Privacy Policy

1Introduction and Data Controller

1.1 This Privacy Policy ("Policy") describes how GlobalBuy24 ("GB24", "we", "us", "our") collects, uses, stores, shares, and protects your personal data when you use our website, mobile application, and cross-border shopping facilitation services (collectively, the "Service").

1.2 Data Controller. GlobalBuy24 is the data controller responsible for your personal data under applicable law. Our operations are based in Berlin, Germany, and as such, the processing of your personal data is subject to the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). We apply GDPR-standard protections to all users of the Service regardless of their country of residence, including users based in Cameroon.

1.3 Contact.

• Address: GlobalBuy24, Marzahner Promenade 8, 12679 Berlin, Germany
• Email: privacy@globalbuy24.com
• Support: support@globalbuy24.com
• Website: globalbuy24.com

1.4 This Policy is incorporated into our Terms of Service (globalbuy24.com/terms). By using the Service, you confirm that you have read and understood this Policy.

2Data We Collect

We collect only the personal data that is necessary to provide the Service. The categories below describe what we collect, why, and from where.

2.1 Account and Identity Data

Collected when you register:

• Full name
• Email address
• Phone number (used for account authentication, collection notifications, and mobile money payment via Fapshi)
• Date of birth (to verify you meet the minimum age requirement of 18)
• Country and city of residence
• Preferred language and currency setting

2.2 Order and Transaction Data

Collected throughout the lifecycle of each order:

• Shopping request details (product URLs, retailer name, product description, size, colour, quantity)
• Order status and history
• Payment amounts, transaction references, and payment confirmation records (we do not hold your mobile money credentials — see Section 2.6)
• Delivery address used for the order (our Berlin hub address — your personal address is not shared with retailers as a privacy measure)
• Selected collection centre (Douala, Yaoundé, Limbe, or Buea)
• Estimated and actual weights and dimensions of your shipment
• Customs declaration data (your name and contact details appear on import documentation submitted to Cameroonian customs authorities — see Section 6.3)
• Signed collection receipt records (physical records held at collection centres and digitally recorded in our system)

2.3 App and Device Data

Collected automatically when you use the GB24 app or website:

• Device type, model, and operating system
• App version and unique device identifier
• Push notification token (to send you order and collection alerts)
• IP address and approximate location (country/region level derived from IP)
• Session data: screens visited, features used, time spent, error logs, and crash reports
• Referral source (how you first accessed the Service)

2.4 Support and Communication Data

• In-app support messages and chat history
• Emails sent to support@globalbuy24.com or privacy@globalbuy24.com
• Damage claim submissions, including photographs and order evidence you provide
• Feedback, reviews, or complaints submitted through the Service

2.5 Marketing and Preference Data

• Your opt-in or opt-out status for marketing communications
• Record of marketing messages sent and whether they were opened (where technically available)
• Your stated product interests or preferences (if provided voluntarily)

2.6 Data We Do Not Collect

We explicitly do not collect or store:

• Mobile money PINs, SIM credentials, or full mobile account numbers. All payment authentication is handled exclusively by Fapshi on their own infrastructure.
• Payment card numbers or banking credentials of any kind.
• Your precise GPS or device location (we use only city-level or IP-derived location).
• Biometric data of any kind.
• Personal data from anyone under 18 years of age (see Section 12).

3How We Collect Your Data

4Legal Basis for Processing (GDPR)

Every processing activity we carry out has a defined legal basis under Article 6 GDPR. Where special categories of data are involved (none in our standard operations), Article 9 GDPR would also apply.

Legitimate interests balancing test. Where we rely on legitimate interests, we have assessed that our interests (fraud prevention, service improvement, liability protection) do not override your fundamental rights and freedoms, given the limited nature and sensitivity of the data involved and the reasonable expectations of users of a commercial shopping service. You may object to legitimate-interests processing at any time as described in Section 9.6.

5How We Use Your Data

We use your personal data exclusively for the following purposes:

To provide and operate the Service:

• Creating, verifying, and maintaining your GB24 account;
• Reviewing and processing your shopping requests;
• Placing orders with international retailers on your behalf, using our Berlin hub address to protect your personal address;
• Processing payments and maintaining payment records through Fapshi;
• Preparing and submitting customs import documentation for shipments entering Cameroon;
• Coordinating with logistics partners to ship your order from Berlin to your chosen collection centre;
• Sending in-app, push, and SMS notifications about your order status, shipment tracking, and collection readiness;
• Recording and managing collection receipts at our collection centres;
• Delivering your package and confirming receipt.

To protect you and us:

• Verifying your identity and minimum age at registration;
• Detecting, investigating, and preventing fraud, account abuse, and attempts to order Prohibited Items;
• Investigating and resolving damage claims;
• Maintaining records necessary to defend against legal claims.

