Privacy Policy

1.1. Purpose of the Policy

This Privacy and Data Protection Policy aims to clearly, transparently and comprehensively inform all users of the website https://gabonconnect.com and digital services operated by Gabon Connect Technology SARLU about the methods of collection, processing, storage and protection of their personal data.

It also defines the rights of users and the company's commitments regarding legal compliance, digital security and data sovereignty.

1.2. Institutional Commitment

Gabon Connect Technology SARLU, a Gabonese sole proprietorship limited liability company (SARLU), is committed to processing all personal data in strict compliance with:

• the Constitution of the Gabonese Republic,
• Law No. 001/2011 of September 25, 2011 on the protection of personal data,
• the regulations and directives of the National Digital Agency (ANINF) and the National Commission for Data Protection (CNPD),
• the General Data Protection Regulation (GDPR – EU 2016/679) applicable to its operations involving users located in the European Union,
• as well as internationally recognized best practices, including ISO/IEC 27001 standards and the Malabo Convention on Cybersecurity and Data Protection in Africa.

1.3. Vision and Digital Sovereignty Principle

As a player in national digital transformation, Gabon Connect Technology SARLU places digital sovereignty, transparency and privacy protection at the heart of its technological strategy.

Each piece of data collected is processed in a responsible, ethical and proportionate approach, aiming to:

• strengthen digital trust among citizens, institutions and businesses;
• guarantee the confidentiality, integrity and availability of entrusted information;
• promote technological development that respects fundamental rights and Gabonese regulations.

1.4. Scope of Application

This policy applies to:

• all users of the gabonconnect.com website;
• clients, partners, suppliers and employees of Gabon Connect Technology SARLU;
• digital services, mobile applications, web portals and interconnected platforms operated by the company, including Wiigo, Hello WiFi, EduConnect, JobConnect, eSanté Connect, Gabon Wallet, Admin+, AgriConnect, Justice Numérique, and any subsequent service within its digital ecosystem.

It applies regardless of the means of access (computer, mobile, tablet, connected terminal, public Wi-Fi network, etc.) and regardless of the territory of use (Gabon, Central Africa, European Union or other partner country).

1.5. Transparency and Accountability Objective

Gabon Connect Technology SARLU adopts a proactive digital accountability approach, involving:

• continuous documentation of data processing;
• regular internal compliance and security audits;
• ongoing training of staff and partners on data protection principles;
• and open cooperation with national regulatory authorities (ANINF, CNPD).

This policy aims to ensure that each user retains full control of their personal data and can fully exercise their rights simply and securely.

2.1. Data Controller

The data controller for personal data collected via the website https://gabonconnect.com and all digital services operated by Gabon Connect SARLU is:

The company acts as data controller within the meaning of Gabonese Law No. 001/2011 and Article 4 of the GDPR, meaning it determines the purposes (objectives) and means of processing collected personal data.

In certain specific cases, particularly in the context of its interconnected services or digital projects carried out in public-private partnerships, Gabon Connect SARLU may also act as joint data controller with partner institutions (administrations, local authorities, public or private establishments) in accordance with a data governance agreement duly governed by contract.

2.2. Data Protection Officer (DPO)

Aware of the strategic and regulatory importance of data protection, Gabon Connect SARLU has appointed a Data Protection Officer (DPO) responsible for ensuring permanent compliance with applicable laws and standards, ensuring internal compliance, and serving as the preferred point of contact between the company, users and supervisory authorities.

The DPO:

• advises and trains internal teams on legal obligations and best practices in data processing;
• monitors compliance of processing with Gabonese and international legal provisions;
• cooperates with the National Commission for Data Protection (CNPD) and the National Digital Agency (ANINF) in case of inspection, incident or complaint;
• ensures secure management of user rights exercise requests.

2.3. National Reference Authorities

For any question relating to data protection or in case of unresolved dispute, users may also contact the competent national authorities:

2.4. Responsibility and Transparency

Gabon Connect SARLU is committed to:

• ensuring transparent governance of the personal data it collects and processes;
• maintaining an internal register of processing in accordance with ANINF and GDPR requirements;
• documenting each purpose and each data transfer to third parties or technical partners;
• notifying the CNPD and, where applicable, users, of any breach or incident affecting the confidentiality or integrity of data.

