Last updated: 1 October 2026 — Version 2.2. Section numbering (6 and 7) follows the Legal Notice; this page is the reference text for personal data and cookies.
6. Personal Data
The Site may collect personal data in the following cases: contact form, newsletter subscription (optional), shop purchase, directory listing (free or paid "Featured" listing), or audience measurement.
6.1 Data controller
SENIDUTI LLC, 8 The Green, STE B, Dover, DE 19901, United States — contact@seniduti.com (see Section 1) is the controller responsible for personal data collected on the Site.
6.2 Applicable data protection law
As the Site is published from the United States, dedicated to the Central African Republic, and accessed from the European Union, several regimes apply cumulatively:
- Central African Law No. 24.001 of January 25, 2024 on the protection of personal data, whose Article 3 covers any processing "that produces effects in the Central African Republic, even if it occurred abroad or by a controller located abroad";
- Regulation (EU) 2016/679 (GDPR), pursuant to its Article 3.2, as the publisher addresses persons located in the European Union;
- applicable US federal and state law, notably the FTC Act (Section 5), the CAN-SPAM Act, and, where relevant, state privacy laws.
In the event of divergence, the publisher applies the rule most protective of the data subject.
6.3 Data collected, purposes, and legal basis
| Data / purpose | Legal basis |
|---|---|
| Contact form — name, email, message: responding to enquiries | Legitimate interest (GDPR art. 6.1.f; Law 24.001 art. 13) |
| Shop order — name, email address, products purchased, order identifier transmitted by Lemon Squeezy: delivery of the digital content, after-sales service, accounting (payment information is processed by Lemon Squeezy, see 6.6) | Performance of a contract (GDPR art. 6.1.b; Law 24.001 art. 13) |
| Invoicing, accounting, archiving of electronic contracts | Legal obligation (GDPR art. 6.1.c; CAR Decree No. 23.047 art. 40) |
| Newsletter — email address, consent text and date. Subscription is optional: it is never a condition of access to any feature of the Site (see 6.3.1) | Express consent, revocable at any time (GDPR art. 6.1.a and 7; Law 24.001 art. 13 and 15; CAR Law No. 22.002 art. 28) |
| Anonymized audience measurement, security and fraud prevention | Legitimate interest, balanced against data subjects' rights (GDPR art. 6.1.f; Law 24.001 art. 13) |
The publisher processes no sensitive data within the meaning of Article 17 of Law No. 24.001, nor any special category within the meaning of Article 9 of the GDPR. Consent may be withdrawn as easily as it was given, without affecting the lawfulness of prior processing.
6.3.1 Newsletter: a free and optional subscription
The puzzle's "leaders" level and the personalized postcard builder are free and unlimited for every visitor, whether or not they subscribe to the newsletter. On first use, an invitation to subscribe is shown; it can be dismissed with one click ("Continue without subscribing") with no restriction of access.
Subscribing requires entering an email address and ticking a box that is not pre-ticked: "I would like to receive emails from Centrafrique Pratique (news, data updates, shop offers). Optional — does not affect access to the Site." Consent given this way is freely given within the meaning of GDPR Article 7(4), specific and informed; its exact text and date are recorded via Netlify Forms (GDPR art. 5.2 and 7.1; Law No. 24.001 art. 13). Every email includes a one-click unsubscribe link.
6.3.2 Business directory and "Featured listing"
Data collected. Name of the business or organisation, sector, region and town, short description, website or social media, professional contact details (telephone / WhatsApp, email address), the plan chosen (free or "Featured") and, for a Featured listing, the order identifier transmitted by Lemon Squeezy. No logo or photo is collected at this stage.
Source. The data is provided by the business itself or by its authorised representative, who confirms at submission that they are entitled to request publication and, where a natural person is named as contact, that this person agrees.
Fields displayed publicly. The following are published and therefore visible to and searchable by any visitor of the Site: name, sector, region, town, description, website and professional telephone / WhatsApp number. The contact email address is never published; it is used only to manage the listing. The publisher recommends using a business line rather than a personal number.
Purposes and legal bases. Publishing and managing the listing: consent of the business representative for publication (GDPR art. 6.1.a; Law 24.001 art. 13) and legitimate interest for verifying and administering the directory (GDPR art. 6.1.f). Subscription and invoicing of the Featured listing: performance of a contract (GDPR art. 6.1.b) and legal accounting obligation (GDPR art. 6.1.c; CAR Decree No. 23.047 art. 40).
Retention. The listing is kept for as long as it is published, then for twelve (12) months after its removal for traceability, before deletion. Order and invoicing data for the Featured listing is kept for ten (10) years (Decree No. 23.047 art. 40; Law No. 22.002 art. 53).
Update, removal and objection. Requests to update or remove a listing are sent to contact@seniduti.com. Any natural person named in a listing may object to the publication of their data at the same address (GDPR art. 21; Law 24.001 art. 30); the listing is then amended or removed within one (1) month.
6.4 Retention periods
Data is retained only for as long as strictly necessary for the stated purposes, then destroyed or anonymized (GDPR art. 5.1.e; Law No. 24.001 art. 9).
| Category | Period |
|---|---|
| Order, invoicing data, and electronic contracts | 10 years from the end of contract performance — required by Article 40 of CAR Decree No. 23.047 and Article 53 of CAR Law No. 22.002 |
| Contact data from voluntary sign-up or outreach | 3 years from last contact, or until unsubscribe if earlier |
| Audience measurement | 13 months in non-anonymized form, then anonymization |
| Directory listing data (see Section 6.3.2) | For as long as the listing is published, then 12 months after its removal, before deletion (Featured-listing order data follows the 10-year period above) |
| Customer service correspondence | 3 years from closure of the request |
Longer retention for archiving in the public interest, or historical, statistical, or scientific research, remains possible with appropriate safeguards (GDPR art. 89; Law No. 24.001 art. 11).
