Personal Data Protection Policy
Rafis Batimat — Compliant with Law No. 2019-014 on data protection in Togo
This Policy describes how RAFIS BATIMAT SARL collects, uses, retains, and protects the personal data of users of its web platform selling construction materials and hardware supplies.
1. Applicable legal framework
The processing of personal data on the platform is strictly subject to Law No. 2019-014 of October 29, 2019 on the protection of personal data in the Republic of Togo, under the oversight of the Personal Data Protection Authority (IPDCP), as well as to Law No. 2017-007 of June 22, 2017 on electronic transactions.
2. Data controller
RAFIS BATIMAT SARL
Represented by its commercial management.
Registered office address: Djariwa, near Orabank, Tchamba, Togo
Email dedicated to data protection: contact@rafisbatimat.fr
Phone: +228 91 52 51 96
Represented by its commercial management.
Registered office address: Djariwa, near Orabank, Tchamba, Togo
Email dedicated to data protection: contact@rafisbatimat.fr
Phone: +228 91 52 51 96
3. Data collected, purposes, and retention periods
In accordance with the principles of legitimacy, purpose limitation, and data minimization set out by Togolese regulations, RAFIS BATIMAT SARL only collects the data strictly necessary to carry out its commercial services:
| Data Category | Legitimate Purpose of Processing | Legal Retention Period |
|---|---|---|
| Last name, first name, email address, phone number, date of birth (optional) | Creating and managing the customer account, personalized tracking of construction projects. | Duration of the business relationship plus 3 years after the last active contact. |
| Delivery and billing addresses for project sites | Managing material deliveries, issuing invoices and accounting records. | 10 years from the close of the fiscal year (OHADA commercial obligation / Togolese General Tax Code). |
| Order history and material quotes | Performing the sales contract, after-sales service, managing material warranties. | 10 years in accordance with administrative obligations and commercial limitation periods. |
| Data related to newsletters (opt-in consent) | Information on new catalog items, promotions on tools and materials. | Until consent is withdrawn or the customer unsubscribes. |
| IP address, connection logs, and access attempts | Security of the Django application, prevention of intrusion or fraud attempts. | 6 months from the date of recording. |
4. Processing of payments and financial data
No banking data, credit card details, or Mobile Money payment credentials are stored on RAFIS BATIMAT SARL's servers.
Payment operations are processed directly through the encrypted, secure interface of our approved payment partner KKiapay. The transaction takes place entirely on the financial provider's secure servers.
5. Data sharing and recipients
The personal data collected is reserved for the exclusive use of RAFIS BATIMAT SARL. It is not sold, rented, or transferred to any commercial third party.
It may only be shared with the following authorized recipients:
- Logistics and transport services: Carriers or delivery drivers to transport construction materials to the designated site.
- Approved payment operator: KKiapay, solely for validating purchase payments.
- Togolese judicial or administrative authorities: In the event of a legal request in accordance with applicable legislation.
6. Security of processing
In accordance with Article 31 of Law No. 2019-014, RAFIS BATIMAT SARL implements all appropriate technical and organizational measures to guarantee the security and confidentiality of your personal data:
- SSL/TLS (HTTPS) encryption of all the website's communication flows.
- Secure password storage using strong cryptographic hashing algorithms (PBKDF2 / Django Security framework).
- Built-in protections against brute-force attacks (dynamic lockout) and application vulnerabilities (CSRF, XSS, and SQL Injection protection).
7. Your rights under Togolese law
In accordance with Chapter III of Law No. 2019-014 on the protection of personal data, you have the following rights over your data:
- Right of access (Art. 18): Obtain confirmation that data concerning you is being processed and obtain a copy of it.
- Right of rectification (Art. 19): Require the update or correction of inaccurate, incomplete, or outdated data.
- Right to deletion/erasure (Art. 20): Request the removal of data whose collection or processing does not comply with the law.
- Right to object (Art. 21): Object, on legitimate grounds, to the processing of your personal data.
To exercise any of these rights, simply contact our data protection officer by email at: contact@rafisbatimat.fr or by mail at the registered office address in Tchamba. Valid proof of identity may be requested. RAFIS BATIMAT SARL undertakes to respond within a maximum of thirty (30) days.
If you believe your rights have not been respected, you may lodge a complaint with the Personal Data Protection Authority (IPDCP) of Togo.
8. Updates to this Policy
RAFIS BATIMAT SARL reserves the right to modify or supplement this policy in order to comply with legislative, regulatory, or technical developments. The applicable version is the one published on the site at the time of your visit.