Flowxi
Download now

Last updated ·

1. PREAMBLE

This Privacy and Personal Data Protection Policy (the “Policy”) describes how FLOWXI Sarl, a single-member limited liability company with share capital of 1,500,000 FCFA, registered with the Benin RCCM under number RB/ABC/25 B 9870, IFU 3202553875369, with its registered office at Ilot 1, Quartier Akouehonou, Parcelle Z, Maison LAVAGNON SALOMON FANDJINOU, Arr. de Pahou, Commune de Ouidah, Atlantique, Benin (“Flowxi”, “we”, “our”), collects, processes and protects users’ personal data (“you”, “your”) on the website https://flowxi.com and through the Flowxi mobile application (“Platform”).

FLOWXI places the utmost importance on the confidentiality and security of your personal data. This Policy explains the collection, processing, retention and security of your data and your related rights, in accordance with:

  • Law No. 2017-20 of April 20, 2018 establishing the Digital Code in the Republic of Benin (Book V, personal data protection),
  • The European GDPR for European users,
  • And any applicable local legislation.

2. SCOPE OF THE POLICY

This Policy applies to all personal data processing carried out by Flowxi in connection with:

  • Use of the website,
  • The mobile application,
  • All associated APIs and digital services,
  • Management of customer, user, affiliate or partner relationships.

The Policy supplements the Flowxi Terms of Use, legal notice, cookie policy and any other contractual document.

3. DEFINITIONS

  • Personal data: any information that directly or indirectly identifies a natural person (e.g. name, number, photo, email, wallet, identifier, etc.).
  • Processing: any operation involving personal data (collection, recording, organization, storage, modification, extraction, consultation, use, disclosure, erasure, etc.).
  • Data controller: Flowxi Sarl.
  • User: any natural or legal person using Flowxi services (web, mobile, API, etc.).
  • Data Protection Officer (DPO): the person responsible for Flowxi’s compliance with data regulations, who can be contacted at dpo@flowxi.com.
  • APDP: the Personal Data Protection Authority of Benin.

4. DATA CONTROLLER AND CONTACT

The controller responsible for processing your data is:

  • FLOWXI Sarl
  • RCCM: RB/ABC/25 B 9870
  • IFU: 3202553875369
  • Registered office: Ilot 1, Quartier Akouehonou, Parcelle Z, Maison LAVAGNON SALOMON FANDJINOU, Arr. de Pahou, Commune de Ouidah, Atlantique, Benin
  • Email: dpo@flowxi.com
  • Support: support@flowxi.com

Flowxi has appointed a Data Protection Officer (DPO), notified to the APDP, who can be contacted at dpo@flowxi.com for any question or to exercise your rights.

5. DATA COLLECTED BY FLOWXI

Depending on the services used and your level of interaction with Flowxi, the categories of personal data that may be collected include:

  • a) Identification and civil status data: Last name, first name, date and place of birth, nationality, sex, photo, image, signature
  • b) Contact data: Postal address, email address, telephone number, country/region
  • c) Login and browsing data: Identifiers, logs, IP address, geolocation, device, cookies, browsing history on the Platform
  • d) Financial and transaction data: Bank account, wallet and card data, source of funds, transaction history (amount, date, counterparty, purpose, crypto/fiat), proof of payment, proof of income
  • e) Authentication and KYC/AML data: Identity card, passport, proof of address, video/photo selfie, biometric data for KYC where applicable
  • f) Professional data: Company name, status, SIREN/RCCM/IFU, role, articles of association, legal documents, employees, beneficial owners
  • g) Marketing and customer relationship data: Survey responses, support messages, reviews, tracking cookies, usage data, preferences
  • h) Data from third parties or partners: Data obtained from payment and KYC partners, aggregators or the blockchain (addresses, txID, amount, timestamp, etc.)

Flowxi does not collect or process data classified as “sensitive” by law (racial origin, opinions, religion, sexual orientation, etc.) unless required by KYC/AML regulations.

6. HOW DATA IS COLLECTED

Your personal data is mainly collected:

  • When you create a Flowxi account or wallet;
  • When you browse, log in to or use the Flowxi website, app or APIs;
  • When you sign up for a newsletter, game or marketing campaign;
  • During a deposit, withdrawal, conversion, crypto/fiat transaction or payment;
  • When you contact customer support or the DPO;
  • Through cookies and audience measurement tools;
  • From partners (identity, payment, account aggregation providers, etc.), with your agreement;
  • During affiliate, ambassador or referral programs.

7. PURPOSES AND LEGAL BASES OF PROCESSING

Your data is processed for the following purposes on the following legal bases:

  • a) Performance of the contract and provision of services:
    • Creating and managing your user account;
    • Managing your operations and transactions on the Platform;
    • Managing customer relationships, support and KYC/AML;
    • Access to the app, your user area, wallets and histories;
    • Legal basis: performance of the contract (Article 8 of the Digital Code, Article 6(1)(b) GDPR).
  • b) Compliance with legal and regulatory obligations:
    • Identity verification (KYC/AML), fraud and money laundering prevention;
    • Tax and reporting obligations, archiving;
    • Transaction security, anti-fraud controls and combating terrorist financing;
    • Legal basis: legal obligation (Article 8 of the Digital Code, Article 6(1)(c) GDPR).
  • c) Flowxi’s legitimate interests:
    • Improving security, the user experience, services and products;
    • Statistics, reporting, service optimization and internal controls;
    • Abuse prevention, investigations and dispute management;
    • Protection of rights and the safety of people and property;
    • Legal basis: legitimate interests (Article 8 of the Digital Code, Article 6(1)(f) GDPR).
  • d) Consent:
    • Sending commercial information, newsletters and satisfaction surveys;
    • Personalizing the experience, targeted marketing and analytical cookies;
    • Legal basis: consent (Article 8 of the Digital Code, Article 6(1)(a) GDPR).
  • e) Other bases:
    • Protection of vital interests (emergency, safety);
    • Specific authorization or the user’s express request.

8. DATA RETENTION PERIODS

Flowxi retains your data only for as long as strictly necessary for the purpose of processing and in compliance with regulations:

  • Identification/KYC data: retained throughout the contractual relationship, then archived for 5 to 10 years under local and international KYC/AML regulations;
  • Transaction data: statutory tax and anti-money laundering retention period (5 to 10 years);
  • Login data/logs: a maximum of 12 to 36 months, except in the event of a security incident or investigation;
  • Marketing data: until consent is withdrawn or 3 years after the last contact;
  • Customer support data: 2 to 5 years depending on the nature of the request.

At the end of these periods, data is deleted, anonymized or securely archived, unless a legal obligation requires otherwise (dispute, authority, etc.).

9. DATA RECIPIENTS

Your data may be disclosed, strictly for the stated purposes, to the following categories of recipients:

  • Flowxi internal departments: customer support, compliance, technical, marketing and management;
  • Technical providers: hosting provider, KYC/AML provider, payment aggregators, crypto sending/receiving partners, IT providers, auditors, etc.;
  • Contractual partners: banks, payment institutions, affiliate companies, funds sending/receiving partners, SMS/email notification providers, etc.;
  • Legal authorities: APDP, judicial authorities, police, tax authorities, anti-money laundering bodies and supervisory authorities;
  • Advisers, auditors and lawyers where necessary;
  • Potential acquirers in the event of a sale or merger, subject to confidentiality requirements;
  • No transfer to unauthorized third parties for commercial or advertising purposes

All processors and partners are contractually bound by strict confidentiality and compliance with local and international regulations.

10. DATA SECURITY AND PROTECTION

Flowxi implements all appropriate technical, organizational and human measures to ensure the security, confidentiality, integrity and availability of your personal data, including:

  • Encryption of communications and sensitive data (SSL/TLS, database encryption, etc.);
  • Securing access through strong authentication (2FA/complex password);
  • Database segmentation and storage in certified data centers;
  • Restricting access to authorized persons only;
  • Access controls, regular audits, monitoring of access and incidents;
  • Regular system updates and security patches;
  • Internal confidentiality and team awareness policies;
  • Procedures for managing and reporting incidents/data breaches to the APDP and affected individuals.

In the event of a security breach or unauthorized access, Flowxi undertakes to inform users and the APDP within the legal time limits, specifying the nature of the breach, the risks involved and the measures taken.

11. DATA TRANSFERS OUTSIDE BENIN/WAEMU

As a general principle, your data is processed and hosted on servers located in WAEMU (Benin, ECOWAS area). However, some processing may involve transfers to third countries outside WAEMU/EEC (e.g. IT providers, international crypto aggregators, cloud hosting providers, technical partners).

  • Only transfers data to partners providing an adequate level of protection,
  • Takes all required contractual safeguards (standard contractual clauses, Binding Corporate Rules, APDP authorization, etc.),
  • Informs the user and strictly limits the transfer to what is needed for the service.

No data may be transferred to states or organizations that do not offer an adequate level of protection without consent or APDP authorization.

12. COOKIES AND TRACKERS

Flowxi uses cookies, trackers and similar technologies on the website and application to:

  • Enable browsing and essential features (user session, language, security, shopping cart, etc.)
  • Measure audiences and analyze platform use (statistics, Google Analytics, Matomo, etc.)
  • Offer personalized content and offers
  • Improve the user experience and security

Some cookies are strictly necessary; others require your consent (particularly for marketing, advertising and advanced analytics). You can manage your preferences or withdraw your consent at any time through the cookie banner or your browser settings. To learn more, see the Flowxi Cookie Policy.

13. USERS’ RIGHTS (GDPR, BENIN LAW, WAEMU)

Under data protection regulations, you have the following rights at any time and free of charge (except in the event of manifest abuse):

  • Right of access: obtain confirmation that Flowxi holds data about you, access it and receive a copy;
  • Right to rectification: request correction or updating of inaccurate or incomplete data;
  • Right to erasure (right to be forgotten): have your data deleted, except where retention is legally required;
  • Right to restriction of processing: request temporary suspension of processing in certain cases;
  • Right to object: object to the use of your data for certain processing (marketing, profiling, etc.);
  • Right to data portability: receive your data in a structured format or request its transfer to a third party of your choice;
  • Right to withdraw consent: at any time, for consent-based processing (newsletters, cookies, etc.);
  • Right to give instructions concerning your data after your death;
  • Right to lodge a complaint with the APDP or any competent supervisory authority

Exercising your rights: Send your request to dpo@flowxi.com or through the dedicated form, specifying your identity and the purpose of the request.
Proof of identity may be required.
Flowxi undertakes to process each request within a maximum of 30 days (or 2 months for complex requests).
If your request is refused, you may lodge a complaint with the APDP (https://apdp.bj) or any other competent authority.

14. DATA BREACH MANAGEMENT AND NOTIFICATION

Flowxi has established an internal procedure for managing and reporting personal data breaches (security failure, loss, unauthorized access, etc.).
In the event of a breach likely to create a risk to your rights and freedoms:

  • Flowxi notifies the APDP of the incident within a maximum of 72 hours,
  • Informs you, if the risk is high, of the consequences, measures taken and your remedies,
  • Immediately takes all necessary measures to limit the impact, secure the data and prevent recurrence.

15. LINKS TO THIRD-PARTY WEBSITES

The Flowxi website or application may contain links to third-party websites, platforms or services not controlled by Flowxi (e.g. partners, aggregators, suppliers).
Flowxi is not responsible for their content, privacy policies or practices.
We recommend reviewing the privacy policy of every third-party website you visit.

16. CHILDREN AND MINORS

Use of Flowxi services is restricted to adults (at least 18 years old) and/or persons with legal capacity under local legislation.
Flowxi does not knowingly collect or process data concerning minors under 18.
Any request to delete a minor’s account should be sent to dpo@flowxi.com.

17. CHANGES TO THE PRIVACY POLICY

Flowxi reserves the right to amend this Policy at any time to reflect changes in its services, regulations or APDP recommendations.
Any amendment will be published on the website and/or communicated to users.
Continued use of Flowxi services after publication constitutes acceptance.

18. CONTACT, DATA PROTECTION OFFICER (DPO), COMPLAINTS

  • General support: support@flowxi.com
  • Data protection / DPO: dpo@flowxi.com
  • Postal address: Flowxi Sarl, Ilot 1, Quartier Akouehonou, Parcelle Z, Maison LAVAGNON SALOMON FANDJINOU, Arr. de Pahou, Commune de Ouidah, Atlantique, Benin
  • APDP: https://apdp.bj (online complaints available)

19. EFFECTIVE DATE AND VERSION

  • Effective date: July 14, 2025

Thank you for your trust.
Protecting your data is an absolute priority for Flowxi.