Privacy & Cookies Policy

Mansa Transfers is a digital Value Added Service (VAS) that facilitates digital payment interactions between users and licensed payment providers. This Policy explains how the Mansa Controller mapped to your Sending Country processes personal data, how licensed providers process data for the regulated payment, and the choices and rights available to you.

Mansa Transfers is a digital Value Added Service (VAS) that facilitates digital payment interactions between users and licensed payment providers. The Mansa controller responsible for the customer interface, Mansa Quote, orchestration, customer support, Mansa fraud and security controls, product operation and transaction evidence is the entity mapped to the user’s Sending Country in the Public Information Schedule in section 19 (‘Mansa Controller’). Section 19 is the single place in this Policy where the controller’s legal identity, address, contact and applicable Jurisdiction Privacy Schedule are maintained.

The recipient’s country does not by itself change the sender-facing Mansa Controller. The Mansa entities are legally separate entities under common ownership or control. An affiliate may act as a processor, separate controller or joint controller according to its actual decision-making, instructions and applicable law. Each entity remains responsible for its own legal duties.

Our provider network changes by country, corridor and payment method, so this Policy identifies legally meaningful categories of recipients rather than listing every changing partner. The Mansa Quote need not identify the selected provider. Where required, the provider identifies itself and supplies its privacy information through its Provider Prompt, confirmation or receipt.

A licensed payment provider may be a separate controller for its Provider Prompt, payment authorisation, KYC/AML, sanctions screening, safeguarding, settlement, payment complaints and regulatory reporting. A technical supplier that processes data only on Mansa’s documented instructions is a processor. We do not call an independent regulated provider our processor merely because we integrate with it.

The current privacy and security contact is maintained once in section 19.

This Policy applies to users, senders, recipients, visitors, customer-support contacts, representatives and persons whose information is supplied for a transaction through https://mansatransfers.com/ and associated transaction/support channels. The selected provider’s privacy notice may also apply and is supplied or linked through its Provider Prompt, confirmation or receipt where required.

• ‘Jurisdiction Privacy Schedule’ — the country-specific privacy supplement mapped to the Sending Country in section 19.
• ‘Licensed Provider’ — a licensed payment aggregator or other licensed provider that may act as a separate controller for regulated payment activities.
• ‘Mansa Controller’ — the Mansa entity mapped to the verified Sending Country in the Public Information Schedule.
• ‘Mansa Quote’ — Mansa’s time-limited transaction summary shown before confirmation.
• ‘Provider Prompt’ — the separate payment request or authorisation interface generated by a Licensed Provider.
• ‘Public Information Schedule’ — the single-source register in section 19 containing supported-country, controller and contact information.
• ‘Sending Country’ — the supported country shown in the transaction flow from which the sender initiates and funds the transaction; Mansa may request evidence where supplied or technical information is inconsistent.

We receive data from you and your device; a sender or recipient acting lawfully; Licensed Providers, banks, mobile-money, card, identity-verification and fraud providers; public/official sanctions and company registers; communications providers where lawful; regulators/law enforcement; and our service providers. If another person supplies your information, we give the legally required notice unless an exception applies.

Where we rely on legitimate interests, we document the purpose, necessity, impact and safeguards. Consent is prior, specific, informed, affirmative and as easy to withdraw as to give. We do not condition the core transfer on consent to unnecessary marketing, analytics, precise location or biometrics.

Identity, contact, transaction, payment-authorisation and legally required compliance information is generally necessary to provide the Mansa Quote or transfer. If you do not provide it, Mansa or the Licensed Provider may be unable to proceed. Optional fields and their purpose are marked separately. We do not ask for information merely because it might be useful later.

Automated rules may evaluate identity, transaction characteristics, device and security signals, sanctions indicators, fraud patterns and legal or provider limits to approve, pause, refuse or refer a transaction. We do not publish security-sensitive thresholds, fraud rules or confidential provider-ranking logic. Provider selection by itself is not treated as a significant automated decision where it does not change the amount, recipient, material timing or rights shown in the Mansa Quote.

Where a solely automated decision has a legal or similarly significant effect, and applicable law grants the right, you may request human review, express your view and contest the outcome through the contact in section 19. We assess high-risk systems and test accuracy, overrides and adverse outcomes.

