Privacy Policy
How KYA SMS (published by ETABLISSEMENT CC AFRICA) collects, uses and protects your personal data, across all platform services.
Last updated : November 14, 2026
Introduction
This Privacy Policy describes how ETABLISSEMENT CC AFRICA ("we"), publisher of the KYA SMS platform available at kyasms.com, collects, uses, shares and protects the personal data of users and customers ("you").
It covers all platform services: KYA SMS (SMS, OTP, campaigns), KYA MAILER (transactional email, campaigns and mailbox), KYA Tickets and KYA Chat (customer service by tickets, live chat and WhatsApp), KYA Factures (quotes and invoices) and the KYA Tickets AI assistant.
As a Value Added Service (VAS) licensed by ARCEP in Benin, we process your data in accordance with the Benin Digital Code (Law No. 2017-20 of 20 April 2018) and under the supervision of the Personal Data Protection Authority (APDP). For our Nigerian subsidiary, we also comply with the Nigeria Data Protection Act (NDPA 2023). For international customers, our practices are aligned with the EU GDPR.
By using our services, you accept the practices described in this policy.
Data Controller
The controller of your personal data is:
- Business
- CC AFRICA
- Headquarters
- Cotonou, Bénin
- Subsidiary
- CC-AFRICA GLOBAL BUSINESS HUB — 3, Oriomi-Sokori, Abeokuta, Ogun, Nigeria
- Data Protection Officer (DPO)
- [email protected]
Data we collect
We only collect data necessary to provide and improve our services:
Identification and account data
- Name, company name
- Email address and phone number
- Login credentials (hashed password, API keys)
- Sender ID and company information
Service usage data
- Sending metadata (recipient numbers, timestamp, delivery status, operator, cost)
- Content of messages sent (processed on your behalf — see "Our role")
- Campaign history, statistics and API call logs
Billing data
- Billing details
- Transaction and top-up history
- Payment method (full card details are handled by our payment providers, never stored by us)
Technical data
- IP address, browser and device type
- Connection and security logs
- Cookies and similar identifiers
Email data (KYA MAILER)
- Sender and recipient addresses, subject, content and attachments of emails sent or received through our services
- Delivery information: statuses, opens and clicks when tracking is enabled, SPF, DKIM and DMARC results
Customer service data (KYA Tickets and KYA Chat)
- Content of tickets and chats exchanged between our business customers and their own customers
- Name, email address or phone number provided by the latter
- For visitors of a website using the KYA Chat bubble: IP address, country derived from the IP address and, if the business enabled it, pages viewed
WhatsApp data
- When a business connects its WhatsApp Business number: its WhatsApp Business account ID, phone number and display name
- For its contacts: WhatsApp number, WhatsApp profile name, content of messages and files exchanged, sent, delivered and read statuses
Billing data of our customers' customers (KYA Factures)
- Identity, contact details and tax number (IFU) of the business's customers
- Lines and amounts of quotes and invoices
- Electronic signature evidence for quotes (name, IP address, date)
Purposes and legal bases
We process your data for the following purposes, each based on a legal basis:
| Purpose | Legal basis |
|---|---|
| Provide and perform the service (SMS, OTP, API) | Performance of contract |
| Send and receive emails, chats and WhatsApp messages on behalf of our customers | Performance of contract |
| Suggest replies and summaries to agents with the AI assistant, when the business enables it | Performance of contract |
| Certify invoices with the Benin tax authority, when the business enables it | Legal obligation |
| Account management and customer support | Performance of contract |
| Billing and accounting | Legal obligation |
| Security, fraud and abuse prevention | Legitimate interest |
| Service improvement and statistics | Legitimate interest |
| Marketing communications | Consent |
| Compliance with legal and regulatory obligations | Legal obligation |
Our role: controller or processor
For your account data (identification, billing, usage), KYA SMS acts as the data controller.
For the content of the SMS you send and the numbers of your own recipients, you are the data controller and KYA SMS acts as a processor, handling this data only on your instructions to route your messages.
The same rules apply to emails, tickets, chats, WhatsApp conversations and invoices: for this content, the business customer is the controller and KYA SMS acts as a processor, on its instructions.
International transfers
Your data may be processed in Benin, Nigeria and by our hosting providers, which may be located outside your country. The very operation of the SMS service involves transmission to operators in the destination country.
WhatsApp messages are processed by Meta, whose servers may be located outside Benin, including in the European Union and the United States. The artificial intelligence providers mentioned above process data in the United States.
When data is transferred outside Benin, we implement appropriate safeguards (contractual commitments, security measures) in accordance with the Benin Digital Code and, where applicable, GDPR standard contractual clauses.
Data retention
We keep your data only as long as necessary for the purposes pursued:
| Category | Retention period |
|---|---|
| Account data | Duration of the contract, then 3 years |
| SMS logs and metadata | 12 months (deliverability, disputes, security) |
| Billing documents | 10 years (accounting obligation) |
| Security / connection logs | 12 months |
| Messages of @kyasend.com addresses | 90 days (no limit for a verified business), unless deleted by the customer |
| Content of emails sent through the API | Depending on the plan, 3 to 30 days; delivery information 12 months |
| Tickets, chats and WhatsApp conversations | For the life of the business customer's account, unless deleted by it |
| IP address and pages viewed by KYA Chat visitors | 30 days |
| Quotes and invoices (KYA Factures) | 10 years (accounting obligation) |
| Text sent to the AI assistant | Not kept outside the ticket or chat concerned |
| Marketing data | Until consent is withdrawn |
Data security
We implement technical and organizational measures to protect your data:
- Encryption of communications (HTTPS/TLS) and sensitive data
- Hosting with specialized providers, in secure data centers
- Strict access control and least-privilege principle
- Two-factor authentication (2FA) and scoped API keys
- Monitoring, logging and regular backups
Your rights
In accordance with the Benin Digital Code and the GDPR, you have the following rights:
- Right of access to your data
- Right of rectification
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to portability
- Right to object
- Right to withdraw consent at any time
Children's data
Changes to this policy
We may update this policy to reflect legal or service changes. Any significant change will be indicated on this page, with the date above updated. We invite you to review it regularly.
Contact us
For any questions regarding this policy or your personal data: