1) Ondjango’s Commitment

Ondjango values privacy and the protection of personal data as a fundamental pillar in our relationship with customers, users, vendors/suppliers, partners, and employees. This Policy explains what data we collect, for which purposes, under what legal grounds, for how long, and the rights of data subjects, in accordance with Angolan Data Protection Law No. 22/11 of 17 June and the guidelines of the Data Protection Agency (APD).

When selling to consumers in the EU/UK, GDPR and local consumer protection rules also apply.

2) Data Controller

The Data Controller is Ondjango (and, when applicable, its affiliates). Ondjango implements appropriate technical and organizational security measures and cooperates with the competent authorities.

For institutional contact, please use the Help Center available on the Platform.

3) Data Subjects

• Customers and Users (visitors, registered users, buyers)
• Vendors/Suppliers (resellers, distributors, manufacturers)
• Candidates and Employees (recruitment and HR)
• Partners and Business Contacts
• Any individuals interacting with the Platform

4) Categories of Personal Data

• Identification & Contact: name, ID document, address, account contact details
• Profile/Account: username, preferences, browsing history (cookies), wishlists
• Transactional: orders, payments (tokenized), invoices/receipts
• Logistics: delivery addresses, tracking information, proof of delivery
• Technical/Usage: IP, device ID, OS, authentication logs, web/app events
• Communication: Help Center interactions; call recordings only when informed and applicable
• Location: approximate coordinates/country (when enabled)
• Professional (vendors): company data, settlement details, KYC/AML information
• User-submitted content: reviews, messages, attachments (catalogues, images)

Note: Ondjango does not store full card details; payments are processed by third-party PSPs (e.g., EMIS, banks, PayPal/Payoneer).

5) Legal Grounds

• Contract performance / pre-contractual steps: account management, orders, payments, deliveries, returns, support
• Legal obligation: tax/accounting compliance, responses to authorities, AML/CFT
• Legitimate interest: security, fraud prevention, service improvement, basic personalization, defense of rights, customer marketing (with opt-out)
• Consent: non-essential cookies/marketing, newsletters, precise geolocation, call recording for quality purposes

Minors: Services are intended for adults. If processing minors’ data is legally required, parental consent is mandatory.

6) Purposes and Retention Periods

• Commercial operations: registration, cart, checkout, billing, payments, logistics integrations (e.g., DHL, MyUS), banks/EMIS, vendors (API/Excel)
• Support & Quality: handling requests/complaints; call recordings when notified
• Marketing & Personalization: campaigns, coupons, communications (with opt-out)
• Security & Fraud Prevention: authentication, logs, audit trails, KYC/AML
• Analytics: usage metrics (favoring aggregated/anonymous data)
• Compliance & Tax: accounting, fiscal archiving, reporting

Retention guidelines:

• Account/Contract: during the relationship + legally required period
• Call recordings (if any): minimum necessary (e.g., 6–24 months), unless litigation
• Video surveillance (if applicable): up to 30 days, unless otherwise required by law
• Marketing: while consent/active relationship exists or internal minimum retention applies
• Cookies/analytics: according to cookie table and browser settings

7) Data Collection Methods

• Direct: registration, checkout, forms, Help Center
• Automatic: cookies, pixels, SDKs, logs, analytics
• Third-party sources: PSPs, logistics partners, identity/SSO services, integrated vendors; publicly available sources when permitted
• Affiliates: intra-group sharing necessary for operations (e.g., settlements in foreign currency)

8) Data Sharing (strictly necessary)

• Payments: EMIS, banks, PayPal, Payoneer
• Logistics: carriers and freight partners (shipping, tracking, returns)
• Vendors/Suppliers: order execution and support, stock/price synchronization
• Technology & Security: cloud hosting, CDN, email/SMS services, anti-fraud tools, analytics
• Consultants/Auditors: under confidentiality obligations
• Authorities: whenever legally required

All processors are bound by data processing agreements and security measures.

9) International Data Transfers

Data may be transferred outside Angola (e.g., EU, USA). Ondjango applies appropriate safeguards, such as standard contractual clauses and additional measures. For EU/UK operations, GDPR requirements are fully observed.

10) Rights of Data Subjects

• Access: to personal data and processing information
• Rectification / Update: request correction or update of your data
• Objection: including marketing; withdrawal of consent at any time
• Erasure & Restriction: when applicable
• Portability: when applicable under GDPR
• Right to complain: with the APD or the relevant authority in your country (EU/UK)

How to exercise your rights:

Use the Help Center / Privacy Portal on the Platform to submit your request.

Identity verification may be required.

We will respond within a reasonable period under applicable law

11) Cookies and Similar Technologies

We use cookies for essential functions (login/security/checkout), analytics, functionality, and marketing (with consent where required).

You may manage preferences through the cookie banner and your browser settings. Blocking essential cookies may affect platform functionality.

12) Information Security

We implement logical, physical, and organizational measures: encryption when applicable, firewalls, access control, logging/audit trails, backups/business continuity, security testing, and anti-fraud frameworks.

Access is restricted to authorized personnel with a legitimate need.

13) Children and Adolescents

The Platform is intended for adults. If we become aware of unauthorized processing of a minor’s data, we will delete it securely.

14) Changes to this Policy

We may update this Policy for legal or operational reasons. The new version will be published on the Platform with prior notice when required by law.

15) Data Protection Officer (if applicable)

If a DPO is appointed, requests may be submitted via the Help Center / Privacy Portal, which will ensure proper internal handling.

EU/UK Appendix (when applicable)

• Consumer rights: 14-day withdrawal right, minimum 2-year conformity guarantee, clear pre-contractual information
• Cookies/marketing: prior consent rules (ePrivacy/GDPR)
• Dispute resolution: access to out-of-court mechanisms (e.g., EU ODR)
• Supervisory authorities: data subjects may lodge complaints with the authority in their country