Privacy Policy

lomi. as controller. We decide how and why personal data is processed, and are therefore the controller, when we: verify the identity of Merchants, their owners and representatives (KYC and KYB); process payments, refunds, Chargebacks and Payouts; prevent and detect fraud; comply with anti-money-laundering, counter-terrorist-financing, sanctions, tax and Card Network obligations; operate and secure our websites, dashboard, API and support channels; and send our own communications. For Customer data needed to complete a payment (for example name, email, phone number, payment instrument and transaction details), we act as an independent controller alongside the Merchant.

lomi. as processor. When a Merchant configures our services to collect or store additional Customer data on its behalf (for example custom checkout fields, delivery addresses, customer notes or catalog data), we process that data as the Merchant's processor, only on its documented instructions. The Merchant is the controller of that data and is responsible for informing its Customers and for answering their requests; we assist it as described in our Terms.

Merchants' own obligations. Each Merchant is responsible for its own compliance with data-protection law in its relationship with its Customers, including telling them that payments are processed by lomi. and its Payment Channel Partners.

Providing the data marked as required at sign-up or checkout is necessary to open an account or to complete a payment; without it we cannot provide the service. Other data is optional and is indicated as such when we ask for it.

In line with Article 50 of BCEAO Instruction No. 001-01-2024, we access only the personal data necessary to provide the payment services and to meet our legal obligations, we may process personal data to prevent, investigate and detect payment fraud, and we ask for your explicit consent before any other use, processing or retention of your data.

These tools may block or delay a payment, place a Hold or Reserve, or flag an account for review. In line with Article 25 of Law 2013-450 and Article 22 of the GDPR, no decision that produces legal effects or similarly significantly affects you (for example refusing an account, terminating a Merchant, or reporting to an authority) is based solely on automated processing: such decisions are reviewed by a trained member of our team, who considers the documents and explanations you provide.

You have the right to obtain meaningful information about the logic involved, to express your point of view, and to contest an automated decision by writing to hello@lomi.africa. We will review it and answer within thirty (30) days. We may not disclose details that would reveal a Payment Channel Partner's confidential risk criteria or compromise an investigation.

Transfers within the ECOWAS area are permitted under Law 2013-450 and the ECOWAS Supplementary Act. Transfers to countries outside ECOWAS are made only where the destination provides an adequate level of protection or with appropriate safeguards, including contractual data-protection clauses with the recipient, the recipient's binding security and confidentiality commitments, and, where required, the prior authorization of the ARTCI. We limit transferred data to what is necessary for the purpose. You may ask us for information about the safeguards that apply to a specific transfer.

Authorities of the countries where data is processed may, in some cases, be entitled to access it under their own laws.

When a Merchant closes its account we stop active processing but keep the records above for the periods indicated. Residual copies may remain in encrypted backups for a limited time before they are overwritten. Anonymized data may be kept indefinitely.

No system is perfectly secure. Merchants remain responsible for protecting their own credentials, API keys and systems, and Customers for their payment instruments and devices.

If we become aware of a personal-data breach likely to result in a risk to your rights, we will notify the ARTCI and, where required, the affected persons and Merchants without undue delay and in any case within seventy-two (72) hours of becoming aware of it, with the information available at that time, and we will cooperate with the Merchant in its own notifications. If you believe your data or account is no longer secure, contact us immediately at hello@lomi.africa.

Analytics. We measure how our websites and documentation are used with Vercel Analytics and a cookieless configuration of PostHog. These tools do not set tracking cookies, do not build cross-site profiles and do not use advertising identifiers; data is aggregated and we do not use it to identify you. Session recording is not enabled. We do not use third-party advertising trackers on our websites.

Merchant sites. When you pay on a Merchant's site or app, that Merchant's own cookies and analytics apply and are governed by its policy. Our embedded checkout only uses the essential storage described above.

You can control cookies through your browser settings; blocking essential cookies may prevent you from signing in or paying. The former cookies page in our documentation now redirects here.

You can opt out at any time through the unsubscribe link in each email, by replying STOP to a WhatsApp or SMS message, in your dashboard notification settings, or by writing to hello@lomi.africa. We will act on your request within ten (10) business days. Opting out of marketing does not stop transactional and service messages (receipts, security alerts, dispute notices, changes to our Terms), which we must send to operate your account.

To exercise a right, write to hello@lomi.africa from the email address linked to your account, or by post to the address in Section 15, stating which right you exercise and which data is concerned. We may ask for information to verify your identity. We answer within thirty (30) days, extendable by a further sixty (60) days for complex requests with notice to you. Requests are free unless manifestly unfounded or excessive. If you are a Customer and your request concerns data controlled by a Merchant, we will direct you to the Merchant and assist it where we act as its processor.

Complaints. You may lodge a complaint with the Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire (ARTCI), the Ivorian data-protection authority (artci.ci), or with the competent authority of your country of residence. We would appreciate the chance to address your concern first.

We may show you a receipt, save your email or phone number to send it, and, if you choose, remember your payment method for future payments to Merchants using lomi. You can ask us to forget a saved method at any time. For questions about an order, contact the Merchant first; for questions about how lomi. processes your data, contact us at hello@lomi.africa.