• licensed payment aggregators and payment institutions, banks and authorised dealer banks, mobile-money operators, card issuers/acquirers and schemes, and collection, settlement and payout providers needed for the transaction;
• identity verification/KYC, sanctions, fraud, device-risk and authentication providers;
• cloud hosting, security, communications, analytics, customer-support and document/evidence processors;
• professional advisers, auditors and insurers under confidentiality and legal duties;
• where a documented duplicate or erroneous payment exists, the actual Creditor, its authorised recovery agent, relevant payment providers, tracing providers, lawyers, process servers, bailiffs/enforcement officers and competent courts, limited to what is lawfully needed to trace, demand, dispute or recover the amount;
• Mansa group companies under common ownership or control, for the limited fulfilment, reconciliation, support, security and compliance purposes in this Policy;
• regulators, consumer/privacy authorities, courts and law enforcement where authorised or required; and
• a buyer, investor or restructuring party under confidentiality and applicable law, with notice where required.

Each category receives only the data reasonably necessary for its role. Mansa records the actual provider used for a Transaction, and the provider supplies its identity and privacy information through the Provider Prompt, confirmation or receipt where required. On a valid access request, Mansa provides the recipients or categories required by applicable law.

Mansa sends the personal data needed to the Licensed Provider selected to generate the Provider Prompt or execute the relevant collection, settlement or payout stage. Processors acting only for Mansa are contractually restricted to documented purposes, confidentiality, security, assistance and deletion or return duties.

A Licensed Provider determines certain purposes and legal duties independently, including its Provider Prompt, payment authorisation, KYC/AML, sanctions, safeguarding, execution, settlement, payment complaints and regulatory reporting. The provider supplies its identity, privacy notice and contact through its Provider Prompt, confirmation or receipt where required. Mansa remains responsible for its own disclosures, data, interface, instructions and assistance. A request or complaint sent to the wrong party is routed to the appropriate party without unnecessary delay.

We may be legally prohibited from telling you about a disclosure, report, freeze or investigation. In particular, financial-crime rules may prohibit ‘tipping off’ a person about a suspicious-transaction report or related analysis. We record the legal authority, recipient, scope and time of the disclosure even when notice cannot lawfully be given. The applicable no-tipping-off instrument is identified in the Jurisdiction Privacy Schedule.

Because transfers cross borders and providers may operate in other countries, personal data may be transferred to the recipient country and to the hosting, provider or support locations described in section 19. Before a transfer, we record the recipient, country, purpose, data, necessity, security and lawful mechanism.

We make a transfer only after applying any approval, adequacy finding, contractual safeguard or statutory condition required by the applicable Jurisdiction Privacy Schedule. The mechanisms currently relied upon are recorded once in section 19. You may request a copy or explanation through the privacy contact there. This Policy does not by itself authorise a transfer.

The ten-year standard applies to the core evidentiary categories above, not to every item of personal data. The start point is chosen by record type: transaction completion/closure for transaction evidence, relationship termination or the occasional transaction for KYC/CDD, and final closure for a complaint or recovery. Any different statutory minimum, lawful-basis condition or local limitation is stated in the applicable Jurisdiction Privacy Schedule. Mansa’s ten-year core-record standard is applied only while a lawful basis remains.

We extend retention only for a documented legal hold, regulator instruction, live judgment or unresolved claim. Access is restricted during the hold. If local law makes part of the ten-year period impermissible, the shorter lawful period applies. When no lawful need remains, we securely delete or irreversibly anonymise the data and require relevant processors to do the same. Each stated period is a maximum as well as a minimum where a legal minimum applies.

We protect sensitive personal data with AES-256 encryption at rest and TLS 1.2 or higher in transit. Privileged and administrative access is protected by multi-factor authentication and role-based, need-to-know access. We also use segregation, payment tokenisation, strong user authentication where applicable, transaction and reconciliation monitoring, secure development and change control, vulnerability management, logging, tested backup/recovery, processor due diligence and incident response. Applicable statutory security, cybersecurity-audit and incident-response requirements are identified in the Jurisdiction Privacy Schedules.

We do not retain card CVV after authorisation, PIN, OTP value, password, private key or full authentication secret. Payment authentication occurs through the relevant Licensed Provider’s controlled flow. No system is risk-free, and we do not use absolute claims such as ‘100% secure’.

We record every suspected or confirmed personal-data incident; investigate affected data/people, source, timing and likely impact; contain and remediate it; preserve a decision log; and notify the responsible controller, provider, authority and affected person within the timing and content standard in the applicable Jurisdiction Privacy Schedule.

Report a suspected incident through the monitored security/privacy incident contact in section 19. A security notice describes the incident, likely consequences, steps taken, what you should do and where to obtain assistance, unless law enforcement or the authority lawfully restricts content/timing.

Depending on your Sending Country and circumstances, you may request information and access; correction; deletion; restriction or objection; portability or a usable copy; withdrawal of consent; direct-marketing opt-out; human review of a significant automated decision; and complaint to a competent authority. The applicable statutory rights, response periods and authority are identified in the Jurisdiction Privacy Schedule. Lawful exceptions include payment, AML, accounting, fraud, legal-claim and regulator retention.