All of these obligations fall under the principle of proactive accountability that guides the company's internal digital compliance policy.

3.1. Minimization Principle

Gabon Connect SARLU collects only the data strictly necessary for providing its digital services, managing user relationships, and fulfilling its contractual or legal obligations.

No data is collected without users' knowledge or used for undeclared purposes.

This approach respects the minimization principle enshrined in Law No. 001/2011 and the GDPR, ensuring that each piece of data collected serves a precise, legitimate and proportionate purpose.

3.2. Categories of Data Collected

Data that may be collected by Gabon Connect SARLU, directly from the user or automatically during browsing, is categorized as follows:

3.3. Sensitive Data

Gabon Connect SARLU does not collect any sensitive data within the meaning of Gabonese law and the GDPR (e.g. political opinions, religious beliefs, trade union membership, genetic, biometric data, sexual orientation, or health data), unless:

• the processing is explicitly required by law or a competent public authority;
• the user gives free, specific, informed and explicit consent for a determined purpose (e.g. teleconsultation via eSanté Connect);
• enhanced security measures (encryption, compartmentalization, anonymization) are implemented.

Such processing is subject to prior declaration or express authorization from the CNPD before any operational implementation.

3.4. Automatically Collected Data

When browsing the site, certain data is automatically collected by logging and analysis systems:

• IP address and session identifier;
• browser and page performance data;
• connection origin (search engine, social network, external link);
• browsing behavior (clicks, duration, pages viewed).

This data is used solely to improve the user experience, ensure site security and produce anonymized global statistics.

No personal profiling is carried out without explicit consent.

3.5. Origin of Collected Data

Personal data comes from:

• directly from the user (via forms, registration, account creation, application, email contact);
• indirectly via technical or institutional partners with whom the user interacts (interconnected portals, public services or partner APIs);
• or automatically through audience measurement tools (Google Analytics, Matomo, or equivalents), subject to the user's prior consent.

Each partner acting on behalf of Gabon Connect SARLU is contractually bound to respect data confidentiality and security obligations, in accordance with Articles 25 to 32 of the GDPR and Law No. 001/2011.

3.6. User Consent

Before any collection, the user is informed of:

• the nature of the data collected,
• the purpose of the processing,
• the retention period,
• and their rights (access, rectification, deletion, objection, portability).

Consent is obtained through a positive action (e.g. checkbox, click on "Accept", or form validation).

The user may withdraw their consent at any time without affecting the lawfulness of prior processing.

4.1. General Principle

Personal data collected by Gabon Connect SARLU is processed lawfully, fairly and transparently, for specific, explicit and legitimate purposes known to the user at the time of collection.

They are in no case subsequently processed in a manner incompatible with these initial purposes.

Each data processing is documented in an internal register describing the purpose, legal basis, recipients, retention period and associated security measures, in accordance with documentation obligations imposed by the CNPD and ANINF.

4.2. Main Processing Purposes

Data collected by Gabon Connect SARLU is used for the following objectives:

4.3. Secondary Purposes

Certain data may also be used for complementary purposes, subject to the user's explicit consent:

• participation in satisfaction surveys, studies or usage polls;
• sending information or newsletters related to digital services or technological innovation in Gabon;
• update notifications, security alerts or new features;
• institutional or event communication (launches, calls for projects, training, partnerships).

These optional processing activities are only activated after obtaining the user's informed consent, which can be withdrawn at any time via the unsubscribe link or by writing to dpo@gabonconnect.com.

4.4. Prohibited Purposes

Gabon Connect SARLU strictly prohibits itself from:

• exploiting data for political, religious, ethnic or ideological purposes;
• reselling, renting, exchanging or commercializing data to third parties without legal basis;
• using data for profiling or automated decision-making producing legal effects on the user, except with express consent or legal obligation;
• transferring data to a State or international organization not compliant with CNPD, ANINF or GDPR guarantees.

4.5. Transparency and Information

In accordance with the principles of transparency and digital accountability, whenever new processing is envisaged, Gabon Connect SARLU:

• informs users clearly before its implementation;
• specifies the exact purpose, legal basis and associated rights;
• updates this policy and the internal processing register;
• conducts, if necessary, a Privacy Impact Assessment (PIA) to evaluate the risks related to the processing.

