Privacy Policy

The controller of the personal data collected through the Kembielti platform is Kembielti SARL (DEV — À CONFIGURER), tax identification number 0000000/X/X/000, whose registered office is at Adresse à configurer, Tunis, Tunisie.

The processing described below is subject to organic law no. 2004-63 of 27 July 2004 on the protection of personal data.

• Company and user identification : legal name, tax identification number, address, sector; name, e-mail address, role and account identifier of each user.
• Instrument data : amounts, dates, references, the mentions carried on the instrument, the parties' legal identifiers — national identity number, tax identification number, bank account number — and the scanned image of the document.
• Settlement data : for every settled instrument, the outcome (on time, late, unpaid), the amount, the due date and the settlement date.
• Billing data : the plan taken out, the contracted price, the documents issued and the payments recorded.
• Technical data : activity and security logs, correlation identifiers, display preferences.
• Fraud-prevention data : at account creation only — IP address, browser user agent, the domain of the creator's e-mail address, and a timestamp.

• Providing the Service : digitising and extracting instruments, tracking receivables and payables, compliance checks, ownership transfer, printing, dashboards.
• Solvency network : calculating and making available a score per partner identifier (article 5).
• Fraud and abuse prevention : detecting multiple registrations, identity reuse and the double pledging of one instrument.
• Notifications : due-date, late-payment and instrument-event alerts, according to the company's preferences.
• Invoicing and accounting obligations : issuing documents and retaining them as required by law.
• Security and support : logging, incident diagnosis and assistance.

• Performance of the contract : providing the Service, notifications, invoicing.
• Express consent : participation in the solvency network. That consent is collected when the account is created, through a box that is not pre-ticked, and retained together with the exact version of the text accepted and its timestamp.
• Legal obligation : retention of accounting and tax records.
• Legitimate interest : fraud prevention and platform security, strictly as described in article 3.

The network is mutualised: it is the heart of the Service and the reason express consent is asked for. Here is precisely what it processes.

• What is processed : only instrument settlement events — outcome, amount, due date, settlement date — attached to the debtor's legal identifiers (identity card, tax identification number, bank account number). No telephone number is ever used as an identifier.
• What is published : never the instruments themselves, and never the identity of holders. A lookup returns an aggregated A-to-E band, a confidence indicator and summary figures — number of events, share settled on time, total volume, date of the last default.
• What is not processed : an instrument rejected by its holder never enters the calculation; an outstanding instrument not yet due produces no event; acceptance and aval have no effect on the score.
• Scope : the score is global — fed by all companies using the Service and consultable by them for a given identifier.
• Reliability : below three observed settlements, the score is explicitly flagged as resting on insufficient data. It is a decision-support aid, never an automated decision.

A data subject may request access to the events recorded under their identifier and the rectification of inaccurate data, in the manner set out in article 9.

A company's instrument data and documents are accessible only to its own authorised users. The Publisher's staff access them only for support and security purposes, and such access is traced.

Only the settlement data described in article 5, in aggregated form, is shared among the companies using the Service. No data is sold, or transferred for advertising purposes.

Technical providers may be involved in hosting, sending e-mail, collecting payments and automatically recognising scanned documents. They act on the Publisher's instructions and for those purposes only.

• Account and instrument data : for the duration of the contractual relationship, then archived in accordance with Tunisian accounting and tax obligations.
• Settlement events : retained beyond the contractual relationship, since the network's value rests on history; the data is then reduced to what the calculation requires.
• Accounting records : for the applicable statutory retention period.
• Fraud-prevention data : retained for as long as the corresponding signals need to be handled.
• Technical logs : retained for a short period, for security and diagnosis.

The Publisher implements appropriate technical and organisational measures: encryption in transit, centralised authentication, role-based access control, strict data partitioning between companies, access logging and regular backups. Logs contain neither personal identifiers nor secrets.

Hosting : the final hosting location is not settled as at the date of this version. Should the data be hosted outside Tunisia, the authorisation required by the applicable regulations would be obtained beforehand and this policy updated.

In accordance with organic law no. 2004-63, every data subject has a right of access, rectification, objection and erasure, within the limits of the statutory retention obligations binding on the Publisher.

These rights are exercised by written request to contact@example.invalid, together with proof of identity. A response is provided as promptly as possible.

As regards settlement data, rectification concerns the accuracy of the recorded event. A score can only be corrected by correcting the events that make it up: it cannot be edited directly.

The use of cookies and local storage is described in the cookie policy.

The prior declaration of the processing described above to the National Authority for the Protection of Personal Data is being prepared. This policy will be updated once those formalities are complete.

For any question about this policy or your data: contact@example.invalid — +216 00 000 000 — Adresse à configurer, Tunis, Tunisie.