Privacy policy

DNA Entreprises (RCCM CM-DLA-03-2026-B13-00642), with its registered office at Logpom, Douala, Cameroon, publishes and operates the Xpress platform — website, mobile application and related services (hereinafter “the Platform”).

The Platform operates in several countries — currently Cameroon and Kenya — where DNA Entreprises is separately registered. Your data is processed under the law of the country in which the service is provided to you, and the competent supervisory authorities are those of that country. Details of each establishment appear in the legal notice.

DNA Entreprises acts as data controller for the data required to operate the Platform: account creation and management, order fulfilment, payments, deliveries, security and fraud prevention.

Sellers, couriers, travel agencies and other providers present on the Platform are independent entities. Where they process data on their own behalf — managing their customers, commercial prospecting, their own accounting or tax obligations — they are themselves responsible for it. DNA Entreprises cannot be held liable for processing they carry out outside the framework set by the Platform.

Contact: contact@xpress-africa.com.

We collect only what is necessary for the service requested.

• Identity and account — surname, first name, display name, date of birth, gender (optional), profile picture, language, city and country.
• Contact details — telephone number, account email address and, where applicable, a separate payment email address required by certain payment providers.
• Delivery addresses — label, city, country and geographic coordinates of the delivery point you provide.
• Location — used to calculate delivery fees, suggest nearby shops and track an ongoing delivery. It is processed only with your permission, which you may withdraw at any time in your device settings.
• Orders and transactions — products, amounts, payment method chosen, status, history.
• Payments — full bank details and validation codes are handled by our payment providers; we do not retain them in full. We retain transaction references and payment status.
• Identity verification (KYC) — for sellers, couriers and certain travel bookings: supporting document, document number and verification status.
• Technical data — device, operating system, IP address, notification identifier, access and security logs.
• Content you publish — product listings, images, messages to support and to sellers, reviews.
• Referrals — your code, the link between referrer and referee, and a cookie placed in your browser when you follow an invitation link.

We make no solely automated decisions producing legal effects concerning you. Anti-fraud controls may flag an operation, but a human decides.

This distinction governs the rest of this document and should be kept in mind: Xpress acts in two different capacities depending on what you buy.

• Xpress as intermediary — the most frequent case. The product is sold by an independent shop. The sales contract binds you to that seller, who receives the data required to prepare your order and becomes responsible for its own processing.
• Xpress as seller — DNA Entreprises sometimes sells its own products. In that case no third party is involved: we are your seller, and solely responsible for the data of that order.

The product page always states who is selling. That statement determines to whom a complaint should be addressed, which return policy applies, and who answers for your data for that specific order.

Returns are not possible on every item, and are not a general right on the Platform. The product page states the applicable policy; that statement prevails.

The following cannot, in principle, be returned:

• perishable goods — food, flowers, prepared items;
• personalised or made-to-order items;
• digital content already downloaded or accessed;
• travel tickets and reservations, governed by the agency’s terms;
• unsealed hygiene or personal care items.

Where a return is accepted, we process the data strictly necessary to handle it: reason, photographs you provide, exchanges with the seller, decision and refund. These items are retained for the duration of the statutory warranty and applicable limitation periods — a dispute may be raised long after delivery, and a file emptied in the meantime can no longer be defended, by you or by us.

Photographs sent in support of a complaint are passed to the seller concerned: without them, the seller can neither observe nor accept the defect. Do not include personal elements unrelated to the item.

Shops may publish ephemeral photos and videos. When you watch one, we record that you saw it: your account identifier, the story identifier and the date. Nothing else — no viewing duration, no progress, no interactions.

That record serves two purposes only: turning off the coloured ring around the shop once you have seen everything, and resuming where you left off. Without it, every opening would replay everything from the start.

What the seller sees. Only a total view count per story. The seller has access neither to your identity, nor to the list of viewers, nor to the time of your visit.

If you are not signed in, nothing is recorded: stories are simply shown to you from the beginning each time.

Retention. The reading marker is kept for as long as the story exists, then becomes moot — stories stop being shown after 24 hours. The photos and videos themselves belong to the seller, who may withdraw them at any time; where identifiable people appear in them, the seller is responsible.

