Shoppy Logo Shoppy

Privacy Policy — SHOPPY

Last updated: February 17, 2026

Headquarters: Lomé

 

SHOPPY is a classifieds and advertising platform operated from Lomé, Togo.

We are committed to respecting the privacy of our users and protecting personal data provided or collected in accordance with Law No. 2019-014 of October 23, 2019 relating to the protection of personal data in the Togolese Republic and the security standards applicable to digital services.

This privacy policy has been put in place to allow our users to use our application safely and with complete peace of mind.

SHOPPY reserves the right to modify this privacy and data protection policy in accordance with changes to the platform or applicable legislation.

1. Data Controller

The data controller is SHOPPY, based in Lomé, Togo.

Contact: [email protected]

2. Data collected

In the context of using the SHOPPY application, certain personal data may be collected in order to ensure the operation of the service, to improve the user experience and to enable connections between users of the platform.

2.1 Data provided directly by the user

When registering or using certain features of the application, the user may be asked to voluntarily provide certain personal information, including:

-          first and last name;

-          email address;

-          phone number;

-          profile picture;

-          information relating to published advertisements (description, price, category, photos, location, etc.);

-          messages exchanged with other users via the application.

This information is necessary to enable the creation of the user account, the posting of advertisements, and communication between users.

2.2 Data relating to published advertisements

When a user posts an ad on the application, certain information may be made public to allow other users to access the ads and contact the advertiser.

This information may include:

-          the content of the advertisement;

-          the associated images or documents;

-          the location of the good or service;

-          some means of contact provided by the user.

The user remains responsible for the information they choose to make public in their ads.

2.3 Automatically collected data

When using the application, certain technical information may be collected automatically, including:

-          the IP address;

-          the type of mobile device used;

-          the phone's operating system;

-          the version of the application;

-          the unique identifier of the device or application;

-          data relating to the use of the application (pages viewed, duration of use, interactions with features).

This information helps to ensure the security of the application, to diagnose technical problems and to improve the services offered.

2.4 Location Data

With the user's consent, the application may collect location data in order to:

-          display listings located nearby;

-          improve the relevance of search results;

-          allow the user to indicate the location of a good or service offered in an advertisement.

 

2.5 Data collected for audience analysis and measurement purposes

The application may use analytics tools to understand how users interact with the application.

This data may include:

-          the features used;

-          pages viewed;

-          the technical performance of the application.

This information is used solely for the purpose of improving the quality of service.

2.6 Advertising identifiers and similar technologies

The application may use advertising identifiers or other similar technologies in order to:

-          to measure the effectiveness of advertising campaigns;

-          display relevant content or advertisements;

-          analyze the use of the application.

2.7 Data relating to user transactions

SHOPPY does not store data relating to transactions between users. The processing of this data is the sole responsibility of the advertisers, who are personally subject to the same obligations regarding the protection of personal data they process in their capacity as Data Controller.

3. Legal basis for processing

The treatments are based on:

-          the execution of the platform usage agreement;

-          user consent when required;

-          compliance with a legal obligation;

-          SHOPPY's legitimate interest (security, fraud prevention, service improvement).

4. Purposes and legal bases for the processing of personal data

The personal data collected on the SHOPPY application is processed solely for specific, explicit, and legitimate purposes. Each processing operation is based on a legal basis that complies with data protection principles.

4.1 Creation and management of user accounts

Personal data is used to enable registration and account management on the platform.

These treatments allow, in particular:

-          the creation and authentication of user accounts;

-          managing login credentials;

-          access to the services offered on the platform;

-          user profile management.

Legal basis: performance of the contract between the user and the site operator.

4.2 Publication and management of advertisements

Personal data is necessary to allow users to post and manage advertisements.

This includes:

-          the posting and distribution of advertisements;

-          displaying the information necessary for connecting users;

-          the modification, updating or deletion of advertisements;

-          managing expired or deleted ads.

Some information provided by the user may be made public as part of the advertisement.

Legal basis: performance of the contract and the legitimate interest of the site in ensuring the operation of the platform.

4.3 Connecting users

The site facilitates communication between users wishing to sell, buy or offer services.

The data can be used for:

-          allow users to contact advertisers;

-          transmit messages or requests for information;

-          to facilitate exchanges related to the announcements.

Legal basis: performance of the service requested by the user.

4.4 Improvement of service and user experience

The data collected can be analyzed to improve the platform's functionality and the user experience.

This includes, in particular:

-          statistical analysis of site traffic;

-          functionality improvement;

-          Optimizing ergonomics and navigation;

-          adapting content to user preferences.

Legal basis: legitimate interest of the site operator in improving its services.

4.5 Platform security and fraud prevention

Personal data may be used to ensure site security and prevent fraudulent activities.

