Privacy Policy & Data Protection Notice
Last updated: March 2026 (Version 1.0)
Operator & Data Controller
Operator: GoBuy CI SARL / GoCab225, Abatta, cité BCEAO, Abidjan, Côte d'Ivoire
Data Controller: GoBuy CI SARL / GoCab225
Contact: legal.gobuy@goca.io
Effective date: [Date of first app release]
Version: 1.0 — March 2026
Your privacy matters to us.
GoBuy collects personal data solely to manage your purchase contract, process your payments, and protect both parties in the event of a dispute. We do not sell your data, share it with advertisers, or use it for any purpose unrelated to your GoBuy contract. This notice explains exactly what we collect, why, how long we keep it, and what rights you have.
1. WHO WE ARE
GoBuy is a phone retail service operated by GoBuy CI SARL / GoCab225 ("GoBuy", "we", "us", "our"), a company registered under the laws of Côte d'Ivoire with registered offices at Abatta, cité BCEAO, Abidjan.
GoBuy is the data controller for all personal data collected through its app, its website, and its in-person customer onboarding process. For any questions about this Privacy Policy or about your personal data, contact us at legal.gobuy@goca.io.
2. WHAT DATA WE COLLECT AND WHY
The table below sets out every category of personal data GoBuy collects, what specific data is included in each category, and the purpose for which it is used.
| Category of Data | Data Collected | Purpose |
|---|---|---|
| Identity | Full name, date of birth, nationality, CNI or passport number, photo of identity document | Contract formation, KYC verification, fraud prevention |
| Contact details | Mobile phone number, home address, email address (if provided) | Contract management, payment notifications, and default notices |
| Professional information | Employer name, job title, monthly income range | Eligibility assessment |
| Emergency contact | Name and phone number of a trusted contact (family member or colleague) | Default recovery and repossession coordination |
| Financial information | Mobile money account number (Wave, Orange Money, MTN Money), payment history within GoBuy | Payment processing, instalment tracking, and default management |
| Device information | IMEI number of the purchased device, device model, and serial number | Retention-of-title enforcement, MDM management, repossession |
| Location data | The GPS location of the device at the moment of delivery only | Delivery confirmation and address verification |
| MDM data | Device lock/unlock status, MDM activation status | Contract enforcement — payment compliance only |
| Usage data | App login timestamps, screens visited, actions taken within the GoBuy app | Service improvement, fraud detection |
What we do NOT collect: GoBuy does not collect the content of your phone calls, text messages, emails, photos, contacts, browsing history, or any other personal content stored on your device. The MDM application installed on your device has no access to any of this information. Its sole function is to confirm device activation status and, if a payment is overdue, to restrict device functionality as described in your purchase contract.
3. LEGAL BASIS FOR PROCESSING
GoBuy processes your personal data on the following legal bases:
- Contract performance: the processing of your identity, contact, financial, and device data is necessary to enter into and perform the instalment sale contract with you. Without this data, we cannot open an account or provide the service.
- Legitimate interest: the processing of emergency contact details, usage data, and MDM status data is based on our legitimate interest in preventing fraud, managing credit risk, and enforcing the retention-of-title clause — balanced against your rights and interests.
- Legal obligation: where applicable, we process and retain data to comply with our obligations under Ivorian tax law, the OHADA commercial acts, and any applicable anti-money-laundering requirements.
4. HOW WE USE YOUR DATA
4.1 Contract Management
Your identity, contact, and financial data are used to open your GoBuy account, generate your purchase contract, process your instalment payments, send you payment reminders, and manage the full lifecycle of your contract from purchase to final payment.
4.2 Device Management (MDM)
The IMEI number and MDM status data are used exclusively to manage the retention-of-title clause in your contract. The MDM application may restrict device functionality if a payment is more than 7 calendar days overdue, following prior notification by SMS. It is permanently uninstalled upon receipt of your final payment. At no point does GoBuy access the personal content of your device.
4.3 Fraud Prevention & Credit Risk
We use your identity data, payment history, and device information to detect and prevent fraud, verify your identity, and assess your eligibility for the GoBuy service. This includes cross-referencing information you provide with publicly available records where permitted by law.
4.4 Customer Support
Your contact details and contract data are used by our customer support team to respond to your questions, process complaints, and resolve disputes. Support interactions may be logged for quality assurance purposes.
4.5 Legal & Regulatory Compliance
We may use and retain your data as required by Ivorian law, including for tax purposes (DGI), anti-money-laundering obligations, and in the context of any legal proceedings or regulatory enquiries.
5. WHO WE SHARE YOUR DATA WITH
GoBuy does not sell your personal data to any third party. We share your data only in the following limited circumstances:
- Payment processors: mobile money operators (Wave, Orange Money, MTN Money) receive your payment details to process instalment payments. These operators are independent data controllers subject to their own privacy policies.
