Privacy policy
Published version: 2026-01
Draft to be completed or validated before publication. Entries marked “unavailable” will be replaced once validated.
Controller and scope
The controller for MEG’s own processing is BARTIK, Libreville, Gabon. Personal data contact: contact@myedugabon.com or privacy@myedugabon.com. Data protection officer: unavailable.
This policy covers visitors, students, company and school representatives, parents and authorised users. A school or company may be controller for its own processing, especially when recruiting or managing a school record. Role allocation and operations where MEG acts only on a school’s instructions: unavailable.
Data, purposes and legal bases
The bases below are proposed under article 71 of law n°025/2023 and must be validated for actual flows.
| Purpose | Data concerned | Proposed basis |
|---|---|---|
| Account and profile | Identity, contact details, age, identifiers, pathway, skills, preferences; representative authorisation | Performance of requested service; legitimate interest to verify authorisations |
| Offers and applications | CV, target offer, selected documents, exchanges and application status | Service and requested pre-contractual steps |
| MEG Verify/KYS | Student card, enrolment certificate, transcripts, school response, verification history | Requested verification service; legitimate interest for proportionate anti-fraud checks |
| OCR | Document image and extracted text | Same purpose and basis as verification or requested calculation |
| APS and optional recommendations for adults | Required grades, pathway and preferences; score and results | Separate proposed consent; exact conditions: unavailable |
| Internship | Agreement, weekly log, evaluations, exchanges with supervisors | Performance of requested service; each organisation’s role: unavailable |
| Support and security | Requests, reports, IP address, logins, technical events and access | Legitimate interest in protection and assistance; legal obligation for connection and traffic data |
| Institutional statistics | Pathway and internship indicators, before anonymisation | Legitimate interest subject to risk analysis; any named transfer requires a specific basis |
| Optional communications and non-essential trackers, if any | Contact details, preferences and authorised events | Consent, revocable |
For minors, prior parental authorisation and specific restrictions apply in addition. A contractual basis does not override them.
MEG limits data to what is necessary. Do not send sensitive information without a justified request and specific notice. Exact fields, sensitive data, payment details and payment features: unavailable. No payment or biometric processing is presumed active under this draft.
Origin and mandatory nature
Data comes from you, people you contact, the verifying school, supervisors and technical use of the service. Any indirect collection must state its source and be explained within legal time limits, at latest at first communication or transfer if earlier.
Each form states required fields and consequences of refusal: inability, as applicable, to create an account, submit an application or verify a document. Optional data does not block access to features that do not need it. Form labelling and notices: unavailable.
Access and recipients
Data is accessible to authorised MEG staff according to their role, recipients of your applications or messages, and schools or supervisors involved in verification or an internship. A recruiter should not by default receive all your school documents.
Technical providers process data needed for their service under contract. Authorities may receive legally required data. Named institutional transfer does not follow from a mere statistical purpose. Public profile visibility, score access, documents and exports: unavailable.
Hosting and transfers
Vercel, Supabase, Cloudflare, Upstash and Sentry are used in the current service architecture. Their role and locations must be verified at publication.
| Service | Contracted provider | Data and countries, including backups and remote access | Transfer safeguards |
|---|---|---|---|
| Website, delivery and network security | Cloudflare, Inc.; Vercel Inc. | United States (and Cloudflare global network); detail: unavailable | unavailable |
| Authentication, database and files | Supabase Inc. | Singapore (registered office); Supabase project region: unavailable | unavailable |
| Cache, monitoring and errors | Upstash, Inc.; Functional Software, Inc. (Sentry) | unavailable | unavailable |
| Email, external OCR or AI, if used | unavailable | unavailable | unavailable |
Article 171 requires APDPVP authorisation for transfers to another State. Particular regimes under articles 173–174 must be assessed case by case; a provider contract alone does not establish lawfulness. Applicable authorisations or regime, references and how to obtain safeguard information: unavailable.
Local hosting in Gabon must only be announced after verified go-live. National copy under article 36 of law n°027/2023 and its implementing rules must also be addressed.
Retention
| Category | Rule and duration |
|---|---|
| Account and profile | During service; period after closure, inactivity threshold and warning: unavailable |
| Applications and messages | unavailable |
| Supporting documents and OCR files | Time needed for verification; erasure of originals and extractions: unavailable |
| APS, verifications and challenges | unavailable |
| Agreements, logs and internship evaluations | unavailable |
| Parental authorisations and consents | unavailable |
| Support and rights requests | unavailable |
| Connection and traffic data | Ten years for data under article 31 of law n°027/2023; technical scope and start date: unavailable |
| Other logs, cookies and backups | unavailable |
The ten-year period does not automatically apply to all CVs, messages or transcripts. Retention for legal obligation or dispute is limited to necessary data, separated from current use and with restricted access. Data is then erased or truly anonymised.
Security and incidents
MEG must ensure limited access, confidentiality, protected exchanges, backup and incident monitoring. Measures actually deployed: unavailable.
In case of a data breach, APDPVP is informed without delay under the law; people at high risk are informed as soon as possible, subject to legal exceptions. Report an incident to contact@myedugabon.com.
Your rights
You may request access, rectification, erasure, restriction, objection and, where legal conditions are met, portability. You may withdraw consent without affecting prior lawful processing. You may object to marketing at any time.
Write to contact@myedugabon.com or privacy@myedugabon.com, stating your request and account concerned. Additional proof of identity is requested only where reasonably doubtful, in proportion.
Response within one month. A two-month extension may be justified and announced during the first month. Requests are generally free; refusal or fees in legal cases must be justified. Erasure may be limited by legal obligation or defence of a right.
You may lodge a complaint with APDPVP and seek judicial remedy.
Scores, minors and changes
The automated processing notice explains intended uses, limits and human review. Profiling of minors is prohibited except under a legally framed exception with APDPVP involvement; parental consent alone does not authorise it.
Minors policy and cookie policy supplement this document. Any new purpose requires prior information and, if needed, separate consent.
References: law n°025/2023, especially articles 66–74, 91–104, 111–118, 142–148, 168–174 and 188–199; law n°027/2023, articles 28, 31 and 36. Sources.