This includes, in particular:

-          the detection of suspicious behavior;

-          the fight against false advertisements or scams;

-          user account protection;

-          the prevention of fraudulent access to the computer system.

Legal basis: legitimate interest of the site operator and legal obligation to prevent illegal activities.

4.6 Communication with users

The data may be used to communicate with users in connection with their use of the site.

This may include:

-          sending notifications related to announcements;

-          information on changes to services;

-          responding to requests for support or assistance;

-          Complaints management.

Legal basis: performance of the contract and legitimate interest.

4.7 Sending commercial and advertising communications

Subject to the user's consent where required by law, the data may be used for:

-          send promotional offers;

-          inform users of new site features;

-          to offer advertisements or services that may interest them.

Users can unsubscribe from these communications at any time.

Legal basis: user consent.

4.8 Compliance with legal obligations

Personal data may be retained and used to comply with applicable legal and regulatory obligations, including:

-          cooperation with administrative or judicial authorities;

-          the prevention and suppression of illegal activities;

-          dispute resolution.

Legal basis: legal obligation.

5. The basic principles governing the processing of personal data

5.1. On the principle of consent and legitimacy

The processing of personal data is considered legitimate if the data subject gives their consent. However, this requirement may be waived when the processing is necessary: 

a) to comply with a legal obligation to which the data controller is subject; 

b) to the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or the third party to whom the data are communicated; 

(c) to the performance of a contract to which the person concerned is a party or to the performance of pre-contractual measures taken at his request; 

d) to safeguard the interests or fundamental rights and freedoms of the person concerned. 

5.2. On the principle of legality and fairness 

The collection, recording, processing, storage and transmission of personal data are carried out lawfully, fairly and not fraudulently. 

5.3. On the principle of purpose, relevance and conservation 

Data is collected for specified, explicit, and legitimate purposes and may not be further processed in a manner incompatible with those purposes. It must be adequate, relevant, and not excessive in relation to the purposes for which it is collected and subsequently processed. 

They must be kept for a period that does not exceed the period necessary for the purposes for which they were collected or processed.

Beyond this required period, data may only be retained for the specific purpose of processing for historical, statistical or research purposes in accordance with legal provisions. 

5.4. The principle of exactness 

The data collected must be accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that inaccurate or incomplete data, with regard to the purposes for which it is collected and subsequently processed, is erased or rectified. 

5.5. The principle of transparency 

It implies mandatory information from the data controller regarding personal data. 

5.6. The principle of confidentiality and security 

Personal data is processed confidentially and protected in accordance with the provisions of Articles 51 and 52 of Law No. 2019-014 of 23 October 2019 relating to the protection of personal data in the Togolese Republic, in particular when the processing involves data transmissions in a network.

5.7. On the principle of subcontractor selection 

When processing is carried out on behalf of the data controller, the latter must choose a data processor that provides sufficient guarantees. The nature of these guarantees is defined by regulation. Both the data controller and the data processor are responsible for ensuring compliance with the security measures defined in Article 52 of Law No. 2019-014 of October 23, 2019, concerning the protection of personal data in the Togolese Republic. 

Any processing carried out on behalf of the controller must be governed by a contract or legal act recorded in writing which binds the processor to the controller and which provides in particular that the processor acts only on the sole instruction of the controller and that the obligations referred to in this article also apply to the latter. 

Any person acting under the authority of the controller or processor, as well as the processor itself, who has access to personal data may only process it on the instructions of the controller.

6. Data Sharing

The personal data collected through the use of the SHOPPY application is neither sold nor rented to third parties. However, it may be shared in certain strictly limited situations, necessary for the operation of the application and the provision of the services offered.

6.1 Sharing with other users of the application

The purpose of the application is to facilitate connections between users, and certain information may be made visible to other users when posting advertisements.

This information may include, in particular:

-          the user's name or pseudonym;

-          the approximate location of the advertisement;

-          the information contained in the advertisement (description, photos, price, etc.);

-          the means of contact voluntarily provided by the advertiser (for example telephone number or internal messaging).

This sharing of information is necessary to allow users interested in an advertisement to contact the advertiser and communicate with them.

Users remain responsible for the information they choose to make public in their ads.

6.2 Sharing with technical service providers

Certain data may be shared with technical service providers involved in the operation of the application, in particular for:

-          hosting the application and databases;

-          the maintenance and security of computer systems;

-          analysis of application usage;

-          the improvement of technical performance.

These service providers only have access to data to the extent necessary for the performance of their duties and are required to comply with strict confidentiality and security obligations.

6.3 Sharing with service partners

In some cases, the application may use external partners to provide certain functionalities, including:

-          online payment services;

-          messaging or notification services;

-          statistical analysis or audience measurement services;

-          advertising distribution services.

