Data processing agreement

This agreement applies to every seller who uses MonEtalo to sell online. It sets the rules under which MonEtalo processes, on your behalf, the personal data of your store’s customers. It forms an integral part of the terms of use: by accepting them, you also accept this agreement. This English version is provided for convenience; if it differs from the French version, the French version prevails.

1. Definitions#

• Seller, you: the person or business that owns a store on MonEtalo. For your customers’ data, you are the controller.
• MonEtalo, we, us: Cowa Services SARL-U (Société à responsabilité limitée unipersonnelle (SARL-U)), with its registered office in Côte d’Ivoire (ANGRE PETRO IVOIRE PRES DE L'EGLISE St AMBROISE DU JUBILE), acting as processor.
• Customers: people who visit your store, create a customer account on it or place an order.
• Customer data: your customers’ personal data processed by MonEtalo as part of the service.
• Sub-processor: a provider MonEtalo uses that may have access to customer data.
• Data breach: a security incident leading to the accidental or unlawful destruction, loss, alteration, disclosure of, or unauthorized access to, customer data.
• Applicable law: Ivorian Law No. 2013-450 of 19 June 2013 on the protection of personal data, and any other data protection law binding on you or us, in particular the law of your country and, for customers in the European Union, the General Data Protection Regulation (GDPR), whose Article 28 inspires this agreement.

2. Purpose#

This agreement describes each party’s obligations when MonEtalo processes customer data to provide the service: hosting your store, receiving and displaying orders, managing customer accounts, sending order-related messages and producing your statistics. It does not cover data MonEtalo processes on its own behalf (your seller account, your subscription), which is covered by the privacy policy.

3. Description of the processing#

MonEtalo never receives the money from your sales and does not store your customers’ card or Mobile Money details: those payments are handled by the aggregator you connected (PayDunya, PayTech, CinetPay), with whom you have your own contract.

4. Your obligations as controller#

You decide how your customers’ data is used. You therefore agree to:

• have a legal basis for each processing activity (fulfilling the order, legal obligation, legitimate interest or consent);
• inform your customers clearly: who you are, how to reach you, what you do with their data, how long you keep it, what their rights are. You can do this by creating “Privacy” and “Legal notice” pages on your store with your own details;
• obtain their consent where the law requires it, in particular before sending them marketing (WhatsApp, email) or setting advertising trackers;
• respond to requests from your customers (access, rectification, erasure, objection…);
• use the data only for your business relationship with them, never sell it and never use it unlawfully or abusively;
• protect your access: strong password, individual access for each team member, roles limited to what they need, removal of access for people who no longer work with you;
• complete any formalities your country’s law requires with its data protection authority.

4.1 Pixels and third-party tools#

If you connect your store to your Meta or TikTok pixel, you act as controller together with the tool’s provider. MonEtalo is not a processor for that processing. The pixels only load after the visitor agrees in the banner MonEtalo shows; you comply with those providers’ terms (see the cookie policy).

4.2 Instructions#

Your instructions are set out in the terms of use, this agreement, the settings you choose in your dashboard and any written requests you send us. They must comply with applicable law.

5. MonEtalo’s obligations as processor#

5.1 Acting only on your instructions#

We process customer data only to provide the service to you and on your documented instructions. We never use it for ourselves: no resale, no marketing to your customers, no targeted advertising. If an instruction seems to us to break applicable law, we tell you immediately and may suspend carrying it out.

If the law requires us to disclose data to an authority, we tell you beforehand, unless the law forbids it.

5.2 Confidentiality#

Only members of our team who need it (support, engineering, security) can access customer data. They are bound by confidentiality. When our team opens your dashboard to assist you, access is limited to 30 minutes per session and recorded.

5.3 Security#

We apply technical and organizational measures suited to the risk, including:

• encrypted connections (HTTPS);
• strict isolation: each store can only access its own data;
• team access limited to need and logged;
• protection against repeated login attempts and forged requests;
• encryption of payment aggregator credentials;
• regular backups and restore procedures;
• regular security updates.

We adapt these measures as risks and best practice evolve.

