Skip to content
ImmoSafe

Legal

Privacy policy

Last updated: 3 May 2026

1. ImmoSafe's commitment

ImmoSafe attaches the utmost importance to protecting the privacy of its users and to the sensitive nature of real estate data. This policy describes which data is collected, for what purposes, how long it is retained, and what the User's rights are.

2. Applicable legal framework

The processing of personal data by ImmoSafe is subject to:

  • Togolese law no. 2019-014 of 29 October 2019 on the protection of personal data;
  • Supplementary Act A/SA.1/01/10 of 16 February 2010 of ECOWAS on the protection of personal data within the ECOWAS area;
  • Togolese law no. 2018-026 of 7 December 2018 on cybersecurity and the fight against cybercrime;
  • Togolese law no. 2017-007 of 22 June 2017 on electronic transactions.

The competent supervisory authority is the IPDCP (Personal Data Protection Authority) of Togo.

3. Data controller

The data controller is the company publishing ImmoSafe, whose details appear in the Legal notice.

4. Data collected

4.1 Identification data

  • Last name, first name, email, phone number (with country code);
  • Password (stored hashed with bcrypt, never in clear text);
  • Account creation date, last login date.

4.2 Asset data

  • Description of properties: type, area, address, GPS coordinates, purchase value, status (built, rented, etc.);
  • Uploaded documents: title deed, ACD, CPF, contracts, receipts, permits;
  • Identity of sub-accounts (trusted persons) and of contacts to be notified in the event of death, including a scanned ID where applicable.

4.3 Technical data

  • IP address, device type, operating system, browser;
  • Access and error logs;
  • OTP codes generated, hashed and stored temporarily for authentication.

5. Purposes of processing

Data is processed to:

  • Enable registration, authentication and use of the Service;
  • Secure the account (2FA via OTP, detection of abnormal access);
  • Store and return the assets and documents registered by the User;
  • Enable asset transmission via trusted persons and the reporting of death;
  • Manage billing and subscriptions;
  • Communicate information about the Service (notifications, document expiry alerts, support);
  • Comply with legal and accounting obligations (retention of invoices for 10 years).

6. Legal bases

  • Performance of the contract (Terms of Use) for providing the Service;
  • Consent for non-essential communications and archiving of contacts' ID documents;
  • Legal obligation for accounting retention and cooperation with authorities;
  • Legitimate interest for Service security and fraud prevention.

7. Recipients

Data is accessible, strictly as necessary:

  • to authorised ImmoSafe staff (administrators, support);
  • to the hosting processor (Supabase, Inc.) within its contractual obligations;
  • to payment providers (bank card, Mobile Money) for transaction processing only;
  • to trusted persons designated by the User, in read-only mode;
  • to judicial or administrative authorities upon legal request.

8. Transfers outside the UEMOA / ECOWAS area

Some technical processors are located outside the UEMOA / ECOWAS zone (Supabase, cloud providers). These transfers are governed by standard contractual clauses and commitments equivalent to the level of protection provided by Togolese law no. 2019-014.

9. Retention period

  • Active account: for the entire duration of use of the Service;
  • Closed account: deletion within 30 days, except where legally required;
  • Accounting and tax data: 10 years in accordance with Togolese legislation;
  • OTP codes: 1 hour (automatic deletion);
  • Technical logs: 12 months maximum.

10. Security

ImmoSafe implements technical and organisational measures to protect data: TLS encryption of communications, bcrypt hashing of passwords and OTP codes, mandatory two-factor authentication, role-based access control, regular backups, secure hosting, and logging of administrator access.

11. User's rights

In accordance with Togolese law no. 2019-014, the User has the following rights:

  • Right of access to their personal data;
  • Right of rectification of inaccurate data;
  • Right to erasure in the cases provided for by law;
  • Right to object to processing on legitimate grounds;
  • Right to portability of their data in a structured format;
  • Right to restriction of processing;
  • Right to set post-mortem directives on the fate of their data — this is the purpose of ImmoSafe's “trusted person” and “contacts to notify” feature.

These rights may be exercised at any time:

  • from the personal space (Profile page);
  • by email to dpo@immosafe.app (the maximum response time is 30 days);
  • by postal mail to the address listed in the Legal notice.

In the event of an unsatisfactory response, the User may lodge a complaint with the IPDCP (Personal Data Protection Authority — Togo).

12. Cookies and trackers

ImmoSafe uses only technical cookies necessary for the operation of the Service (session, theme preference). No third-party advertising or audience-measurement cookies are set without explicit consent.

13. Minors

The Service is not intended for persons under 18. If the publisher becomes aware that an account has been created by a minor without parental consent, the account will be closed and the data deleted.

14. Data breach notification

In the event of a data breach likely to affect the rights and freedoms of Users, ImmoSafe notifies the IPDCP as soon as possible and no later than 72 hours after becoming aware of it, and informs the Users concerned in accordance with the law.

15. Changes to the policy

Any substantial change to this policy is notified by email with 30 days' notice. Continued use of the Service constitutes acceptance of the changes.