To comply with legal obligations:

• Fulfilling customs declaration and import documentation requirements under Cameroonian law;
• Complying with German and EU accounting, tax, and export control obligations;
• Responding to lawful requests from competent authorities (see Section 6.3).

To improve the Service:

• Analysing anonymised or aggregated usage data to understand how the Service is used;
• Identifying and fixing bugs and performance issues;
• Developing new features based on usage patterns.

To communicate with you (where consented):

• Sending you promotional communications about new product categories, GB24 features, or partner offers;
• Sharing updates through our optional WhatsApp community channels.

We do not use your personal data to make fully automated decisions that produce legal or similarly significant effects about you without human review (see Section 9.7).

6Sharing Your Data with Third Parties

We do not sell, rent, or trade your personal data. We share it only in the circumstances described below, and only to the minimum extent necessary.

6.1 Fapshi — Payment Processing

GB24 uses Fapshi to process mobile money payments (MTN MoMo, Orange Money) in Cameroon. When you initiate a payment, the GB24 app connects to Fapshi's infrastructure. Fapshi processes your payment transaction and returns a transaction reference and confirmation to us. GB24 does not receive, store, or have access to your mobile money PIN, SIM credentials, or full account number at any point. Fapshi's handling of your data is governed by their own privacy policy. We recommend reviewing it at fapshi.com.

6.2 Logistics and Courier Partners

To ship your order from our Berlin hub to your chosen collection centre in Cameroon, we share the following data with our logistics partners: your order reference number, the weight and dimensions of your package, the destination collection centre address, and a contact name and phone number for collection purposes. We do not share your home address with logistics partners. All logistics partners are contractually bound to use this data solely for the purpose of shipping and delivery.

6.3 Cameroonian Customs Authorities

Cross-border shipments into Cameroon require import customs declarations. Your name, the nature and value of the goods, and the destination collection centre address are included in customs documentation submitted to the relevant Cameroonian customs authority. This is a legal requirement under Cameroonian customs law and is processed under Art. 6(1)(c) GDPR (legal obligation). GB24 does not control how customs authorities use or retain this data once submitted.

6.4 International Retailers

When we place an order with a retailer on your behalf, we provide the retailer with our Berlin hub address as the delivery address. We do not share your personal address, phone number, or email address with retailers. The retailer receives only the information necessary to fulfil the order to our hub.

6.5 Collection Centres

Our collection centre staff in Douala, Yaoundé, Limbe, and Buea have access to your name, order reference, and contact number for the sole purpose of matching you to your package at collection. They record your signed collection receipt. Collection centre staff operate under confidentiality obligations and may not use your data for any other purpose.

6.6 Cloud Infrastructure and Technology Providers

GB24 uses third-party cloud hosting and infrastructure providers to operate the Service. These providers are located within the EU/EEA or in countries with adequate data protection as determined by the European Commission, and are bound by data processing agreements requiring GDPR-compliant handling of your data.

6.7 Customer Support Tools

We use support tooling to manage in-app and email support communications. These providers access your communication data only as necessary to deliver the support function and are bound by confidentiality and data protection obligations.

6.8 Analytics Providers

We use analytics tools to understand how users interact with the Service. These providers receive anonymised or aggregated data by default. Where any identifiable data is involved (e.g., device identifiers), this is processed only under your consent (see Section 11).

6.9 WhatsApp / Meta Platforms

If you choose to join our optional GB24 WhatsApp Community or any associated group, your phone number and WhatsApp profile name will be visible to other group members. This data is processed by Meta Platforms Inc. under their own Terms of Service and Privacy Policy, entirely outside GB24's control. GB24 does not share your order history, transaction data, payment information, or any other Service data through WhatsApp. Participation is entirely voluntary and can be discontinued at any time by leaving the group.

6.10 Legal and Regulatory Disclosure

We may disclose your personal data without prior notice where required by:

• Cameroonian customs or tax authorities in connection with import documentation;
• German or EU regulatory or supervisory authorities in connection with GDPR enforcement or export control compliance;
• Law enforcement agencies in Germany or Cameroon pursuant to a valid legal order, warrant, or court order.

Where legally permitted, we will notify you before disclosing your data in response to a legal request and will take reasonable steps to challenge overly broad or unlawful requests.

6.11 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of GB24's assets, your personal data may be transferred to a successor entity. We will notify you of any such transfer at least 30 days in advance and inform you of any change to this Policy that results. You will have the right to object or delete your account before the transfer takes effect.

7International Data Transfers

7.1 GB24 operates from Berlin, Germany, within the EU/EEA. Most of your data is stored on infrastructure within the EU/EEA.

7.2 The following transfers outside the EU/EEA occur as part of the Service:

7.3 For transfers to Cameroon, which is not currently the subject of an EU adequacy decision, we rely primarily on Standard Contractual Clauses (SCCs) as adopted by the European Commission (Decision 2021/914) where contractual partners are involved, and on legal obligation where data is submitted to government authorities.