5.1. Legality Principle

All personal data processing carried out by Gabon Connect SARLU is based on a clearly identified legal basis, in accordance with Gabonese Law No. 001/2011 of September 25, 2011 and Article 6 of the General Data Protection Regulation (GDPR – EU 2016/679).

The company is committed to collecting and processing personal data only within the framework of determined and legitimate purposes, based on a lawful basis among those set out below.

5.2. Applicable Legal Bases

5.3. Documentation and Traceability

Gabon Connect SARLU maintains an internal compliance register listing all processing carried out, their legal basis, purpose, retention period and associated security measures.

This register, regularly updated by the Data Protection Officer (DPO), may be communicated to the CNPD or ANINF upon official request.

Each data collection is accompanied by clear and transparent information allowing the user to know the legal basis applied before any consent validation or information submission.

6.1. General Principle

Gabon Connect SARLU retains personal data only for the period strictly necessary to achieve the purposes for which it was collected, in accordance with the principle of proportionality and current legal requirements.

Beyond this period, data is either permanently deleted or irreversibly anonymized for statistical, research or secure internal archiving purposes.

Specific periods may be imposed by Gabonese law (tax, social, criminal, commercial) or by regulatory obligations from ANINF, CNPD or international conventions (OHADA, GDPR).

6.2. Retention Period Summary Table

6.3. Legal Archiving and Regulatory Obligations

Certain data may be retained beyond the above periods when necessary to:

• comply with a legal obligation (tax, social, judicial);
• defend the rights of Gabon Connect SARLU in case of litigation or audit;
• satisfy technical traceability requirements imposed by ANINF or CNPD;
• comply with contractual obligations with public or private partners.

In this case, data is archived on separate media, accessible only to a limited number of authorized persons and subject to enhanced security rules (encryption, traceability, sealed storage).

6.4. Deletion and Anonymization

Upon expiration of legal retention periods:

• data is permanently erased from all active systems;
• backup copies are subject to scheduled purging;
• data that may still have statistical or historical interest is anonymized using methods approved by the CNPD.

No reuse of deleted or archived data is authorized, except in case of formal legal or judicial constraint.

6.5. Documentation and Control

The Data Protection Officer (DPO) is responsible for monitoring and controlling compliance with retention periods.

An internal retention register is maintained and made available to the CNPD or ANINF upon request.

Each information system operated by Gabon Connect SARLU integrates an automated purge and data lifecycle management mechanism, ensuring compliance of applied retention periods.

7.1. General Confidentiality Principle

Personal data collected and processed by Gabon Connect SARLU is strictly confidential.

• It is only communicated to duly authorized recipients, according to the "need to know" principle, and within the framework of clearly defined purposes.
• Under no circumstances is personal data sold, rented, exchanged or resold to third parties for commercial or advertising purposes.
• Any transmission to a partner or subcontractor is governed by a confidentiality and compliance contract guaranteeing the security, legality and traceability of the processing.

7.2. Internal Recipients

The following may access personal data, within the limits of their duties and subject to authorization:

• internal staff of Gabon Connect SARLU (technical, security, compliance, customer support, communication and administration services);
• the Data Protection Officer (DPO), responsible for compliance monitoring and user rights tracking;
• the legal department and information systems security officers (CISO) in the context of audits, litigation or official requests.

All employees and collaborators are subject to a strict contractual confidentiality clause and regular training on data protection and cybersecurity.

7.3. External Recipients and Technical Partners

Within the framework of the site's operation and interconnected digital services, certain data may be transmitted to service providers or technical partners acting as subcontractors within the meaning of regulations.

These partners are selected for their strict compliance with CNPD, ANINF and GDPR requirements.

• Arsys Internet S.L.U.: ISO/IEC 27001 certified host, based in Spain (EU), guaranteeing a high level of security, availability and compliance.
• Cloud infrastructure and security providers: encryption solutions, firewalls, CDN, system monitoring and auditing.
• Messaging and communication providers: transactional email and newsletter sending platforms, with servers hosted in Europe.
• Payment and financial service providers: authorized operators for secure transaction execution via Gabon Wallet.
• Institutional partners: public administrations or partner organizations within the framework of e-administration platforms operated by Gabon Connect SARLU.

Each subcontractor acts only on written instructions from Gabon Connect SARLU, and implements appropriate technical and organizational measures to guarantee the confidentiality, availability and integrity of processed data.