- MDM provider: our MDM software provider receives the device IMEI and activation status to operate the remote management function. The MDM provider processes only the minimum data necessary for this function and is contractually prohibited from using it for any other purpose.
- Legal and regulatory authorities: we may disclose your data to the DGI, the RCCM, courts, or law enforcement agencies where required by applicable law or by a valid legal order.
- Debt recovery: in the event of a default, your contact information and contract details may be shared with a legal counsel or authorised recovery agent acting on behalf of GoBuy, strictly for the purpose of enforcing your purchase contract.
- GoCab Group: as a subsidiary of GoCab225, certain anonymised and aggregated performance data may be shared with the GoCab Group for internal reporting purposes. Individual personal data is not shared with the GoCab Group beyond what is necessary for group consolidation and financial reporting.
GoBuy does not share your data with advertisers, data brokers, marketing companies, or any third party for commercial purposes unrelated to the operation of your purchase contract.
6. DATA RETENTION
GoBuy retains your personal data only for as long as is necessary for the purposes for which it was collected, and in accordance with applicable legal obligations.
| Data Category | Retention Period |
|---|---|
| Contract and payment data | 5 years from the date of the last payment or termination of contract — in line with the OHADA statute of limitations for commercial obligations |
| Identity documents | 5 years from the date of the last payment or termination of the contract |
| MDM data | Deleted automatically upon receipt of the final instalment payment and MDM uninstallation |
| Location data (delivery GPS) | 90 days from the date of delivery, then permanently deleted |
| App usage data | 12 months on a rolling basis |
| Data related to a dispute or legal proceeding | Until final resolution of the dispute plus 2 years |
When a retention period expires, data is permanently deleted from our systems or irreversibly anonymised so that it can no longer be associated with you.
7. DATA SECURITY
GoBuy implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:
- Encryption of data in transit between your device and our servers.
- Access controls limit data access to GoBuy staff members who need it to perform their duties.
- Regular review of data access logs to detect any unauthorised access.
- Contractual data protection obligations are imposed on all third-party service providers who process data on our behalf.
In the event of a data breach that is likely to affect your rights and interests, GoBuy will notify you without undue delay and take all appropriate remedial action.
8. YOUR RIGHTS
You have the following rights with respect to your personal data held by GoBuy:
- Right of access: you may request a copy of all personal data GoBuy holds about you.
- Right of rectification: You may request the correction of any inaccurate or incomplete data.
- Right to erasure: you may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to our legal retention obligations.
- Right to restrict processing: you may request that we limit the use of your data in certain circumstances, for example, while a dispute is being resolved.
- Right to object: you may object to the processing of your data where it is based on our legitimate interest.
- Right to data portability: you may request that we provide your data in a structured, commonly used, and machine-readable format.
To exercise any of these rights, contact us at legal.gobuy@goca.io. We will respond within 30 days. Exercising these rights is free of charge. We may ask you to verify your identity before processing your request.
Please note that certain rights may be limited where GoBuy is required to retain or process data by law, or where it is necessary to enforce your purchase contract — for example, we cannot delete your identity data while your contract is still active.
9. COOKIES & TRACKING
The GoBuy app does not use advertising cookies or third-party tracking technologies. We use only essential session data to keep you logged in and to record your in-app actions for the purpose of providing the service. This data is not shared with any advertising platform.
10. CHILDREN
The GoBuy service is not directed at persons under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will delete it promptly. If you believe we may have collected data from a minor, please contact us at legal.gobuy@goca.io.
11. CHANGES TO THIS PRIVACY POLICY
GoBuy may update this Privacy Policy from time to time to reflect changes in our data practices or applicable law. We will notify you of any material changes through the app and by SMS at least 14 days before the changes take effect. The updated policy will be accessible at all times from the app settings menu. Continued use of the GoBuy app after the effective date of the updated policy constitutes your acceptance of the changes.
12. CONTACT & COMPLAINTS
For any questions, concerns, or requests relating to your personal data, contact GoBuy at:
Email: legal.gobuy@goca.io
Post: GoBuy CI SARL / GoCab225, Abatta, cité BCEAO, Abidjan, Côte d'Ivoire
If you are not satisfied with our response to your request or complaint, you have the right to refer the matter to the Commission Nationale de l'Informatique (CNI) in Abidjan, which is the supervisory authority for data protection in Côte d'Ivoire, or to the Direction Générale de la Concurrence, de la Consommation et de la Répression des Fraudes (DGCCRF).
13. GOVERNING LAW
This Privacy Policy is governed by the laws of Côte d'Ivoire. Any dispute arising from the processing of your personal data that cannot be resolved amicably shall be submitted to the exclusive jurisdiction of the Tribunal de Commerce d'Abidjan.