Privacy Policy

Electronic communications

the emission, transmission or reception of signs, signals, writing, images or sounds, by electronic or magnetic means;

Consent of the data subject

any express, unequivocal, free, specific and informed expression of will by which the data subject or their legal, judicial or contractual representative accepts that their personal data be subject to manual or electronic processing;

Recipient of personal data processing

any person authorized to receive communication of such data, other than the data subject, the data controller, the processor, and persons who, by virtue of their duties, are responsible for processing the data. However, legally authorized public authorities may, within the framework of a specific mission or the exercise of a right of communication, request the data controller to communicate personal data to them;

Personal data

any information relating to a natural person who is identified or identifiable, directly or indirectly, by reference to an identification number or to one or more elements specific to their physical, physiological, genetic, psychological, cultural, social or economic identity;

Sensitive data

all personal data relating to religious, philosophical, political, or trade union opinions or activities, to sexual or racial life, health, social measures, prosecutions, criminal or administrative sanctions;

Health-related data

any information concerning the physical and mental state of a data subject, including the aforementioned genetic data;

Personal data file

any structured set of data accessible according to specific criteria, whether that set is centralized, decentralized or distributed in a functional or geographical manner;

Identification

the process by which a financial institution collects, on a declarative basis, the information necessary to establish the identity of natural persons, legal entities, trusts or similar legal arrangements;

Electronic identification

the process of using personal identification data in an electronic form unambiguously representing a natural or legal person, or a natural person representing a legal entity;

Customer due diligence measures

all measures to be implemented by financial institutions for the identification, verification of identity and knowledge of the customer, within the meaning of AML/CFT/CPF regulations;

Means of electronic identification

a material and/or immaterial element containing personal identification data, used to authenticate oneself for an online service;

Atypical operation

an unusual operation, notably by its nature, amount, frequency, geographical origin or destination, complexity or the absence of an apparent economic justification or lawful purpose;

Data subject

any natural person whose personal data is being processed;

Data controller

the natural or legal person, public or private, any other organization or association which, alone or jointly with others, decides to collect and process personal data and determines the purposes of the processing;

Processor

any natural or legal person, public or private, any other organization or association that processes data on behalf of the data controller;

Remote service

any value-added service offering, based on telecommunications and/or computing, intended to enable, interactively and remotely, a natural or legal person, public or private, to carry out activities, procedures or formalities, etc.;

Third party

any natural or legal person, public or private, any other organization or association other than the data subject, the data controller, the processor and the persons who, placed under the direct authority of the data controller or processor, are authorized to process the data;

Processing of personal data

any operation or set of operations provided for in Article 2 of the present law, whether or not performed by automated means, and applied to data, such as collection, exploitation, recording, organization, retention, adaptation, modification, extraction, backup, copying, consultation, use, communication by transmission, dissemination or any other form of making available, matching or interconnection, as well as locking, encryption, erasure or destruction of personal data;

Identity verification

a process of confirming the accuracy and authenticity of the information provided during identification.

This Privacy Policy applies to all products and services of the group, and covers all areas of activity, including those of the neo business application, a MIKATY SN SA product.

The development of this Privacy Policy is part of MIKATY SN SA's compliance with the regulatory texts in force concerning the protection of personal data of customers, employees, partners and third parties.

Concerned about the security of its customers’ personal data, MIKATY SN SA defines through this policy the terms of collection, retention and use of personal data for which it is responsible as part of the business relationship.

Furthermore, this policy also aims to determine, in a responsible and transparent manner, the terms under which the various rights conferred by the use and processing of personal data may be exercised, including the right of access, the right to rectification, the right to object, the right to portability, and the right to erasure.

As previously defined, MIKATY SN SA's Privacy Policy, in addition to customer data, also takes into account all personal data of employees and third parties such as external service providers, commercial and banking partners, among others, when such data is made available and subject to collection and processing.

MIKATY SN SA is committed to preserving the integrity and dignity of its customers, hence the great importance placed on respecting data confidentiality.

