).

The personal data collected is processed exclusively for the following specific and legitimate purposes:

Pursuant to the GDPR (Article 6) and the principles established by ECOWAS Supplementary Act A/SA.1/01/10 and the Malabo Convention, No Bindi's data processing rests on the following legal grounds:

No Bindi retains personal data only for the period strictly necessary to fulfil the purposes for which it was collected, or for the legally required period. Once that period expires, the data is securely deleted or irreversibly anonymised.

When a user requests account deletion, personal identification data will be anonymised within 30 days, except where the law requires retention for a longer period (tax data, data required for defence in pending legal proceedings).

Personal data processed by No Bindi may be transferred to or accessible from third countries in the context of using cloud infrastructure services and third-party services integrated into the Platform. No Bindi ensures that such transfers take place with appropriate safeguards, including:

• Entering into standard contractual clauses or data processing agreements (DPA) with service providers;
• Selecting providers with internationally recognised security certifications (ISO 27001, SOC 2, etc.);
• For users in the EU: transfers to countries not recognised as adequate by the European Commission are carried out under the safeguards provided for in Chapter V of the GDPR (Articles 46 et seq.).

Within ECOWAS, data transfers between member states are facilitated by the framework established by Supplementary Act A/SA.1/01/10. For transfers to countries outside ECOWAS, No Bindi verifies whether the destination country offers an adequate level of data protection.

never sells your personal data to third parties for commercial purposes. Data may be shared with the following categories of recipients:

Users have the following rights regarding their personal data, exercisable free of charge, except in cases of manifestly unfounded or excessive requests:

No Bindi uses algorithmic systems for the following purposes:

• Recommendation personalisation: The algorithm analyses browsing and search history to present relevant listings in the user's feed;
• Fraud and prohibited content detection: Automated algorithms analyse listings and behaviours to detect potential violations of the Terms of Use, flagging them for human review;
• Content moderation: Automated systems for detecting inappropriate content in listings.

Pursuant to Article 22 of the GDPR, users have the right not to be subject to decisions based solely on automated processing that produce significant legal effects. Where No Bindi takes decisions affecting the User (account suspension, listing removal), the right to human intervention, expression of point of view and appeal is guaranteed, in accordance with Section 18.2 of the Terms of Use.

No Bindi implements technical and organisational security measures appropriate to the level of risk, in accordance with the state of the art and international information security standards:

11.1 Technical Measures

• Encryption of all communications in transit via TLS 1.2/1.3 (HTTPS mandatory);
• Encryption of data at rest in the database;
• Password storage as a salted hash (bcrypt);
• JWT token-based authentication with automatic expiry (60 minutes for access token);
• Rate limiting on all sensitive endpoints (login, password recovery, registration);
• HTTP security headers (Helmet) on all API responses;
• Audit logging of all administrative and authentication actions.

11.2 Organisational Measures

• Role-based access control (RBAC): user, moderator, super-admin: with principle of least privilege;
• Confidentiality agreements with all staff and sub-processors with access to personal data;
• Documented security incident response procedures;
• Periodic reviews of security and privacy policies.

In the event of a personal data breach that puts users' rights and freedoms at risk, No Bindi undertakes to:

• 72 hoursNotify the competent data protection authority within a maximum of of becoming aware of the breach, pursuant to Article 33 of the GDPR and the equivalent principles of the Malabo Convention;
• without undue delayNotify affected users where the breach is likely to result in a high risk to their rights, indicating the nature of the breach, the categories of data affected and the measures taken;
• Take immediate steps to contain the breach, minimise damage and prevent further occurrences;
• Document all data breaches, including those that are not notified to the authorities.

No Bindi is intended exclusively for users aged 18 (eighteen) years or older. No Bindi does not intentionally collect personal data from persons under the age of 18.

If No Bindi becomes aware that it has inadvertently collected data from a person under the age of 18, it will immediately and permanently delete that data and close the associated account, without prejudice to any notification to the competent authorities.

Parents or legal guardians who detect improper use of the Platform by minors should immediately contact No Bindi at [email protected].

The No Bindi Platform uses cookies (on the website) and AsyncStorage (in the mobile application) to store data locally on the user's device. These technologies are used to maintain the active session, save preferences and improve the user experience.

For detailed information on the types of cookies used, their purposes, retention periods and how to manage your preferences, please consult our Cookie Policy.

No Bindi may update this Privacy Policy to reflect changes in data processing practices, Platform features or applicable law. In the event of material changes that affect users' rights, No Bindi will notify registered users at least 30 (thirty) days in advance by email or in-app notification. The updated version will be published on this page with the date of the last revision.

Previous versions of this Policy may be requested by contacting [email protected].

To exercise your rights, lodge complaints or obtain clarification about this Policy:

Without prejudice to the right to lodge a complaint with No Bindi, Users always have the right to lodge a complaint with the competent data protection authority in their jurisdiction of residence.