Privacy policy
What we collect, why, how long we keep it, who else sees it, and how to make us stop. Written to Cameroon’s Law No. 2024/017 of 23 December 2024 on the protection of personal data, which became fully applicable on 23 June 2026.
What we can and cannot claim
Who is responsible
The data controller is the entity named in the legal notice. For anything about your own data, write to academy@smartsana.com, or ask at the campus, or telephone the number in the footer and say it is a privacy request.
We have a named person responsible for data protection questions and for being the point of contact with the Authority once it exists. We do not describe that person as a certified Data Protection Officer, because the bodies that would certify one under Cameroonian law do not yet exist, and the claim would be unverifiable.
What we collect, why, and for how long
| What we do with data | What we collect | Why we may do it | How long we keep it |
|---|---|---|---|
| Answering an enquiry | Name, phone, email, city, programme of interest, what you told us about your situation | Your consent, given on the form | 12 months from last contact, then deleted |
| Enrolling you | The above, plus date of birth, identity details you choose to provide, emergency contact, and for under-18s a parent or guardian’s consent and contact details | Your consent, and necessity for the training contract you are entering into | For the duration of the contract and 10 years afterwards for academic and financial records |
| Delivering the programme | Attendance, module completion, assignment submissions and grades, coach notes, days since last contact, work you produce | Necessity for the training contract | For the duration of the contract and 10 years afterwards |
| Taking payment | Amount, date, status, and a payment reference from the mobile-money or card provider | Necessity for the contract, and our legal and accounting obligations | 10 years, per accounting requirements |
| Issuing and verifying your certificate | Your name, programme, level, assessment result, and the projects you chose to publish | Necessity for the contract, and your consent for anything shown publicly | Indefinitely, so an employer can still verify it years later, unless you ask us to take the public record down |
| Sending you news about future intakes | Name, email, phone | Your separate, express, opt-in consent only. Never bundled with enrolment, and withdrawing it changes nothing about your enrolment. | Until you withdraw consent, then deleted from the list |
| Measuring how the website is used | Pages viewed, approximate region and device type (only if you accept measurement cookies) | Your consent, given in the cookie banner. Off until you say yes. | See the cookie policy |
| Publishing our outcome figures | Aggregated, non-identifying counts: enrolled, completed, assessed, in paid work at six months, and how many we reached | Your consent for the follow-up survey; the published figures identify nobody | Published figures kept indefinitely; the underlying survey responses for 3 years |
Consent, and how we record it
Where we rely on consent it is free, informed, specific and express, and it is obtained before we process anything. There are no pre-ticked boxes anywhere on this site, and scrolling is not consent. Because the law puts the burden of proving consent on us, we log the moment you gave it, the exact wording you were shown, the version of the form, the specific purposes you agreed to, and the moment you withdrew it.
Withdrawing is as easy as giving. One message to the privacy address, or a word to your coach. Marketing consent is separate from enrolment consent and withdrawing it has no effect on your place, your grades or your certificate.
Direct marketing requires prior consent. We do not treat an enquiry as permission to market to you, and we do not use an existing-customer exception.
Sensitive data, and why we ask for so little
Cameroonian law treats health, biometric, judicial, religious, political and banking transaction data as sensitive, prohibits processing it in principle, and requires prior authorisation from the Authority in the cases where it is allowed. Since that authorisation cannot currently be obtained, we have designed around it.
- We do not collect health data as a condition of enrolment. If you choose to tell us about an access requirement so that we can accommodate it, we record only what the accommodation is, not a diagnosis.
- We do not hold your payment card or mobile-money transaction detail. The payment provider holds it; we store a reference and a status.
- We collect no biometric data. Attendance is taken by a person, not a fingerprint or a face.
Learners under eighteen
Cameroonian vocational training law allows apprentices from the age of fourteen, and data protection law requires a parent or guardian’s consent for anyone under eighteen. If you are under eighteen we will not enrol you without that written consent, we collect the minimum we can, and we collect no sensitive data about you at all. See safeguarding.
