Privacy Policy

1. Data controller

The data controller is the publisher of T-Drop, a natural person established in Cameroon. Their identity is not published on the site, as permitted for non-professional publishers (see the terms of use), but it is withheld from no one: it is disclosed without delay to any supervisory authority that requests it, and to anyone with a legitimate interest, in particular to exercise their rights or lodge a complaint.

No data protection officer has been appointed: requests are handled directly by the publisher, at contact@tdrop.org.

2. Data we collect

We only collect data necessary to run the service:

• Account: email address, password (stored hashed, never in clear text), display name, country, preferred language and currency, and phone number if you provide one.
• Identity verification (KYC): only the verification result, its date and the provider used. No image of your ID document is kept on our servers — it is sent directly to the verification provider.
• Forwarders: legal name, registration number, contact details, and the public contact details you choose to publish.
• Activity: messages exchanged, shipment requests, carts, ratings, and the contact-disclosure log.
• Sponsorship payment: amount, currency, status and payment provider references. We store no card data.
• Technical data needed for security and proper operation (access logs, session identifier).

3. Purposes and legal bases

• Provide the service (account creation, matching, messaging) — performance of the contract.
• Verify identity before a transaction — security obligation and legitimate interest in preventing fraud.
• Share your phone number with a verified forwarder who takes on your trip — on the basis of your consent, collected and time-stamped at publication.
• Process forwarder sponsorship payments — performance of the contract.
• Ensure security, prevent abuse and handle disputes — legitimate interest.

4. Recipients

Your data is never sold. It is accessible to our technical processors, strictly for the needs of the service:

• Database, authentication and file storage: Supabase PTE. LTD. (Singapore), hosted in the European Union (Ireland).
• Website hosting and delivery: Netlify, Inc. (United States).
• Identity verification: the KYC provider configured for your country.
• Payment: the configured payment provider (mobile money, card depending on country).
• Verified forwarders: your name and phone are shared with them only if they take on your trip and you have consented; every disclosure is logged.

5. Transfers outside your country

Your account and activity data is hosted in the European Union, in Ireland. The website itself is delivered by a global content delivery network, which involves no storage of your personal data outside that hosting.

Our technical providers are established outside the European Union: Supabase PTE. LTD. in Singapore, and Netlify, Inc. in the United States. They may access data from those countries for support and maintenance purposes. Such access is framed by the European Commission’s standard contractual clauses set out in their data processing agreements.

Finally, platform administration and dispute handling are carried out from Cameroon, a country not covered by an adequacy decision of the European Commission. Such access is limited to what is necessary to operate the service and subject to the same confidentiality requirements.

6. Retention periods

We apply the following periods, which are maximums: data that is no longer needed is deleted before they expire.

• Account data: kept while the account exists, then deleted within 30 days of its closure, unless a legal obligation requires otherwise.
• Listings, trips, shipment requests and carts: 3 years from the last action concerning them.
• Messages exchanged: 3 years from sending.
• Identity verification (result and date, no document image): 3 years from account closure, for evidence purposes.
• Contact-disclosure log: 3 years, for evidence purposes in case of a dispute.
• Administration action log: 3 years.
• Items added to a dispute file: until the deletion date set when they were added, and at the latest 5 years after the dispute is closed.
• Sponsorship payments: 10 years, under accounting obligations.
• Technical access and security logs: 12 months.

7. Your rights

Under applicable law (GDPR and equivalent local laws), you have the following rights:

• Access to your data and a copy.
• Rectification of inaccurate data.
• Erasure, within the limits of our legal obligations.
• Restriction of and objection to processing.
• Portability of the data you provided.
• Withdrawal of your consent at any time, without retroactive effect.
• Lodging a complaint with the competent supervisory authority.

To exercise these rights, write to contact@tdrop.org stating the email address linked to your account. We reply within one month, extendable by two months for complex requests, in which case we will tell you. If you believe your rights are not respected, you may lodge a complaint with the competent supervisory authority in your country of residence.

8. Security

We implement appropriate technical and organisational measures: encrypted communications, isolation of sensitive data, access control, and minimisation (for example, no ID document image is kept).

9. Cookies

We only use cookies strictly necessary for the service to work. Details in our cookie policy.

10. Changes

This policy may change. The last-updated date appears at the top of the page. In case of a substantial change, we will inform you.