Privacy policy

Version in force as of 1 October 2026. Version française

In case of discrepancy, the French version prevails.

1. Controller and contacts

GKL Consulting, 16 bis avenue Kapela, quartier Yolo-Nord 1, commune of Kalamu, Kinshasa, DRC, RCCM CD/KNG/RCCM/25-B-02916, determines the purposes and means of the processing of GK Power service data and is the controller. Personal data contact: telephone +243 818 080 030, email GKPOWER@gklgroupholdings.com.

KANAPE LLC, registered office at 5900 Balcones Drive, Suite 100, Austin, Texas 78731, United States, Texas SOS file no. 0804649346, acts for managed services and maintenance, under the instructions of GKL Consulting. OVH SAS, 2 rue Kellermann, 59100 Roubaix, France, RCS Lille Métropole 424 761 419, is the designated host.

2. Data and purposes

We process the data needed for ordering and payment: payer’s number, payment method, references, amounts, currency and transaction statuses. Battery, station and slot references and the dispensing and return dates make it possible to manage the rental, calculate its price and return the deposit.

Support requests, useful supporting documents, disputes and follow-ups make it possible to handle incidents and complaints. Technical logs and connection information useful for security, including the IP address where it is processed by the infrastructure, serve to limit abuse and diagnose incidents; their exact scope depends on the active services.

If loyalty or customer accounts are offered, the number may be linked to a history of returns and payments in order to administer the benefits. The account schema also provides for a display name, an email address and information on city, commune or neighbourhood: only the fields actually requested and filled in are processed. Optional fields are flagged. Any later processing or a minutes wallet requires appropriate information before it is activated.

The operations necessary for rental and payment rest on their necessity for the contract, the applicable legal obligations and the collection of consent where Congolese law requires it. Security and abuse-prevention purposes are limited to what is necessary and documented. Acceptance of the CGV is not a blanket consent to any use of the data. Any commercial prospecting is subject to separate information and a separate choice; service messages are not an advertising subscription.

When loyalty is active, the deposit reduction is based on the number of on-time returns linked to the number, according to the announced rules. You may request a human review of this history and contest an erroneous decision or association.

3. Payment data and security

Mobile Money secrets and full card data are entered with the payment provider in its secure journey; we do not ask you to give us these secrets. Our application receives the references, amounts and statuses necessary for the transaction. Numbers may appear in financial data or in provider responses; masking a display does not mean the data is absent from the database.

Access is limited to authorised persons according to their duties. Access control, logging, backup and communications protection measures are implemented according to the scope of the service. No absolute security is promised. Protect the tracking link and report any suspicious access on +243 818 080 030 or at GKPOWER@gklgroupholdings.com.

4. Recipients

The following may receive only the data necessary for their duties: authorised staff of GKL Consulting; authorised agents who assist with the rental; Kanape LLC for managed services; OVH for hosting; FlexPay RDC, the main payment provider, and other providers only where their channel is actually used; the SMS providers actually activated and the notification and monitoring services. Alerts are limited to useful information.

Authorities or authorised bodies may receive data where the law or a lawful procedure requires it. GKL Consulting does not sell personal data for the purposes described here.

5. International hosting and access

Managed services are provided by Kanape LLC in Texas: this may involve access to data from the United States depending on the permissions granted.

The Congolese Digital Code provides, as a principle, for storage and hosting in the DRC and regulates transfers abroad.

6. Retention

We keep data for the periods necessary for each purpose, without applying a single period to all files. Data needed for a rental or a refund in progress is kept until resolution; accounting records and necessary supporting documents are archived for the legally required period, notably ten years for records falling under the AUDCIF, without extending this period to all profiles and logs.

Retention periods: raw terminal transaction data is kept for 90 days and machine logs for 30 days. The other categories (operational history, profiles and loyalty, support files, access and security logs, backups) are kept for the time necessary for the purpose, then deleted or anonymised.

Data needed for a dispute or a legal obligation may be kept in restricted form for the time justified. At the end of that period, it is deleted or made effectively anonymous according to the means deployed; a partly masked number is not, on its own, anonymised.

7. Rights

Under Congolese law, you may request access, rectification, erasure, restriction or portability, or object to processing where that right applies. You may withdraw consent for the future without making earlier lawful processing unlawful. A deletion cannot erase a record whose retention is legally required; we explain the reason and limit its use.

Write to +243 818 080 030 or at GKPOWER@gklgroupholdings.com, stating the relevant reference and the right you wish to exercise. We ask for additional proof of identity only if it is necessary and proportionate. For a copy of the information under the right of access, Article 210 of the Code provides for communication no later than 60 days after receipt of the request, subject to the exceptions provided by law; other requests follow their own rules.

You may lodge a complaint with the competent Congolese data protection authority.

8. Information and updates

Whether collection is mandatory or optional, and its consequences, are specified when you provide your data. Without the elements essential to payment and rental, we cannot carry out the order. A change of purposes, providers or transfers is subject to appropriate information and, if necessary, a new formality or new consent. The Cookies and local storage page supplements this policy.