Privacy notice
Nchemty Credit Union Cooperative · Bokwango, Buea, South West Region, Cameroon · infos@nchemty.com · +237 679 923 521
This policy explains what personal data Nchemty Credit Union Cooperative (“Nchemty”, “we”) collects when you use Nchemty Digital Banking, why we use it, who we share it with, how long we keep it and what rights you have. Nchemty Digital Banking means our website www.nchemty.com and its client area, our e-banking service at ebank.nchemty.com, the Nchemty mobile app, our mobile-money top-up and cash-out services, and our chat and agent services.
1. Who is responsible for your data
Nchemty Credit Union Cooperative, a microfinance institution registered under [REG. NO.] and approved by the Banking Commission of Central Africa (COBAC) under approval [APPROVAL NO.], with its head office at Bokwango, Buea, South West Region, Cameroon, is the controller of your personal data.
For any question about your data or to exercise your rights, contact our data protection contact: [DPO NAME], [dpo@nchemty.com], or write to the head office. General enquiries: infos@nchemty.com, +237 679 923 521.
2. Who this policy covers
This policy applies to:
- members and customers who use our digital services;
- applicants who start or submit an account application online, even if no account is opened;
- the directors, signatories, beneficial owners and representatives of associations, njangi groups and companies;
- visitors to our website and people who chat with us or contact us;
- beneficiaries and senders of transfers, as far as we receive their details.
It does not cover websites or services of third parties (for example mobile-money operators), which have their own policies.
3. The laws we follow
We process personal data in accordance with Law No. 2024/017 of 23 December 2024 on personal data protection in Cameroon, the CEMAC regulation of 11 April 2016 on the prevention and repression of money laundering and terrorist financing, the rules of COBAC and the Bank of Central African States (BEAC), and the professional secrecy that binds financial institutions.
4. The data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Identity | Full name, date and place of birth, sex, nationality, marital status, photo | You |
| Identity documents | Photos of your national ID card, passport, residence permit or other accepted document, and the details read from them (number, dates, machine-readable zone) | You |
| Biometric data | A live selfie and the short video frames taken during the identity check, a passport-style photo, a signature drawn on screen, and a face descriptor (a list of numbers computed from your face for comparison, not a picture) | You, through our identity check |
| Contact | Address, phone numbers, e-mail address, preferred language | You |
| Professional and financial | Occupation, employer, income range, source of funds, purpose of the account, expected activity, tax residence and tax number | You |
| Due diligence | Whether you or a close associate are a politically exposed person; results of sanctions and watch-list screening; risk assessment | You, public lists, our checks |
| Organisations | Registration documents, statutes, minutes and resolutions, list of directors, signatories and beneficial owners with their identity data, signing rules | The organisation and its representatives |
| Account and transactions | Account numbers, balances, deposits, withdrawals, transfers, loan and savings records, fees | Our core banking system |
| Mobile money | Mobile-money number, operator, amounts, dates, references and status of top-ups and cash-outs | You, the mobile-money operator |
| Digital access | Login name, encrypted passwords, one-time codes sent, registered devices, sign-in history, security events | Our systems |
| Device and usage | Device type, operating system, browser, app version, pages and screens used, approximate location (country and town) worked out from your internet address, crash reports | Our systems |
| Communications | Chats, messages, e-mails, complaints, call notes and support tickets | You, our staff |
| Referral | The agent who introduced you and the commission paid | Our agent network |
We do not keep your full internet address: its last part is removed. We do not collect your precise GPS location, your contacts or your photos library, and the mobile app uses the camera only when you take an identity photo or selfie.
Giving us identity, contact and due-diligence information is required by law to open and keep an account; without it we cannot provide the service.
5. Why we use your data, and on what basis
| Purpose | Legal basis |
|---|---|
| Checking your identity, opening and running your accounts, executing your instructions, providing e-banking, the app and mobile-money services | Performance of our contract with you |
| Customer due diligence, risk assessment, monitoring transactions, keeping records, reporting suspicious transactions and answering lawful requests from authorities | Legal obligation (anti-money-laundering and banking regulation) |
| Preventing and detecting fraud, securing accounts and devices, protecting our systems | Legal obligation and our legitimate interest in protecting you and Nchemty |
| Handling questions, complaints and chats | Contract and legitimate interest |
| Calculating and paying agent commissions | Legitimate interest and our contract with the agent |
| Improving our services, statistics on how our website and app are used, measuring campaigns | Legitimate interest |
| Sending you offers and news about our products | Your consent, which you can withdraw at any time without affecting your accounts |
6. Automated checks and decisions
When you open an account online, our systems read your identity document, check that you are physically present (liveness), compare your selfie with your document photo and search for duplicate identities. These checks produce a report and a risk score that help our staff. Every decision to open, refuse or close an account is taken by a person. You can ask for a human review of any check and give your point of view.
