Privacy Policy

1. Data controller

SODACARDS, NINEA 012424628, Dakar, Senegal. Email: contact@sodacards.com

We process your data in accordance with Law No. 2008-12 of 25 January 2008 on the protection of personal data in Senegal, under the supervision of the Personal Data Protection Commission (CDP), the independent administrative authority established by that same law.

2. What we collect, and why

We only collect what the Platform needs in order to work. No data is requested as a precaution.

Data	When	Why	Legal basis
Email address	when you create an account	to identify you, send you your codes, keep you informed about your orders and your account (delivery, refund, an order that could not be completed, store credit or Soda Coins about to expire), reset a password	performance of the contract
Display name	optional	to name you in the interface	your consent
Password	at sign-up	never stored in clear text, only an encrypted fingerprint is kept	performance of the contract
Google account	if you choose that sign-in method	to identify you without a password	your consent
Phone number	at payment	required by the mobile money provider	performance of the contract
WhatsApp number	if you turn on WhatsApp in your account, after confirming the number with a code	to send you updates about your orders on WhatsApp	your consent, which you can withdraw at any time from your account
Email address, for our offers	if you accept it in your account	to remind you of a basket left waiting and tell you about our offers	your consent, which you can withdraw at any time from your account
Messages sent to customer support, with the number or address they come from	when you write to us, by email or on WhatsApp	to answer you and link your request to your account and your orders	performance of the contract
Player ID	when buying a top-up	to credit your game account	performance of the contract
Email address of a service account	when buying a subscription or an access	to send you an invitation or your login details	performance of the contract
Country and language	on your visit	to show the currency and products that concern you	legitimate interest
Order history	with every purchase	so you can find your codes again	accounting obligation
Transaction data	with every payment	to detect fraud and enforce limits	legitimate interest and legal obligation
Meta advertising identifier (_fbp, _fbc)	on your visit, after you accept	to measure our campaigns and avoid showing you an ad if you have already bought	your consent
Audience analytics identifier (Google Analytics 4)	on your visit, after you accept	to understand what prevents people from buying and improve the Platform	your consent
Arrival source (utm parameters, referring site, landing page)	on your visit, then kept with the order	to know which ad or link brought a customer in	legitimate interest
Advertising click identifier (fbclid) and when it was first seen	on arrival from an ad, before you answer anything	to tie a purchase to the ad that produced it, even if you accept measurement later	legitimate interest, and erased if you refuse measurement
Email address and phone number, in hashed form	at purchase, after you accept	to match a purchase with the ad that produced it	your consent

We do not collect your date of birth, your postal address, your identity document, or your banking details.

Where your email address or phone number is sent to an advertising platform, it is sent only in hashed, irreversible form. Those platforms never receive this information in clear text, and it is neither sold nor rented.

3. Minimum age

Our services are intended for people aged eighteen or over, or who have the permission of their parents or legal guardians. We do not knowingly collect a child's data. If you become aware that such an account exists, write to us and we will delete it.

4. The visitor's country

We infer your country from your connection in order to offer you the right currency. This is a suggestion, not a decision. We ask you to confirm it, and your refusal is remembered. This inference creates no profile and is used for no other purpose.

5. Who receives your data

Your data is only passed to the recipients who need to process it.

1. Payment providers, Bictorys and InTech, to carry out the transaction.
2. Product suppliers, to credit a top-up, and only the player ID, never your identity.
3. Our host and technical tools, for error monitoring and sending emails.
4. Botsailor and WhatsApp (Meta), for exchanges on WhatsApp: order updates, only if you have turned them on, and conversations with support when you write to us on WhatsApp. Your number is then passed to them as is, since it is how they reach you.
5. Meta and Google, to measure our advertising campaigns and analyse audience, only if you have consented. These recipients receive no clear-text data that directly identifies you.

We neither sell nor rent your data to anyone.

6. Transfers outside Senegal

Some of our technical providers and product suppliers are established outside Senegal. Fulfilling your order may therefore involve transferring data to those countries, in particular the player ID needed for a top-up.

These transfers are limited to what performance of the contract requires. We make sure our providers offer appropriate security safeguards and we send them no data that is not necessary to them.

Meta and Google, as well as Botsailor and WhatsApp when you exchange with us on WhatsApp, also process your data outside Senegal, under their own privacy policies. For measurement and advertising, this processing only takes place with your consent, and you can withdraw it at any time.

7. Retention periods

1. Account: kept for as long as it exists, then deleted on request.
2. Orders and accounting records: kept for ten years, in accordance with the OHADA Uniform Act on accounting law and financial reporting.
3. Technical logs: twelve months at most.
4. Measurement and advertising data: kept for the periods applied by Meta and Google, and erased from our own tools after twenty-six months at the latest.
5. Origin cookie (sc_origine): ninety days from your arrival.

An order cannot be erased on request, because it is an accounting record. Your account can be. The accounting entry then remains without naming you.

8. Your rights

You have the following rights at any time.

1. Access the data we hold about you.
2. Have it corrected if it is inaccurate.
3. Request its deletion, subject to our accounting obligations.
4. Object to processing based on our legitimate interest.
5. Request the restriction of processing you dispute.
6. Withdraw your consent where processing relies on it, in particular for measurement and advertising cookies, WhatsApp messages and our offers by email.

Write to contact@sodacards.com. We reply within thirty days.

You may also refer the matter to Senegal's Personal Data Protection Commission (CDP).

9. Security

Traffic is encrypted. Passwords are hashed. Access to data is logged and limited to the people who need it. We monitor transactions in order to detect fraud.

No system is infallible. In the event of a breach affecting your data, we will inform you and the competent authority.

10. Cookies

We use three categories of cookies.

Necessary cookies, which keep the service working, do not require your agreement and cannot be turned off: your session, your country, your language, your basket, and any refusal of the country suggestion.

Our own origin cookie, sc_origine, set as soon as you arrive, before you answer anything: an advertising click does not come round again, and without it the information is lost at the first page change. For ninety days it holds the four campaign parameters of the address (source, medium, campaign, content), the page that sent you, the landing page, and the advertising click identifier. Only our server can read it, it carries neither your name nor your address, and nothing leaves it for an ad platform until you have accepted measurement. The click identifier is treated separately: it is erased if you refuse measurement, while the source and campaign are kept under our legitimate interest.

Third-party measurement and advertising cookies, set by Meta and Google Analytics 4, which let us understand what works on the Platform and evaluate our campaigns. They are only set after you accept and you can refuse them without this limiting your access to the service in any way.

You can change your choice at any time from the link at the foot of the page, or by deleting cookies in your browser settings.

We sell no data to advertisers and we build no advertising profile beyond measuring our own campaigns.

11. Changes to this policy

Any change is published on this page with its date. Where a change affects your rights, we will inform you by email before it takes effect.