Personal data

Privacy Policy

This Privacy Policy describes how ILBS GROUP collects, uses, stores, shares and protects the Personal Data of users of the ILBS Platform. ILBS GROUP places paramount importance on the protection of privacy. By using the Platform, you acknowledge having read this Policy.

Effective date: 2026-06-01
Platform: https://ilbsgroup.com

ARTICLE 1 — DATA CONTROLLER

The controller of Personal Data is ILBS GROUP, whose registered office is at Kalou, Conakry, Guinée.

Legal representative: Oua 1 Bilivogui. For any question relating to the processing of your Personal Data, you may contact our Data Protection Officer (DPO) at: dpo@ilbsgroup.com.

ARTICLE 2 — DATA COLLECTED

2.1 Data provided directly

Identification and contact data: surname, given name(s), date and place of birth, nationality, postal address, e-mail, phone number
KYC documents: identity document, identity photo, proof of address and any additional required document
Financial data: amounts invested, transaction history and bank details used for dividend payments
Account data: login credentials (hashed password), 2FA preferences, language, timezone, notification preferences

2.2 Automatically collected data

IP address, browser type and version, operating system and technical information required for security, diagnostics and compatibility
Connection, authentication and sensitive activity logs for security, audit and fraud detection purposes
Technical preferences stored locally in your browser, such as language, display formats, the email address remembered if you enable the remember-me option, or banners you choose to hide

2.3 Sensitive data

In the context of KYC/AML regulatory obligations, we may process sensitive personal data such as nationality, copies of official identity documents or financial information. These data are processed with an enhanced level of protection and in strict compliance with applicable legal provisions.

ARTICLE 3 — PURPOSES AND LEGAL BASES FOR PROCESSING

Data are processed for the following purposes: creation and management of your Account (contract performance); KYC identity verification and AML/CTF compliance (legal obligation); subscription and management of Investment Agreements (contract performance); dividend payments (contract performance); generation and archiving of contractual documents (legal obligation); Platform security and fraud detection (legitimate interest); transactional communications (contract performance / legal obligation); marketing and promotional communications (consent); Platform improvement (legitimate interest); dispute management (legitimate interest / legal obligation).

ARTICLE 4 — DATA RETENTION PERIODS

Your Personal Data are retained for a period not exceeding what is necessary for the purposes for which they were collected:

Active account data: duration of the contractual relationship + 5 years. KYC and identity documents: 5 years from the end of the business relationship. Data relating to Investment Agreements: 10 years from the end of the agreement. Connection and security logs: 12 months. Marketing communication data: until withdrawal of consent or 3 years after the last contact. Necessary cookies and local preferences: retained only for the period strictly useful to Platform operation, until technical expiry, preference change or deletion from your browser.

Upon expiry of these periods, data are securely deleted or anonymised for statistical purposes.

ARTICLE 5 — DATA RECIPIENTS

5.1 Authorised internal personnel

Only members of the ILBS GROUP team who need access to data in the performance of their duties (commercial, compliance and technical teams) have access to it, strictly in accordance with the need-to-know principle.

5.2 Sub-processors and third-party partners

ILBS GROUP may share your data with third-party providers acting as sub-processors in the performance of services offered on the Platform:

Platform host: hosting of data and infrastructure (EU(Amsterdam))
Supabase: storage of KYC documents and agreements (European Union)
Resend: sending of transactional communications (United States)
Banking providers: execution of dividend transfers
External identity verification provider (if applicable): KYC validation (Guinée)

5.3 Competent authorities

ILBS GROUP may be required to communicate your data to judicial, tax, regulatory or supervisory authorities, upon their request and within the strict framework of their legal prerogatives.

5.4 International data transfers

Some of our sub-processors are established outside the Republic of Guinea and the European Union. ILBS GROUP ensures that appropriate safeguards are in place (standard contractual clauses, European Commission adequacy decision) to govern these transfers in compliance with GDPR requirements for European users.

ARTICLE 6 — DATA SECURITY

ILBS GROUP implements appropriate technical and organisational measures to protect your Personal Data against any unauthorised access, disclosure, alteration or destruction:

Encryption of data in transit (TLS/HTTPS) and at rest for sensitive data
Access control: strong authentication (2FA) for administrators and users
Password hashing with robust algorithms (bcrypt) — never stored in plain text
Logging and audit of accesses and sensitive actions
Regular security testing and vulnerability analysis
Incident response procedures and notification in the event of a data breach

ARTICLE 7 — COOKIES AND TRACKING TECHNOLOGIES

7.1 Types of cookies used

Essential cookies: Platform operation, session management, security (Session / 30 days — legitimate interest)
Local preference storage: memorising language, display formats, the email address if you enable the remember-me option, and banners you choose to hide
No analytical, advertising or social media cookie is currently placed without a prior consent mechanism

7.2 Cookie management

The Platform does not trigger a consent banner while no non-essential tracker is active. If audience measurement, advertising or third-party tracking tools are added later, they will be subject to your prior consent with the ability to accept, refuse or change your choices. You can already delete cookies and local data from your browser.

ARTICLE 8 — YOUR RIGHTS

In accordance with the GDPR (for users residing in the European Union) and applicable regulations, you have the following rights:

Right of access: obtain confirmation that data concerning you is being processed and obtain a copy
Right to rectification: have inaccurate or incomplete data corrected
Right to erasure: request deletion of your data, within the limits provided by law
Right to restriction of processing: request temporary suspension of processing
Right to data portability: receive your data in a structured, machine-readable format
Right to object: object to processing based on legitimate interest or for prospecting purposes
Right to withdraw consent: withdraw your consent at any time
Right regarding automated decisions: not be subject to a decision based solely on automated processing producing significant legal effects

How to exercise your rights

To exercise any of these rights, send a request accompanied by proof of identity to dpo@ilbsgroup.com or by post to Kalou, Conakry, Guinée. ILBS GROUP undertakes to respond within one (1) month, which may be extended by two (2) additional months for complex requests.

If you believe your rights are not being respected, users residing in the European Union may contact the competent data protection authority in their country of residence (in France: CNIL — www.cnil.fr).

ARTICLE 9 — MINORS' DATA

The Platform is strictly reserved for persons aged eighteen (18) or over. ILBS GROUP does not knowingly collect Personal Data relating to minors. If we learn that a minor has provided us with personal data, we will take all necessary measures to delete them as soon as possible.

ARTICLE 10 — AMENDMENTS TO THE PRIVACY POLICY

ILBS GROUP reserves the right to amend this Privacy Policy at any time, in particular to comply with any legal, regulatory or technical developments. Any material change will be notified to users by e-mail and/or via a notification on the Platform at least thirty (30) days before it takes effect. The current version is always accessible on the Platform.

ARTICLE 11 — GOVERNING LAW

This Privacy Policy is governed by the laws of the Republic of Guinea. For users residing in the European Union, the provisions of the GDPR apply on a complementary basis.

Login and file security

We use a random browser identifier in an essential cookie, valid for one year, to detect a browser unknown to your account. This identifier does not grant access. We record the approximate country and city derived from the IP address for login history and alerts; we do not collect GPS location. Cloudflare Turnstile protects forms against abuse. New files are held in private storage and undergo security checks before becoming available. Uploaded images and PDFs are rebuilt as sanitized copies. Existing files are not scanned again. Revocation links expire after 24 hours and alert data is deleted after at most 31 days. Processed or rejected originals are deleted from quarantine. Files still pending or in error expire after 24 hours and are deleted.