Privacy policy

1. Data controller

The data controller is Yekola SARL, a limited liability company governed by Congolese law, with its head office at 5th floor, Immeuble le 130, Av. Kwango, C. Gombe, Kinshasa, DR Congo, registered with the RCCM under number CD/KNG/RCCM/26-B-02158, National Identification 01-H5300-N00001R.

Yekola SARL also has an office at 1620 US Route 22, Suite 100-10, Union, New Jersey 07083, United States.

Contact for any question about personal data: yves@yekola.academy.

2. Legal framework

Processing is carried out in accordance with the law applicable in the Democratic Republic of the Congo, in particular:

• the Constitution, which guarantees the right to privacy (article 31);
• Ordinance-Law No. 23/010 of 13 March 2023 on the Digital Code, in particular its provisions on the protection of personal data;
• Law No. 09/001 of 10 January 2009 on the protection of children, which establishes the best interests of the child.

Where data is processed from other countries, Yekola SARL also applies the mandatory rules of those countries insofar as they apply.

3. Data collected

Yekola SARL only collects the data necessary for the Platform to operate:

• Student account data: surname, middle name, first name, e-mail address or login, password (stored only in irreversibly encrypted form), class, school, province; optional profile picture.
• Parent or guardian data: surname, first name, relationship to the student, e-mail address, phone number, and proof of consent (date, time, version of the documents accepted).
• Learning data: lessons viewed, answers to exercises, quizzes and mock exams, scores, time spent, progress, points, badges and rankings.
• School data: name and address of the school, identity and contact details of authorised managers and teachers.
• Technical data: connection logs, IP address, type of device and browser, needed for security and proper operation of the service.
• Payment data, where applicable: transaction reference and payment status. Mobile Money or card payments are processed by the relevant operators; Yekola SARL neither receives nor stores PIN codes or full card numbers.

Yekola SARL does not collect sensitive data (ethnic origin, political or religious opinions, health data). Users are asked never to enter such data in messaging areas.

4. Purposes and legal bases

Data is used exclusively to:

• create and manage the accounts of students, parents and schools (performance of the requested service and parental consent);
• provide educational content, correct exercises and adapt reviews to the student’s level;
• produce tracking dashboards for the student, their parents and, where the school enrolled the student, the school;
• run gamification features: points, badges, challenges and leaderboards;
• ensure the security of the Platform and prevent fraud and abuse (legitimate interest of Yekola SARL and users);
• improve content and the service using aggregated or anonymised statistics;
• comply with legal, accounting and tax obligations.

Student data is never used for targeted advertising, nor sold, rented or transferred to third parties for commercial purposes.

5. Minor students and parental consent

The protection of children is at the heart of the Platform:

• A minor student’s account is only activated after the express consent of a parent or legal guardian, given after reading this policy and the terms of use. The date, time and version of the documents accepted are recorded.
• When a school enrols its students, it undertakes to obtain parental consent; the Platform allows each parent to confirm it.
• Parents may at any time view their child’s data, request its correction or deletion, and withdraw their consent. Withdrawal leads to closure of the account, without affecting processing already carried out.
• In leaderboards, students appear under their first name and the initial of their surname, or under a nickname; no contact details are ever shown to other students.
• Any exchanges with teachers or between students are supervised and may be moderated to protect children.

If Yekola SARL finds that a minor student’s account was created without parental consent, it suspends the account and contacts the parent or school concerned.

6. Recipients of the data

Depending on its nature, data may be accessed by:

• authorised Yekola SARL staff, within the limits of their duties and under a duty of confidentiality;
• parents or guardians, for their child’s data;
• the student’s school, where it enrolled the student, for the learning-tracking data of its own students;
• Yekola SARL’s technical service providers (hosting, messaging, payment), solely to perform their service and bound by confidentiality;
• administrative or judicial authorities, only upon a lawful request.

7. Hosting and transfers

Data is hosted on secure servers operated on behalf of Yekola SARL. These servers may be located outside the Democratic Republic of the Congo. In that case, Yekola SARL ensures that the providers concerned offer appropriate security and confidentiality guarantees, and limits transferred data to what is strictly necessary.

8. Retention periods

• Account and learning data: for as long as the account is used, then at most two (2) years after the last login, before deletion or anonymisation.
• Proof of parental consent: for the life of the account, then three (3) years after its closure, in order to evidence that consent.
• Technical connection logs: twelve (12) months at most.
• Accounting records and billing data: ten (10) years, in accordance with OHADA accounting law.

A deletion request made by a parent is handled without waiting for these periods to expire, subject to data that the law requires to be kept.

9. Security

Yekola SARL implements appropriate technical and organisational measures: encrypted exchanges (HTTPS), passwords stored in irreversibly encrypted form, access to data restricted to authorised persons, access logging, regular backups and separated databases.

In the event of a data breach likely to present a risk to students or their parents, Yekola SARL informs the persons concerned and, where applicable, the competent authority as soon as possible.

10. Your rights

Each user, and for a minor student their parent or guardian, has the following rights:

• right of access to their data;
• right to rectify inaccurate or incomplete data;
• right to erasure of data;
• right to object to certain processing and to withdraw consent at any time;
• right to obtain a copy of their data in a readable format.

To exercise these rights, simply write to yves@yekola.academy stating the student’s identity and, for a parent, their relationship to the student. Yekola SARL may ask for proof of identity in order to protect the child’s data. A reply is given within thirty (30) days.

In case of disagreement, the user may refer the matter to the competent data protection authority in the Democratic Republic of the Congo.

11. Cookies and local storage

The website yekolatenasosp.com uses neither advertising cookies nor third-party audience measurement tools. The platform eleves.yekolatenasosp.com only uses the technical elements strictly necessary for login (session token) and display. No learning data is kept in the browser: it is stored on Yekola SARL’s servers.

12. Changes to this policy

This policy may change. Each version is dated and numbered. In the event of a substantial change, parents are informed and, where the law requires it or where the change affects their child’s data, their new consent is requested before use continues.

13. Contact

Yekola SARL — 5th floor, Immeuble le 130, Av. Kwango, C. Gombe, Kinshasa, DR Congo.

E-mail: yves@yekola.academy · Phone: +243 856 077 556 · +243 824 858 528.