When these partners have access to certain personal data, they are required to process it only within the scope of the services provided and in accordance with applicable data protection obligations.

6.4 Sharing within the framework of legal obligations

Personal data may be disclosed to the competent authorities when required by law or when such disclosure is necessary for:

-          to comply with a legal or regulatory obligation;

-          to respond to a request from a judicial or administrative authority;

-          to prevent or detect fraudulent or illegal activities;

-          to protect the rights, security or property of the application, its users or third parties.

6.5 Sharing in the event of restructuring or transfer of business

In the event of a merger, transfer, restructuring or sale of all or part of the application's activities, personal data may be transferred to the new operator or acquiring entity, subject to compliance with applicable data protection obligations.

In such a situation, users will be informed, to the extent possible, of any changes concerning the controller of their data.

7. Payment processing and technical service providers

SHOPPY uses specialized technical service providers for the secure processing of financial transactions, including:

-          CinetPay

-          PayGate

These entities act as technical intermediaries and do not constitute means of payment offered directly to users.

Payment methods available to users may include:

-          TMoney

-          Flooz

-          bank cards via the Visa and Mastercard networks

Financial data is processed directly by these providers in accordance with their own applicable privacy policies and security standards.

SHOPPY :

-          does not store complete bank card data;

-          does not have access to the full card numbers;

-          retains only the information necessary for billing and transaction tracking.

Payment providers act as independent data controllers for data strictly necessary for the financial transaction.

8. Disclaimer regarding user-to-user transactions

The SHOPPY application is a platform for connecting users, allowing them to post ads and get in touch with other users interested in those ads.

The application acts solely as a technical intermediary and does not participate in transactions that may be concluded between users following an advertisement published on the platform.

Consequently:

-          the application is not a party to the contracts concluded between users;

-          The application does not guarantee the accuracy, reliability, or legality of the published advertisements;

-          the application does not systematically verify the identity, creditworthiness or legal capacity of users;

-          The application does not guarantee the quality, conformity, or availability of the goods or services offered in the advertisements.

Users are solely responsible:

-          the content of the ads they publish;

-          information that they share with other users;

-          transactions they enter into with other users.

Users are responsible for exercising caution and verifying information about the goods or services offered before entering into any transaction.

The application publisher cannot be held responsible for disputes, damages or losses resulting directly or indirectly from transactions concluded between users, particularly in cases of fraud, deception, non-payment or non-delivery.

However, the application reserves the right to remove any advertisement or suspend any user account in the event of non-compliance with the platform's rules of use or reporting of illegal content.

9. Clause for moderating and removing advertisements

In order to guarantee the security and quality of the services offered on the SHOPPY application, the publisher reserves the right to moderate the content published by users.

In this capacity, the publisher may, in particular:

-          review the ads posted on the platform;

-          refuse or remove any advertisement that does not comply with the application's rules of use;

-          suspend or delete a user's account in case of non-compliance with the terms of use.

The publisher also reserves the right to remove, without notice, any advertisement that may infringe on the rights of a third party, public order, or applicable laws and regulations.

However, the publisher is not required to systematically monitor all user-generated content.

10. Clause relating to prohibited content and advertisements

Users agree not to post advertisements or content on the application that are contrary to laws, public order, or morality.

Specifically prohibited on the platform are:

-          advertisements relating to illegal goods or services;

-          counterfeit or fraudulently obtained products;

-          fraudulent or misleading content;

-          advertisements that infringe on the intellectual property rights of third parties;

-          defamatory, abusive or discriminatory content;

-          advertisements aimed at promoting illegal activities.

The publisher reserves the right to remove any advertisement that does not comply with these rules and, where appropriate, to suspend or delete the account of the user concerned.

11. Clause for reporting illegal or fraudulent content

The application provides users with a mechanism to report advertisements or content that may be illegal, fraudulent or contrary to the platform's rules of use.

Any user can report an advertisement by stating the reasons for the report and providing, where appropriate, the information necessary to assess its validity.

After receiving a report, the publisher may:

-          examine the reported content;

-          request additional information from the user in question;

-          suspend or delete the disputed advertisement;

-          take all appropriate measures, including suspending the user's account.

12. International Data Transfers

Some technical service providers may process data outside of Togo.

SHOPPY ensures that these transfers are governed by safeguards guaranteeing an adequate level of protection for personal data.

12. Data retention

The data is retained for the following periods:

-          Active account: for the duration of service use;

-          Inactive account: deletion or anonymization after 24 months;

-          Technical and safety logs: maximum 12 months;

-          Data related to legal and accounting obligations: according to the deadlines imposed by applicable regulations;

-          Deleted ads: maximum 12 months archiving then deletion or anonymization.