MIKATY SN SA, as part of the processing of personal data, collects the following data:

1. Customer data

In order to comply with customer identification obligations when entering into a relationship (KYC), to offer the customer products and services best suited to their needs, and to ensure sound management of the customer portfolio, we collect:

• Identity-related data (first name, surname, date and place of birth, nationality, gender, national identity card or passport, consular card or residence permit for foreigners, identity photo (physical or digital));
• Contact details (home address, telephone number, email, etc.);
• Professional data (employer name, area of activity, position held, place of work, etc.);
• Economic, financial and banking data (income level, payslip, bank account details, payment card numbers, information on ongoing credits and/or savings, etc.);
• Biometric data (fingerprints for users with Android devices, and Face ID for users with iOS (Apple) devices);
• Location, connectivity and browsing data (information on exact position, notably for service needs; preferences on online payment methods and services (card, mobile money, etc.));
• Contact list data: permission to access from the application the list of contacts to facilitate transactions;
• Communication data with MIKATY SN SA's support services (Compliance, Customer Service, requests via the website, requests via the neo business application, complaints and information requests, suggestions or requests via our social channels, etc.);
• Access data (OTP codes, identifiers, passwords, etc.).

2. Employee data

As part of personnel management, MIKATY SN SA collects personal data from candidates during the recruitment stages and throughout the employment relationship. Human Resources are designated as Personal Data Managers for this purpose and may request documented supporting materials such as curriculum vitae, diplomas obtained, work attestations, most recent payslip(s) from the previous employer, professional references, among others.

Among the information collected we find:

• Basic data such as: identification and address data;
• Sensitive data such as: marital status, number of children, information about the spouse, contact details of a relative in case of emergency, bank details, criminal record, and other filiation data and data relating to any sanctions or criminal convictions, legal proceedings or any other restrictive measures;
• Confidential data such as: health-related data (e.g., medical visit or counter-visit reports, genetic data, blood type).

Furthermore, MIKATY SN SA, in addition to the personal information indicated on the employment contract and the required administrative documents, provides all its collaborators with internal documents for information, signature or simply as complementary information, including:

• the information sheet;
• the internal regulations;
• the group's IT charter;
• the work equipment allocation form;
• the health coverage enrollment form for the employee and their dependents (spouse and children);
• a commitment sheet relating to the proper management of the benefits made available according to classification;
• any other document required upon taking up duties for completion, signature, or reading.

3. Partner and third-party data

In addition to customer and employee data, MIKATY SN SA may collect and process data from third parties (natural or legal persons) such as commercial partners, banking partners, external service providers or prospects in order to carry out the required due diligence.

The data collected allows us to better know the third parties with whom we intend to deal, while enabling us to propose the best formula for collaboration in the event of a contract being concluded.

Among the data processed are identification and address data, professional data and financial data, among others.

Furthermore, other types of personal data may be processed by MIKATY SN SA, independently of the business relationship, namely data collected on customers, employees or third parties via social networks, websites, blogs, platforms and official pages of supervisory and regulatory authorities including the official journal, public lists, judgments or reports published or publicized...

This includes information published by institutional and public bodies fighting money laundering and the financing of terrorism, the fight against corruption and tax fraud, publications and databases made accessible by public authorities, partners, service providers and suppliers of goods and services, payment initiators, general information services, etc.

MIKATY SN SA, in order to comply with the provisions of Instruction No. 003-03-2025 of March 18, 2025 on identification, identity verification and customer knowledge by financial institutions, uses personal data for the following purposes of compliance due diligence, customer relationship management, personnel management, and communication:

• transaction monitoring;
• tracking of the history of customers' financial transactions;
• surveillance of suspicious accounts and atypical operations;
• reporting to the competent authorities;
• follow-up of legal matters;
• follow-up of financial and accounting flows;
• management of the customer database;
• monitoring and management of complaints;
• implementation of a rigorous internal control system;
• commercial prospecting;
• proposing suitable products and services;
• strengthening the quality and security of transactions;
• commercial and relational management;
• improvement of payment solutions;
• management of the digital platform;
• security and management of access to premises;
• protection of staff, partners and third parties having access to MIKATY SN SA's premises;
• human resources management and monitoring of staff transactions.