5.4 Assistance#

We help you, as far as reasonably possible and taking into account the information we have:

• to answer your customers’ requests to exercise their rights: you can find their details and orders in your dashboard, and you can erase a customer yourself from their page (“Erase this customer”: name, phone, email and addresses deleted, amounts kept for your accounts); for a request you cannot handle yourself (full copy), write to support@monetalo.com. If a customer contacts us directly, we forward the request to you without answering it on the merits, unless you instruct us otherwise;
• to keep data secure and handle a data breach;
• to carry out, if the law requires it of you, a data protection impact assessment or prior consultation with the authority, by giving you useful information about our service.

5.5 Data breaches#

If a data breach affects your customers’ data, we notify you without undue delay after becoming aware of it, by email to your account address. As soon as it is available, we give you:

• the nature of the breach, and the categories and approximate number of people and records concerned;
• its likely consequences;
• the measures taken or planned to address it and limit its effects;
• a contact for further information.

This lets you notify the data protection authority and, where necessary, your customers within the deadlines set by applicable law (for example 72 hours for notifying the authority under the GDPR). Our notification is not an admission of liability.

5.6 Records#

We keep a record of the processing we carry out on behalf of our sellers, where applicable law requires it.

6. Sub-processors#

You give us general authorization to use sub-processors to provide the service. The up-to-date list (hosting, media storage, WhatsApp messaging, support email, AI, payments), with each one’s role, country and safeguards, is in the table in the privacy policy.

We undertake to:

• contractually require each sub-processor to meet data protection obligations at least equivalent to those in this agreement;
• tell you about any new or replacement sub-processor by updating the privacy policy and, for a significant change, by email or in your account at least 15 days in advance;
• remain responsible to you for their performance.

If you have a serious data-protection reason to object to a new sub-processor, write to support@monetalo.com within that period. We will look for a solution; failing that, you may stop using the service and close your account at no extra cost, with the period already started remaining payable.

7. International transfers#

Customer data is hosted on a server in France. Some sub-processors may process it in other countries, particularly the United States (media storage, WhatsApp if you turn on alerts, AI at your request). Every transfer is covered by appropriate safeguards: European Commission standard contractual clauses, the EU–US Data Privacy Framework where it applies, and contractual security commitments. If your country’s law requires a formality for these transfers, let us know and we will give you the information needed to complete it.

8. Audits#

You may ask us for the information needed to check that we comply with this agreement. We answer first in writing (questionnaire, description of our security measures, available certifications).

If that information is not enough, or if an authority requires it, an audit may be carried out, no more than once a year except after a data breach, by you or by an independent auditor bound by confidentiality who is not a MonEtalo competitor. The audit must be requested in writing with at least 30 days’ notice, take place during business hours without disrupting the service or compromising the security or data of other sellers, and is at your expense, unless it reveals a material breach on our part.

9. End of the contract: what happens to the data#

When your account is closed:

• for 30 days, you can reopen your store and download your customers’ data and your orders in a common format (CSV) from Settings › My data;
• after that, we delete customer data from our live systems, then from our backups within 30 days;
• we only keep data the law requires us to keep, for the required period, and do not use it for anything else.

When your store is only paused or back on the free plan (subscription not renewed after the grace period), data is kept so you can resume selling; you can ask for your account to be closed at any time.

10. Liability#

Each party is liable for breaches attributable to it under applicable law and this agreement. You are responsible for the lawfulness of the processing you decide on, for informing your customers and for the trackers you add to your store. MonEtalo is responsible for meeting its obligations as processor.

MonEtalo’s liability under this agreement is subject to the limits set out in the terms of use, to the extent permitted by applicable law.

11. Term and order of precedence#

This agreement takes effect when you accept the terms of use and remains in force for as long as MonEtalo processes customer data on your behalf, including after your account is closed until that data has been fully deleted.

If this agreement and the terms of use conflict on a data protection matter, this agreement prevails. We may update it to reflect the law or the service; you will be informed as provided in the terms of use.

12. Governing law and contact#

This agreement is governed by Ivorian law, without prejudice to mandatory data protection rules that protect your customers. Disputes are handled as set out in the terms of use: first an attempt at an amicable solution, then the courts of Abidjan.

For any question about this agreement, a request for assistance or an incident: support@monetalo.com.