7.4. Transmission to Authorities and Legal Obligations

Data may be transmitted, in cases provided by law, to:

• the National Digital Agency (ANINF) for supervision and technical compliance needs;
• the National Commission for Data Protection (CNPD) for any regulatory control or declaration;
• judicial, tax or administrative authorities upon official and motivated requisition;
• any regulatory or investigative authority in the context of combating fraud, cybercrime, money laundering or terrorism financing.

In all cases, Gabon Connect SARLU is committed to verifying the legality, legitimacy and proportionality of the request before any data transmission.

7.5. International Data Transfer

Gabon Connect SARLU favors sovereign or regional hosting (Gabon / Central Africa) and, where applicable, the use of providers located in the European Union.

7.6. Access Traceability and Control

Each access, transfer or data manipulation is subject to automatic logging to ensure complete traceability of operations.

These logs are kept in a secure environment for a maximum period of 12 months.

Regular compliance audits are conducted to verify adherence to internal procedures.

7.7. Responsibility and Contractual Commitment

Any recipient or service provider of Gabon Connect SARLU contractually commits to:

• acting only on written and validated instructions from the company;
• implementing security measures compliant with ISO/IEC 27001 standards;
• immediately reporting any incident, leak or unauthorized access to data;
• fully cooperating with the DPO and CNPD in case of audit or investigation.

Gabon Connect SARLU remains fully responsible for data processing, even when carried out by an external subcontractor.

8.1. Security Principle

Gabon Connect SARLU implements a rigorous information security and personal data protection policy, based on the principles of confidentiality, integrity, availability and traceability.

The objective is to ensure that all processed personal data remains protected against loss, destruction, alteration, unauthorized disclosure or unlawful access.

The company applies a risk management approach in accordance with ISO/IEC 27001 and ISO/IEC 27701 standards.

8.2. Technical and Organizational Measures

To guarantee a high level of protection, Gabon Connect SARLU implements a set of measures:

8.3. Governance and Risk Management

Gabon Connect SARLU has implemented an Information Systems Security Plan (ISSP) and a GDPR security compliance register, integrating:

• a Privacy Impact Assessment (PIA) for any new sensitive digital project;
• a risk mapping related to data protection and business continuity;
• periodic penetration tests (pentests);
• a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP).

8.4. Security Incident Management

In case of personal data breach, Gabon Connect SARLU commits to:

• immediately triggering an internal alert protocol;
• notifying the CNPD within a maximum of 72 hours in accordance with Article 33 of the GDPR;
• informing affected individuals if the breach is likely to pose a high risk;
• implementing immediate corrective measures.

Each incident is subject to a documented report, archived and transmitted to the DPO for analysis and follow-up.

8.5. Subcontractor Security

Any subcontractor or technical provider accessing personal data is subject to:

• a subcontracting contract compliant with Articles 28 and 29 of the GDPR and Law No. 001/2011;
• a prior compliance and security assessment;
• regular verification audits;
• an obligation of immediate notification in case of incident.

No subcontractor is authorized to sub-subcontract processing without the prior written agreement of Gabon Connect SARLU.

8.6. Application Security and Responsible Development

Gabon Connect Technology SARLU applies the "Privacy by Design & by Default" principle:

• integration of security and confidentiality from the design phase;
• default settings limiting data collection and exposure;
• vulnerability testing, code review and security validation before each production release;
• periodic compliance audit of APIs and interconnections between platforms.

This approach ensures that deployed technologies respect Gabonese digital sovereignty and user protection requirements.

8.7. Traceability, Supervision and Audit

All actions and access to systems containing personal data are subject to automated traceability:

• complete logging of critical operations;
• centralized supervision and detection of abnormal activities (SIEM / SOC);
• internal GDPR / CNPD compliance audits conducted at least once a year;
• regular backup restoration tests and file integrity verification.

All logs are kept in an encrypted and restricted environment for a maximum period of 12 months.

8.8. Security Awareness and Culture

Information security also relies on human vigilance.

Gabon Connect SARLU promotes a corporate culture focused on cybersecurity and data protection, notably through:

• regular training sessions for employees and contractors;
• internal awareness campaigns on phishing, password management and digital confidentiality;
• designation of security ambassadors within technical and operational teams.