Send a request through the privacy-request route in section 19. We verify identity proportionately, acknowledge the request, search Mansa and relevant processors, coordinate independent controllers where needed, explain any lawful refusal and respond within the period required by the applicable Sending Country law. Requests are free unless the law permits a reasonable fee for a manifestly unfounded or excessive request.

Withdrawing consent does not invalidate earlier lawful processing. Deletion does not erase records we must keep; those records are restricted and deleted when the duty or hold ends.

Transactional, receipt, security, status, complaint and legal messages are necessary service communications and are not marketing. We send electronic marketing only through the channels you separately select and where the required prior consent or other valid basis exists. Every message identifies Mansa and provides an easy unsubscribe.

Change marketing choices through an unsubscribe control or the contact in section 19. We record consent wording, channel, time, source and version, and preserve a suppression record after opt-out so that we do not re-contact you unlawfully. Withdrawing marketing does not affect the transfer service.

Our banner provides ‘Accept all’, ‘Reject non-essential’ and ‘Manage choices’ with equal clarity. Strictly necessary technologies operate for security and the requested service. Functional, analytics and advertising technologies remain off until the required consent. Continued browsing is not consent. The banner or preference tool identifies each current cookie or similar technology, provider, purpose and duration and lets you change non-essential choices.

The Mansa service is for adults aged 18 or over. We do not knowingly contract with a child. Recipient information relating to a child is processed only where lawfully necessary for a transfer and with appropriate authority and safeguards. Use the privacy contact in section 19 if you believe we hold a child’s data improperly.

We identify the version and effective date and retain earlier versions. Non-material factual updates—such as a contact or adding a country to an already applicable legal schedule—may be made in section 19 without rewriting this Policy, if they do not reduce rights or conceal a processing change. A new controller, materially different purpose, data category, recipient role, international-transfer mechanism, retention rule, automated-decision effect or right requires a new Policy version or other notice or consent required by law. Continued use is not consent to a materially different consent-based purpose.

How this schedule works

This section is the single place in this Policy for supported-country mappings and Mansa privacy contacts. We may update a contact or map a new country to an existing Jurisdiction Privacy Schedule without changing the rest of the Policy, provided the update does not conceal a material processing change or reduce a right.

Maintained privacy information

Jurisdiction Privacy Schedule A — CEMAC framework

This Schedule applies to the CEMAC Sending Countries mapped in section 19. The national law of the relevant Sending Country applies alongside the common CEMAC payment framework; the laws are not treated as interchangeable merely because the countries belong to CEMAC.

Cameroon: Law No. 2024/017 of 23 December 2024 relating to personal data protection governs Mansa’s Cameroon processing, including lawful and proportionate processing, security, retention, data-subject rights, automated decisions and cross-border transfers. Article 53 establishes the independent Personal Data Protection Authority. ANTIC remains relevant for applicable cybersecurity, security-audit and CIRT matters under Law No. 2010/012 and Decree No. 2012/1643/PM, but is not described here as the personal-data complaint authority under Law No. 2024/017.

Central African Republic: Law No. 24.001 of 20 November 2024 on the protection of personal data applies to processing connected with the Central African Republic, including processing that produces effects there. Chad: Law No. 007/PR/2015 of 10 February 2015 on protection of personal data applies, with ANSICE exercising the functions assigned by the applicable digital laws. Republic of the Congo: Law No. 29-2019 of 10 October 2019 on protection of personal data applies. Gabon: Law No. 025/2023 of 12 July 2023 modifying Law No. 001/2011 on personal data protection applies, under the Autorité pour la Protection des Données Personnelles et de la Vie Privée (APDPVP). Requests may always be sent first through section 19, without removing a direct complaint right to the competent national authority.

Jurisdiction Privacy Schedule B — Nigeria

This Schedule applies to Nigeria when mapped in section 19. Mansa applies the Nigeria Data Protection Act 2023 and applicable Nigeria Data Protection Commission directives. Relevant provisions include section 24 on processing and storage limitation, section 27 on privacy information, sections 34–38 on rights and automated decisions, section 39 on security, section 40 on breaches and sections 41–43 on international transfers. The regulated-entity AML minimum is generally five years under regulation 23 of the CBN Customer Due Diligence Regulations 2023; Mansa’s ten-year core-record standard applies only while a lawful basis remains under section 24(1)(d) of the Act.

Under section 40, a breach likely to risk individual rights and freedoms is notified to the Commission within 72 hours of awareness, and a high-risk breach is communicated to affected people immediately, subject to the statutory conditions. Complaints may be sent to the NDPC at No. 12 Clement Isong Street, Asokoro, Abuja; https://ndpc.gov.ng.