6.5 User rights
Common baseline. Regardless of location, every data subject has the following rights:
- access to their data and information on purposes, categories, and recipients (GDPR art. 15; Law 24.001 art. 30 — exercised free of charge);
- rectification, completion, and updating of inaccurate, incomplete, ambiguous, or outdated data (GDPR art. 16; Law 24.001 art. 32);
- erasure and blocking / restriction of processing (GDPR art. 17 and 18; Law 24.001 art. 32);
- objection, at any time and free of charge — and, for direct marketing, without having to give a reason (GDPR art. 21; Law 24.001 art. 29);
- portability of provided data, in a structured, machine-readable format (GDPR art. 20);
- withdrawal of consent at any time (GDPR art. 7.3; Law 24.001 art. 13);
- unsubscribe from any commercial communication, by a means as simple as subscribing (Law 24.001 art. 15; CAN-SPAM Act).
Minors. Consent is given or authorized by the holder of parental authority, who exercises the child's rights; the minor is involved according to age and maturity (Law 24.001 art. 10 and 36; GDPR art. 8). The Site is not directed at children under 13 and does not knowingly collect their data (COPPA). In the European Union, the consent of a child below the age set by their Member State (16 by default, 13 to 16 depending on the country) is given or authorised by the holder of parental responsibility.
How to exercise these rights. Requests should be sent to contact@seniduti.com, by telephone at +1 302 508 4912, or by post to SENIDUTI LLC, 8 The Green, STE B, Dover, DE 19901, United States, together with proof of identity. The publisher responds within a maximum of one (1) month. It may refuse requests that are manifestly excessive by their number or repetitive character, in which case the burden of proof lies with the publisher (GDPR art. 12.5; Law 24.001 art. 31).
6.5.1 Complaints — Central African Republic
Complaints are addressed to the agency responsible for personal data protection, an independent administrative authority established by Law No. 24.001. Pending its effective establishment, its functions are carried out by the Ministry responsible for the Digital Economy, Posts and Telecommunications (art. 57). For matters relating to electronic transactions, the competent body is the Electronic Communications and Postal Regulatory Authority (ARCEP) (Law No. 22.002 art. 59).
6.5.2 Complaints — European Union
Any person located in the European Union may lodge a complaint with the supervisory authority of their Member State of residence, place of work, or the place of the alleged infringement (GDPR art. 77). The list of authorities is published by the European Data Protection Board (edpb.europa.eu).
The publisher's representative in the Union within the meaning of Article 27 GDPR: Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria.
6.5.3 United States residents
Residents of certain states have specific rights (access, deletion, correction, opting out of the "sale" or "sharing" of data). SENIDUTI LLC does not sell or share personal data with third parties for behavioral advertising purposes. Requests are made to the same address, without discrimination as to price or service. Where a state law applies, the response timelines and appeal rights it provides apply in place of the general one-month period stated above.
6.6 International transfers
Data is hosted and processed in the United States by the following recipients, each for the role indicated:
| Recipient | Role | Country |
|---|---|---|
| Netlify, Inc. | Hosting of the Site and receipt of form submissions (contact, newsletter, directory) — processor | United States |
| Lemon Squeezy, Inc. (a Stripe company) | Payment, invoicing and tax as Merchant of Record — independent controller for those purposes | United States |
| Newsletter sending platform | Sending emails to subscribers — processor; will be named here as soon as it is selected | — |
| Audience measurement tool | Anonymised traffic statistics, activated only with your consent (see Section 7) — will be named here as soon as it is selected | — |
No data is transmitted to other third parties, except where required by law.
Under Central African law. In accordance with Articles 21 to 27 of Law No. 24.001, transfer to a State that is not a member of CEMAC or ECCAS requires an adequate level of protection (art. 24) and prior notification of the agency (art. 25). Failing that, transfer occurs by derogation where it is necessary for the performance of the contract concluded with the data subject, or where the data subject, informed of the absence of an equivalent level of protection, has consented (art. 26), subject to appropriate contractual clauses (art. 27).
From the European Union. Transfers are made on the basis of the European Commission's standard contractual clauses (GDPR art. 46.2.c), accompanied by a transfer impact assessment, or an applicable adequacy decision (GDPR art. 45). Netlify, Inc. is certified under the EU-U.S. Data Privacy Framework, the UK Extension and the Swiss-U.S. Data Privacy Framework: transfers to Netlify rely on that adequacy decision. As regards Lemon Squeezy, Inc., transfers rest on the standard contractual clauses referred to above; its certification under the Framework remains to be confirmed.
Payment (Shop and Featured listing). Lemon Squeezy, Inc. processes the payment as Merchant of Record and as an independent controller for payment, invoicing, tax and fraud-prevention purposes, under its own privacy notice: lemonsqueezy.com/privacy. SENIDUTI LLC receives order and fulfilment data from Lemon Squeezy (name, email address, products purchased, order identifier) and remains the controller for delivery, after-sales service and accounting. Card numbers and complete banking details are never accessible to SENIDUTI LLC. To exercise your rights over payment data, contact Lemon Squeezy; for order and fulfilment data, contact SENIDUTI LLC (Section 6.5).