8.9. Continuous Compliance Commitment

The company is committed to maintaining a security level consistent with the state of the art and updating its protection measures based on:

• the evolution of threats and attack techniques;
• new legal or regulatory requirements (ANINF, CNPD, OHADA, GDPR);
• recommendations from internal and external audits.

This commitment is part of a permanent approach to continuous improvement of compliance and digital resilience.

9.1. General Principle

In accordance with the Constitution of the Gabonese Republic, Law No. 001/2011 and the GDPR (EU 2016/679), each user of the website https://gabonconnect.com has a set of fundamental rights relating to their personal data.

Gabon Connect Technology SARLU fully recognizes these rights and guarantees their effective exercise.

9.2. Detailed Rights

9.3. How to Exercise Rights

The rights listed above may be exercised:

• by email: dpo@gabonconnect.com;
• or by postal mail addressed to:
  Gabon Connect Technology SARLU – Data Protection Service
  160, Rue Cheikh Ahmadou Bamba Mbacké - Bd Triomphal (montée de Sotega), B.P. 5817, Libreville-Gabon

The request must specify:

• the identity of the requester (copy of official ID attached);
• the right they wish to exercise;
• the elements necessary to locate the data concerned.

A response will be provided within a maximum of 30 business days, except in cases of particular complexity (extension possible up to 60 days).

In case of refusal, Gabon Connect SARLU will justify its decision and inform the user of available remedies.

9.4. Right to Complain to the Supervisory Authority

If the user believes their rights are not being respected, they may file a complaint with:

National Commission for Data Protection (CNPD)
Libreville – Gabonese Republic

Users residing in another country may also contact the competent supervisory authority of their place of residence in accordance with Article 77 of the GDPR.

9.5. Free and Confidential Procedures

The exercise of rights is free of charge.

Gabon Connect Technology SARLU reserves the right to charge reasonable fees in case of manifestly excessive, repetitive or unfounded requests.

All requests are processed in strict compliance with the confidentiality and security of exchanges, under the supervision of the DPO.

10.1. Definition and Principle

When visiting the website https://gabonconnect.com, cookies or similar technologies may be placed on the user's device.

A cookie is a small text file stored on the user's browser to store temporary information about their browsing or preferences.

These cookies may be:

• technical, necessary for the proper functioning of the site;
• analytical, intended to measure traffic and improve performance;
• functional, allowing personalization of the user experience;
• advertising or social media, used for targeting or content sharing.

No non-essential cookie will be activated without the user's prior, free and explicit consent.

10.2. Types of Cookies Used by Gabon Connect

Cookies issued by external services are subject to their own privacy policies.

10.3. User Consent

On their first visit to the site, an information banner informs the user of the presence of cookies and allows them to:

• accept, refuse or customize their deposit preferences;
• access this policy to learn more about their purposes.

Consent is retained for a maximum of 13 months.

Upon expiration of this period, new consent will be requested.

The user may modify their choices at any time via the "Manage my cookies" module accessible at the bottom of the site page.

10.4. Cookie Management and Deactivation

The user has several options to manage or delete cookies:

10.5. Cookies Exempt from Consent

Certain cookies strictly necessary for the site's operation are exempt from consent:

• authentication cookies;
• session cookies;
• load balancing cookies;
• technical personalization cookies requested by the user.

These cookies are essential and can only be disabled by manually modifying browser settings.

10.6. Third-Party Cookies and Liability

The site may include embedded content from third-party platforms.

These services may place their own cookies, independent of Gabon Connect SARLU's control.

The company cannot be held liable for subsequent processing carried out by these third parties.

Users are invited to consult the privacy policies of these providers:

• YouTube (Google): https://policies.google.com/privacy
• LinkedIn: https://www.linkedin.com/legal/privacy-policy
• Facebook / Meta: https://www.facebook.com/privacy/policy

10.7. Tracker Traceability and Security

All cookies placed by Gabon Connect SARLU are subject to:

• unique identification and expiration control;
• centralized management and secure logging;
• annual CNPD/ANINF compliance audit conducted by the DPO.

No data collected by cookies is cross-referenced with other nominative databases without explicit consent.

10.8. Transparency Commitment

Gabon Connect SARLU is committed to maintaining full transparency on:

• the updated list of cookies and trackers used;
• their validity periods;
• their exact purposes and legal bases.

This policy will be updated each time a cookie is added, modified or removed.