Who else sees your data
| Recipient | What they get | Why |
|---|---|---|
| Your instructor and coach | Everything about your learning: attendance, submissions, grades, coach notes | They cannot teach you otherwise |
| Mobile money and card payment providers | What they need to take the payment | To collect your fees |
| Exam vendors, for the certification exam of your level | The name and identity details the vendor requires to register you | Only with your agreement, for your level’s certification exam |
| Employers, at demo day or via your Career Passport | Only what you chose to publish | With your consent, which you can withdraw |
| SmartSana Labs clients, at Level 3 | Your name and the work you deliver to them | Necessity for the engagement you agreed to join |
| The US host organisation, for your internship | Your name, CV, the work you produce and your contact details | Necessity for the placement you agreed to join. This is a transfer outside Cameroon; see the section below. |
| Public authorities | What the law requires of us | Legal obligation |
| Website host, email provider, learning platform and form handler (to be named individually before launch) | n/a | n/a |
We have written processing agreements with the service providers who handle data on our behalf, and we do not sell personal data to anybody, for any purpose, ever.
Data leaving Cameroon
Cameroonian law requires prior authorisation from the Authority before personal data is transferred to a foreign country or international organisation, and the penalties for transferring without it are substantial. As explained above, that authorisation cannot currently be applied for. This is what we actually do, and what we will do when it can.
- We minimise what leaves. Learner records and enrolment data are intended to be held on infrastructure in Cameroon wherever that is technically possible. Hosting location to be confirmed and named here.
- We name the destinations. Where a service we depend on is hosted abroad, the provider and the country will be named in the recipients table above, not hidden behind a phrase like “our trusted partners”.
- We do not claim adequacy. The list of countries recognised as adequate does not exist yet. We do not assert that any destination is approved.
- Formal authorisation will be sought once the Personal Data Protection Authority is constituted and its transfer procedure is published.
Your rights, and how to use them
| Your right | What it means here |
|---|---|
| Information | To be told what we do with your data: this page, which we version and date. |
| Access | To get a copy of the personal data we hold about you. |
| Rectification | To have anything inaccurate corrected. Tell us and we correct it; we do not require you to prove the error. |
| Erasure | To have data deleted. We will do this except where we must keep academic or financial records, and we will tell you exactly what we are keeping and why. |
| Objection | To object to a particular use. For direct marketing the objection is absolute and immediate. |
| Portability | To receive your data in a usable format, including your assessment record and the work you produced. |
| Objection to profiling and automated decisions | We make no automated decisions about enrolment, assessment or exclusion. A person decides, every time. |
| Rights after death | Processing stops on confirmed death, subject to the exceptions the law allows. Beneficiaries may ask us to update or remove records, and we bear the cost of doing so. |
To exercise any of these, write to academy@smartsana.com or ask at the campus. We will acknowledge within three working days and respond substantively within 30 days, or sooner where the law requires. Statutory response periods under Law No. 2024/017 are to be fixed by regulation and will apply as soon as they are in force; we are not publishing a borrowed foreign deadline in the meantime. There is no charge.
If you are not satisfied with our answer, you may complain to the Personal Data Protection Authority once it is constituted, and you may take the matter to the competent Cameroonian courts at any time. Our own complaints procedure is separate and is for complaints about the teaching or the service.
Keeping it safe, and what happens if we fail
Access to learner records is limited to the people who need it for their job: your instructor, your coach, the pedagogical head and the accounting head for what concerns them. Accounts are individual, data in transit is encrypted, and we keep a record of our processing activities.
If there is a breach we will notify the Authority and the people affected without undue delay. We are not publishing a seventy-two-hour commitment: that is a figure from European law, Cameroonian law does not set one, and quoting it would be a confident statement that is wrong. What we commit to is telling you what happened, what data was involved, what we have done, and what you should do.
Who this site is for
This site is directed at learners in Cameroon. Our training fees are in FCFA, teaching is at our campus in Yaoundé and online on Cameroonian hours, and we run no campaigns aimed at any other country. If you are resident in the European Union, the GDPR may apply to your data rather than, or as well as, Cameroonian law; write to the privacy address and say so, and we will handle your request to the higher of the two standards.
Changes to this policy
This page carries a version number and a date. When the Authority is constituted, when the retention and security reference framework is published, or when we add a service provider, we will update it, change the version, and date the change. If a change materially affects you we will tell you directly rather than relying on you re-reading the page.