Privacy and data protection

Who we are

aLTlas operates this portal for the African continent. Files are routed by region. No city office is published. A named controller and a contact for data requests will be published before launch. Until then, use the contact form and mark the subject “privacy”.

What we collect

Account data in the name of an entity: the person’s name, role, email, country, and the password hash. On upgrade: position, website, expertise, business address, telephone, and copies of a certificate of incorporation and a utility bill. Opportunity text, investor briefs, engagement messages, abuse reports, and the audit trail of staff actions. We do not ask for card numbers in this phase.

Why

To run the directory, to decide whether a person or a lead may be published, to route a brief to the right desk, to calculate a fee, to send a sign-in link or a feedback request, and to answer a legal request. Marketing mail is not sent unless you ask for a broadcast as a partner or you opt in later.

Contact masking

Partner and investor telephone numbers, emails, and street addresses are not placed on public pages. Staff can see them in order to make an introduction. A counterparty sees them only if a reviewer marks the engagement as released.

Documents

Verification files are stored in private object storage (local disk in development). They are available to the account holder and to reviewers. They are not part of the public profile.

How long

Account records are kept while the account is open and for a period afterwards that counsel will set, long enough for a commission dispute or a regulatory question. Audit logs are kept. Magic links expire after 20 minutes.

Who else sees it

Staff at the desk that owns the file, professional advisers bound to confidence, infrastructure providers who host the database and the files, and authorities when the law requires a disclosure, including a suspicion of money laundering. We do not sell the directory.

Across borders

A file is routed by region, including a Middle East origin. Hosting may sit outside the country of the data subject. That transfer needs a lawful basis. The draft assumes contractual clauses and a record of the transfer. Counsel must confirm that before launch.

Ghana

The Data Protection Act, 2012 (Act 843) is the Ghanaian frame: a stated purpose, security, and the rights of the data subject, with oversight by the Data Protection Commission. aLTlas will register if the Act requires it. This notice is not that registration.

Kenya

The Data Protection Act, 2019, and the Office of the Data Protection Commissioner, will govern processing that is established in Kenya or aimed at people in Kenya, including the rules on cross-border transfer.

South Africa

Where the Protection of Personal Information Act applies, the conditions for processing, the information-officer duty, and the Information Regulator’s role are in scope. A South African partner or client should be able to exercise POPIA rights through the same contact.

Morocco

Law 09-08 on the protection of individuals with regard to the processing of personal data, and the CNDP, are the reference where processing concerns Morocco. Prior authorisation or declaration, where the law still requires it, is a launch item, not something this draft pretends to have completed.

European Union

If aLTlas offers services to people in the EEA or monitors them, the GDPR applies: a lawful basis, transparency, data-subject rights, a representative if one is required, and transfer tools for data leaving the EEA. Investor briefs from Europe are the obvious case.

United States

There is no single federal consumer privacy statute of GDPR’s shape. State laws, including the California Consumer Privacy Act as amended by the CPRA, can apply to residents of those states. We will honour access and deletion requests that those laws require, and we do not sell personal information.

Asia

Regimes differ sharply, from comprehensive statutes such as those in force in several East and Southeast Asian jurisdictions to sector rules. A launch into a specific Asian market needs a country memo. This notice does not claim compliance with every Asian statute.

Your requests

You may ask what we hold, ask for a correction, ask us to close the account, or object to a use. Use the form on this page. A signed-in member can download a copy of their own file. Some records, especially audit logs and files tied to a live engagement or a legal hold, cannot be deleted on demand. Sending the form records the request. It does not delete the account by itself.

A request about your data