13. Data Security

SHOPPY implements appropriate technical and organizational measures including encryption of sensitive data, secure access control, access monitoring, protected databases, and limitation of internal access.

In the event of a data breach likely to pose a risk to users, SHOPPY will notify the individuals concerned and the competent authority in accordance with applicable regulations.

14. User Rights

In accordance with Law No. 2019-014 of October 23, 2019 relating to the protection of personal data in the Togolese Republic, you have the following rights:

-          Right to information ; 

-          right of access;

-          right of rectification;

-          right to delete;

-          right to object;

-          right to erasure ; 

-          right to restriction of processing;

-          right to data portability.

To exercise your rights: [email protected]

You can also contact the APDP if you believe your rights are not being respected.

15. Obligations of the Data Controller

15.1. The obligation of confidentiality

 The processing of personal data is confidential. It is carried out exclusively by persons acting under the authority of the data controller and only on their instructions. 

For the processing of data, SHOPPY selects individuals who, with regard to data confidentiality, offer all necessary guarantees of technical and legal expertise as well as personal integrity. A written commitment to comply with data protection law must be signed by all individuals processing such data. 

The contract between a subcontractor and SHOPPY includes an indication of the obligations incumbent upon the subcontractor with regard to the protection of the security and confidentiality of data and provides that the subcontractor may only act on the instructions of the data controller.

15.2. The obligation of safety 

SHOPPY will take all necessary precautions regarding the nature of the data and, in particular, to prevent it from being distorted, damaged, or accessed by unauthorized third parties. 

He therefore takes all measures aimed at: 

a) ensure that, for the use of an automated data processing system, authorized persons can only access personal data within their competence; 

b) ensure that the identity of third parties to whom personal data may be transmitted can be verified and established;

c) ensure that the identity of the persons who have had access to the information system and what data has been read or entered into the system, and at what time, can be verified and established a posteriori; 

d) prevent any unauthorized person from accessing the premises and equipment used for data processing; 

(e) prevent data storage media from being read, copied, altered, destroyed or moved by an unauthorized person; 

(f) prevent the unauthorized introduction of any data into the information system as well as any unauthorized access, modification or deletion of recorded data; 

(g) prevent data processing systems from being used by unauthorized persons using data transmission facilities; 

(h) prevent data from being read, copied, altered or erased in an unauthorized manner during the communication of data and the transport of data media; 

i) back up the data by creating backup copies; 

j) refresh and, if necessary, convert the data for long-term storage. 

15.3. The obligation to preserve

Personal data may only be kept longer than necessary for processing for historical, statistical, cultural, or scientific purposes. In this case, the data controller informs the IPDCP and the data subject. 

15.4. The obligation of sustainability 

SHOPPY takes all necessary measures to ensure that the personal data processed can be used regardless of the technical medium employed. In particular, it ensures that technological developments will not hinder this use.

16. Cookies (trackers) and similar technologies

SHOPPY may also automatically collect information through the use of cookies (trackers) placed on the device you use (computer, tablet, mobile, smartphone) when you access the platform, subject to your agreement, which you can modify at any time.

Cookies (trackers) are small pieces of information stored by your web browser on the device you are using (computer, tablet, mobile phone, smartphone). Cookies can be persistent or temporary. Persistent cookies are stored on your device for a period not exceeding thirteen (13) months. Temporary cookies disappear each time you close your browser.

Cookies (trackers) are used for :  

-          To ensure the proper functioning of the site, to allow the use of all the services offered by the site, in particular to request information on a product ; 

-          To facilitate your navigation on the site, in particular by remembering your connection data (IP address) ; 

-          To monitor the site and compile site audience statistics, including determining the number of visitors, the most viewed pages, your connection time, the type of browser used, the pages from which you accessed the site, the search engines used to access it, and the geographical location from which you accessed the site.

-          Performance analysis ; 

-          Personalizing the experience;

-          Targeted advertising with prior consent.

Users can manage their preferences via their browser or cookie management tool.

Consent can be withdrawn at any time.

SHOPPY obtains your consent before placing cookies. You can modify your browser settings at any time to accept or refuse cookies, and block or delete cookies that have already been placed on your browser. You can configure your browser to allow cookies to be stored on your device or, conversely, to reject them, either systematically or according to their origin. You can also configure your browser to prompt you to accept or refuse cookies on a case-by-case basis before a cookie is likely to be stored on your device. Each browser has a different way of managing cookies. This is described in your browser's help menu, which will explain how to modify your cookie preferences.

17. Policy changes

Any changes to this policy will be posted on this page and may be notified to users via email or in-app notification when necessary.

18. Contact

For any questions relating to data protection:

[email protected]

Lome, Togo