• Sellers and agencies — what is needed to prepare and honour your order or booking.
• Couriers — your first name, your delivery point and your number, for the duration of the delivery.
• Payment providers — to collect and verify the transaction.
• Technical providers — hosting, notification delivery, messaging, audience measurement, acting as processors on our instructions.
• Authorities — upon lawful request, or to assert our rights.

We do not sell your personal data.

Some of these providers are established outside your country of residence. Transfers then take place under appropriate safeguards — standard contractual clauses or an equivalent mechanism recognised by the competent authority.

Periods imposed by law prevail over those stated here where they differ.

Where. In the app: Profile › Settings › Account & Security › Permanently delete my account (customers and sellers alike). You confirm the request with a code sent by SMS to the account’s phone number. No contact with customer support is needed.

What happens immediately. Your account is removed from the Platform and you are signed out: your profile, your shop and your products are no longer visible. A notification confirms the request and gives the deletion date.

Timeline. The account is permanently deleted 30 days after the request, automatically. During that period, and only during that period, you can recover it at xpress-africa.com/compte/reactivation. A notification tells you when the deletion is complete.

What is deleted. Your sign-in account, name, email, phone number, addresses, date of birth, profile photo, personal files, saved payment methods, browsing and search history, and your devices’ notification tokens.

What is kept, and why. Orders, invoices, payments, accounting records and identity documents (KYC) are kept for the applicable legal period (accounting, tax, anti-fraud and anti-money-laundering obligations). A minimal identification record of the deleted account is also kept, accessible only to authorised administrators, so the account can be traced in case of a dispute, fraud or a request from an authority. This data is used for no other purpose.

Special cases. The request is refused while an order is in progress or a balance is owed to you: the app then tells you what to do (wait for delivery, withdraw your balance). It never requires you to go through customer support.

• Access — obtain a copy of the data concerning you.
• Rectification — correct inaccurate data, directly from your profile.
• Erasure — request deletion of your account and your data, subject to what the law requires us to keep.
• Objection and restriction — object to processing based on our legitimate interest.
• Portability — receive your data in a machine-readable format.
• Withdrawal of consent — at any time, without affecting what was done beforehand.

Write to contact@xpress-africa.com. We respond within 30 days. We may request proof of identity — without it, responding would amount to disclosing your data to whoever asks for it.

You may lodge a complaint with the competent data protection authority of your country of residence.

Encryption of communications, access partitioned by role and permission, logging of sensitive actions, rate limiting and systematic server-side verification of payments. Full payment credentials never pass through our application servers.

No system is infallible. In the event of a breach likely to result in a high risk to your rights, we will inform you and the competent authority within the timeframes set by applicable regulation.

The Platform is intended for persons who have reached the age of majority applicable in their country of residence. That age is not the same everywhere: it is set by national law, and we apply the law of the country from which the service is used. The thresholds in force are detailed on the page dedicated to protection of minors.

We do not knowingly collect the data of a person below the required age. If you become aware that a minor has provided us with data, write to us: we will delete it.

Your age is used to filter what you see. When you provide your date of birth, we use it to hide products and content reserved for an adult audience in the categories that regulation covers — in particular alcoholic beverages, tobacco and related products, and adult items.

What this processing does, and does not do. Your date of birth is used solely to determine whether content may be shown to you. It feeds no advertising profiling, is never disclosed to sellers, and the result of that check is not stored as an attribute of your profile: it is recomputed at display time.

If you do not provide your date of birth, we cannot establish that you meet the age condition: the content concerned is then hidden by default. This is a display restriction, not a penalty.

We use strictly necessary cookies (session, security, basket), a 90-day referral cookie when you follow an invitation link, and audience measurement cookies. The latter are placed only with your agreement where applicable regulation requires it. You may delete them from your browser settings.

The Platform connects buyers with independent sellers, couriers and agencies. Descriptions, prices, images and availability are supplied by those third parties, who answer for them. DNA Entreprises is not a party to the sales contract concluded between a buyer and a seller, except where it sells in its own name.

DNA Entreprises reserves the right to suspend or remove any account, content or listing infringing the law, the terms of use or third-party rights, without prejudice to any action it deems appropriate.

Links to third-party sites, including payment pages, are governed by the privacy policies of their respective publishers.

We may update this document. Any substantial change will be notified to you on the Platform or by message before it takes effect. The date at the top of the page indicates the last revision.

This document is written in French. Versions in other languages are provided for your convenience; in the event of divergence, the French version prevails.