Publisher. Nexus is a product and a trademark published and operated by Neero SAS, a French société par actions simplifiée. Neero SAS is the legal entity that undertakes the commitments described in this policy and with which the Client contracts. Complete legal information about the Publisher (share capital, RCCM registration, registered office) is set out in our Terms of Use.
Preamble.
Nexus places the highest importance on privacy and personal data protection. We commit to processing your data in compliance with Regulation (EU) 2016/679 of April 27, 2016 (GDPR), the French "Informatique et Libertés" law as amended, and all applicable national laws in the territories where we operate (Ivory Coast, Senegal, Cameroon, Benin, Morocco, etc.).
This policy applies to all data processed by Nexus via its websites, applications, APIs, dashboards and any other services provided under the Nexus brand.
Data controller.
The data controller within the meaning of Article 4.7 GDPR is Neero SAS, a Cameroonian société par actions simplifiée (OHADA), registered with the Trade and Personal Property Credit Register (RCCM) of Douala under number RC/DLA/2022/B/6628, whose registered office is located in Douala, Cameroon, as publisher and operator of the Nexus Platform.
For any question on data protection, to exercise your rights (access, rectification, erasure, portability, objection, restriction) or to contact our Data Protection Officer (DPO), please email dpo@nexus-africa.io.
You also have the right to lodge a complaint with a competent supervisory authority, notably the Commission Nationale de l'Informatique et des Libertés (CNIL) in France, or the data protection authority of your country of residence.
Personal data collected.
Nexus collects several categories of personal data depending on your relationship with our services:
Identification data
- First and last name, date and place of birth, gender, nationality
- ID document (national ID, passport, residence permit) with photo
- National identifier number (if applicable)
- Biometric "selfie" for KYC verification
- Postal address and proof of address
Contact data
- Email address, mobile phone number
Financial data
- Mobile Money wallet numbers, IBAN, bank account numbers
- Transaction history, amounts, timestamps, counterparties
- Payment card data (tokenized, never in cleartext)
Business data
- Company name, role, industry
- Corporate legal documents (registration, statutes, beneficial owners)
Technical data
- IP address, user-agent, device type, OS
- Session identifiers and cookies
- API connection and usage logs
- Approximate geolocation (country, city)
Processing purposes.
Nexus processes your data only for specified, explicit and legitimate purposes:
| Purpose | Data categories |
|---|---|
| Provision of payment services and transaction execution | Identification, financial, technical |
| Identity verification (KYC) and AML/CFT | Identification, contact, business |
| Fraud prevention and suspicious activity detection | Transactions, technical, behavioral |
| Regulatory reporting obligations | Transactions, identification |
| Customer relations, technical support, complaints | Contact, interaction history |
| Service improvement and anonymized statistics | Technical, behavioral |
| Marketing communications (with consent) | Contact |
| Collections and litigation | Identification, financial |
Legal bases.
- Contract performance (Article 6.1.b GDPR) — delivery of subscribed services.
- Legal obligation (Article 6.1.c GDPR) — KYC, AML/CFT, reporting to regulators.
- Legitimate interest (Article 6.1.f GDPR) — fraud prevention, service improvement, platform security.
- Consent (Article 6.1.a GDPR) — marketing communications, non-essential cookies, biometric data.
Retention periods.
| Data | Retention |
|---|---|
| KYC and identification data | 10 years after relationship closure (AML/CFT obligation) |
| Transaction history | 10 years after the transaction |
| Technical logs | 12 months |
| Audit logs (security) | 10 years (non-repudiation) |
| Tokenized card data | Contract duration + 13 months |
| Prospects without order | 3 years after last contact |
| Analytics cookies | 13 months |
After these periods, data is either deleted or irreversibly anonymized for statistical purposes.
Data recipients.
- Authorized internal teams: compliance, finance, support, risk.
- Subcontractors and technical providers: cloud hosting, email/SMS, KYC/screening, analytics tools.
- Banking partners and Mobile Money operators: Orange Money, Wave, MTN, Moov, YAS, Airtel — strict minimum required for transaction execution.
- Regulatory and judicial authorities: BEAC, BCEAO, COBAC, TRACFIN, CENTIF, courts, upon valid request.
- External auditors: statutory auditors, certification auditors — under confidentiality agreement.
Nexus never sells your data to third parties. No personal data is ever transferred to data brokers, marketing networks or advertising platforms, for any purpose.
Transfers outside the European Union.
Nexus hosts data primarily in Africa (WAEMU/CEMAC data centers) and the EU (Paris, Dublin). Some transfers may occur to other countries for cross-border payment execution.
These transfers are framed by appropriate GDPR safeguards:
- Standard Contractual Clauses (SCC) from the European Commission for non-EU transfers.
- Adequacy decisions from the European Commission (where applicable).
- Binding Corporate Rules (BCR) within the Nexus group.
Your rights on your data.
Under GDPR, you have the following rights:
To exercise your rights, send your request to dpo@nexus-africa.io with a proof of identity. We respond within one month, extendable by two months for complex requests.
If you believe your rights are not respected, you can file a complaint with a supervisory authority: CNIL in France, ARTCI in Ivory Coast, CDP in Senegal, APDP in Benin, CNDP in Morocco.
Cookies and tracers.
Nexus uses cookies and similar technologies to ensure site functionality, measure audience and improve your experience. You can modify your preferences at any time via the consent banner or browser settings.
Strictly necessary cookies
Essential for site functioning (session, security, CSRF). No consent required.
Audience measurement cookies
We use a privacy-respecting analytics tool with anonymized IP.
Third-party cookies
Only set after your explicit consent. You can refuse without impact on your navigation.
Data security.
Nexus implements appropriate technical and organizational measures to protect your data against destruction, loss, alteration, disclosure or unauthorized access.
- TLS 1.3 encryption in transit, AES-256 at rest
- Environment separation (prod / pre-prod / dev)
- Mandatory MFA for internal access
- Annual pentests by certified firms
- Permanent bug bounty program
- PCI-DSS Level 1, ISO 27001, SOC 2 Type II certifications
In case of a data breach likely to create a risk for your rights, we notify the supervisory authority within 72 hours and, where applicable, the affected individuals.
Minors data processing.
Nexus services are restricted to persons aged 18 and over or emancipated minors. We do not knowingly collect data about minors without prior authorization from a legal guardian.
Policy changes.
Nexus may modify this policy to reflect evolutions in its services, regulation or best practices. Substantial changes will be notified by email and/or via your dashboard at least 30 days before entry into force.
Data Protection Officer contact.
Data Protection Officer — Nexus
Email: dpo@nexus-africa.io
Mail: DPO — Neero SAS, Douala, Cameroon