In addition to the conditions of use of personal data, it may be processed according to the following terms:

1. Compliance with regulatory obligations

In accordance with Financial Security legislation, with customer identification and knowledge (KYC) obligations, and with the various texts applicable to the collection, processing and retention of personal data, MIKATY SN SA uses this data to participate in:

• fighting effectively against money laundering, the financing of terrorism and the proliferation of weapons of mass destruction;
• preventing the risks of international sanctions and embargoes;
• strengthening vigilance on suspicious transactions or customers;
• reporting to the competent authorities any detected case of fraud and submitting suspicious activity reports;
• effectively combating corruption and tax evasion.

2. Compliance with contractual obligations

• Enrollment in the application through acceptance of the General Terms of Use and the Specific Terms, including the Tariff Terms;
• Subscription to the various products and services of the neo business application requiring the provision of personal data, commitment by signature or simple approval.

3. Compliance with security obligations and standards

• guaranteeing the security of customers' operations;
• ensuring the security of payment methods.

The processing of personal data by MIKATY SN SA may involve its sharing for information, declaration or even investigation purposes. Personal data of customers, staff or third parties may therefore be subject to analysis by various recipients, always while respecting the related confidentiality and security measures.

1. Destination of data collected

Personal data of customers, staff, or third parties may be shared:

• With the services of the various existing and future entities of the MIKATY group, including MIKATY SN SA, participating directly or indirectly in the processing of personal data;
• With suppliers, service providers and processors for the development or execution of any contracts, in the payment process, for identification purposes when entering into a relationship, for filtering, surveillance and monitoring of transactions, in the establishment or provision of technical, security and IT infrastructure such as servers and cryptographic means, in relational management, for the follow-up of complaints, remote assistance (via call center, by email or in writing), and to conduct various surveys and studies on satisfaction, prospecting, polling, or continuous improvement of the products and services offered;
• With regulatory, supervisory and financial surveillance authorities, judicial, administrative, public or semi-public bodies authorized to requisition information that may include personal data;
• And in special circumstances, with regulated professions such as judges, lawyers, notaries and statutory auditors, notably in the event of litigation, disputes, requisitions, audits, legal proceedings, tax reassessment or financial investigation, within the limits of the prerogatives conferred on them by the laws in force.

2. Method of retention of personal data

MIKATY SN SA retains the personal data of customers, employees and third parties in accordance with the authorizations of the Personal Data Protection Commission in its Deliberation No. 2025-00892/CDP authorizing the processing of personal data by MIKATY SN SA.

Thus, the data is stored in Senegal by MIKATY SN SA, which has undertaken to take all appropriate security measures in view of the nature of the data, in order to avoid its distortion, damage, or access by unauthorized third parties.

3. Retention period of data collected

In accordance with the provisions of Article 35 of Law No. 2008-12 of January 25, 2008 on the Protection of Personal Data, and as authorized by the Personal Data Protection Commission, MIKATY SN SA retains personal data for a period not exceeding the time necessary for the purposes for which it was collected or processed.

• Law No. 2008-12 of January 25, 2008 on the Protection of Personal Data;
• Instruction No. 003-03-2025 of March 18, 2025 on the identification, verification of identity, and knowledge of customers by financial institutions;
• Law 2025-03 of February 19, 2025 regulating banking in Senegal;
• Deliberation No. 2025-00892/CDP of the Personal Data Protection Commission authorizing the processing of personal data by MIKATY SN SA;
• This Privacy Policy.

This Privacy Policy is available in the neo business mobile application as well as on the official website of the MIKATY SN SA group.

It applies to all users of the group's products and services and is intended for all MIKATY SN SA collaborators as information on the management of personal data within the group, and falls within the framework of compliance with regulatory requirements regarding the processing and use of personal data.

For any request, information inquiry or assertion of exercisable rights, please contact the Compliance team via compliance@mikaty.com.

The MIKATY SN SA group's Privacy Policy enters into force on the date of its approval.