Our identity checks run on our own servers. Your documents and selfie are not sent to any outside identity-verification company.
7. Who receives your data
Your data is covered by professional secrecy (see our Confidentiality agreement). Inside Nchemty, only staff who need it for their work can see it, and every view of an identity document is recorded. We share data only with:
- authorities entitled by law: COBAC, BEAC, the National Financial Investigation Agency (ANIF), the courts, the tax administration and the data protection authority, when the law requires or allows it;
- mobile-money operators (MTN Mobile Money and, when available, Orange Money), limited to what is needed to carry out the top-ups and cash-outs you request;
- our service providers, under written contracts that require confidentiality and security and forbid any other use: core banking software and hosting, website and server hosting, SMS and e-mail delivery, encrypted backup storage, and IT support;
- the agent who introduced you, limited to the status of your application and the commission due, never your documents or balances;
- other parties to a transaction (for example the beneficiary of a transfer), limited to the details a payment normally carries;
- a successor, if Nchemty merges with or transfers its business to another institution, as the law allows.
We never sell your personal data.
8. Transfers outside Cameroon
Some of our providers store or process data outside Cameroon: [COUNTRIES, e.g. the hosting of our website and backups]. Such transfers take place only with the authorisation of the data protection authority where the law requires it [REF.], and with contractual safeguards that protect your data to the same standard. You can ask us for details of these safeguards.
9. How long we keep your data
| Data | Kept for |
|---|---|
| Identity documents, account-opening file and due-diligence records | 10 years after the account is closed or the relationship ends (CEMAC anti-money-laundering regulation, art. 38) |
| Transaction and mobile-money records | 10 years after each transaction |
| Face descriptors of applications that were rejected or abandoned | Deleted after 90 days |
| Applications started but never submitted | Deleted on request, or after [12] months without activity |
| Chats, support tickets and complaints | [5] years after they are closed |
| Website and app usage records | 365 days, unless linked to your customer file |
| Sign-in and security logs | [2] years |
| Encrypted backups | Overwritten in rotation; restored only to recover from an incident |
At the end of these periods we delete or anonymise the data. While we keep data only to meet a legal obligation, it is locked and used for nothing else.
10. How we protect your data
- Encryption of all connections (HTTPS) and, at rest, of identity numbers, application answers and face data.
- Identity documents stored outside the public website, visible only to you and to authorised staff.
- Staff access with a password and a one-time code, limited to their role, with an audit trail.
- E-banking protected by a separate password, codes sent by SMS and e-mail, and confirmation of new devices.
- Identity checks run on our own servers; signed, encrypted connections between our systems.
- Encrypted backups kept in two places.
- Confidentiality obligations for staff, agents and providers.
If a security incident puts your data at risk, we contain it, notify the data protection authority as the law requires, and inform you when it may affect you.
11. Your rights
You have the right to:
- access your data and obtain a copy;
- correct data that is inaccurate or incomplete;
- delete data we no longer need or have no right to keep;
- object to the use of your data based on our legitimate interest, and at any time to marketing;
- withdraw your consent where we rely on it;
- restrict the use of your data while a request is examined;
- ask for a human review of an automated check;
- complain to the data protection authority.
Send your request to [dpo@nchemty.com], through the client area, or by letter to the head office. We may ask you to prove your identity. We answer within one month, free of charge. Some rights are limited by law: for example, we cannot delete records we must keep for anti-money-laundering purposes.
12. Closing your account and deleting your data
You can ask us to close your accounts, or to delete your online profile if no account was opened, at any time through the page www.nchemty.com/account-closure, without using the app. Section 9 explains what we must keep and for how long; everything else is deleted.
13. Cookies and similar technologies
Our website uses only cookies needed for it to work (session, security, language) and one first-party cookie that recognises your browser between visits for our own statistics. The location shown in our statistics is worked out on our own servers with IP Geolocation by DB-IP (db-ip.com). We do not use advertising or third-party tracking cookies. The mobile app stores only what it needs to keep you signed in securely and remember your settings.
14. Children
Accounts for people under 18 are opened and operated with a parent or legal guardian, who exercises their rights on their behalf.
15. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the current version. We inform customers of important changes by e-mail or in the app before they apply.
Last updated October 27, 2026