7.4 For further information about the specific safeguards applicable to any transfer, contact privacy@globalbuy24.com.

8Data Retention

We retain your personal data for no longer than necessary to fulfil the purposes for which it was collected, subject to legal retention obligations.

When the applicable retention period expires, data is securely deleted or irreversibly anonymised. Anonymised data may be retained indefinitely for statistical purposes.

9Your Rights Under GDPR

As a data subject under GDPR, you have the following rights. We apply these rights to all GB24 users, regardless of their country of residence.

9.1 Right of Access (Art. 15 GDPR)

You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of it along with information about the purposes, categories, recipients, and retention periods.

9.2 Right to Rectification (Art. 16 GDPR)

You have the right to request correction of inaccurate personal data and completion of incomplete data without undue delay. You may update most account data directly in the GB24 app.

9.3 Right to Erasure — "Right to Be Forgotten" (Art. 17 GDPR)

You have the right to request deletion of your personal data where: it is no longer necessary for the purposes collected; you withdraw consent and no other legal basis applies; you object and we have no overriding legitimate grounds; or it was unlawfully processed. This right does not apply where retention is required by law (e.g., our 10-year transaction record obligations) or where we need the data to establish, exercise, or defend legal claims.

9.4 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request that we restrict processing of your data — meaning we may store it but not use it — in the following circumstances: you contest its accuracy (pending verification); processing is unlawful but you prefer restriction to erasure; we no longer need it but you need it for legal claims; or you have objected and we are assessing whether our legitimate grounds override yours.

9.5 Right to Data Portability (Art. 20 GDPR)

Where we process your data based on contract or consent, and processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON or CSV) and to transmit it to another controller. This right covers your account data and order history.

9.6 Right to Object (Art. 21 GDPR)

You have the right to object at any time to processing based on our legitimate interests (Art. 6(1)(f)). We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests or the processing is necessary for legal claims. You have an unconditional right to object to processing for direct marketing purposes at any time; we will stop immediately.

9.7 Rights in Relation to Automated Decision-Making (Art. 22 GDPR)

GB24 does not make decisions about you based solely on automated processing that produce legal or similarly significant effects. All decisions with material consequences (e.g., account suspension, order refusal) involve human review. If this changes, we will update this Policy and ensure you have the right to human review, to express your point of view, and to contest the decision.

9.8 Right to Withdraw Consent (Art. 7(3) GDPR)

Where we process your data based on your consent (e.g., marketing communications), you may withdraw consent at any time through the GB24 app (Settings → Notifications) or by contacting privacy@globalbuy24.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

9.9 How to Exercise Your Rights

Submit a request by emailing privacy@globalbuy24.com with the subject line "DATA RIGHTS REQUEST – [Your Name / Account Email]". We will:

• Acknowledge receipt within 5 business days;
• Respond in full within 30 calendar days (extendable by a further 2 months for complex requests, with notice to you within the first 30 days);
• Explain clearly if we cannot comply with a request and why;
• Not charge a fee unless the request is manifestly unfounded or excessive, in which case we will inform you before applying any charge.

Identity verification. To protect your data against unauthorised access, we may require you to verify your identity before processing a rights request. We will ask for the minimum information necessary for verification and will not retain verification data beyond what is needed.

10Rights Under Cameroonian Law

10.1 Our users are primarily based in Cameroon. Cameroonian law — including Law No. 2010/012 on Cybersecurity and Cybercriminality in Cameroon — contains provisions relevant to the protection of personal data. We are committed to complying with applicable Cameroonian data protection principles.

10.2 Regardless of your location, you may contact us at privacy@globalbuy24.com to raise any concern about how your personal data is handled. We will investigate and respond within 30 calendar days.

10.3 As Cameroonian data protection legislation continues to develop, we commit to reviewing and updating our practices to remain compliant with any new requirements applicable to our Service.

11Cookies and Tracking Technologies

11.1 The GB24 app and website use cookies and similar technologies (including local storage and device identifiers) for the following purposes:

11.2 You may manage cookie and tracking preferences through the GB24 app (Settings → Privacy) or your browser settings. Disabling strictly necessary cookies will prevent the Service from functioning. Disabling analytics cookies will not affect your ability to use the Service.

11.3 We do not permit third-party advertising networks to place tracking cookies on our platform without your explicit consent.

12Children

12.1 The Service is not directed at and may not be used by anyone under the age of 18. We do not knowingly collect, store, or process personal data from any person under 18.

12.2 If we become aware that we have collected personal data from a minor, we will delete it promptly and, if an order was placed, cancel it. If you have reason to believe a minor has registered or placed an order using the Service, contact us immediately at privacy@globalbuy24.com.

13Security

13.1 We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encrypted data transmission between your device and our servers (TLS 1.2 or higher);
• Encryption of sensitive data fields at rest;
• Role-based access controls ensuring staff access only data necessary for their function;
• Regular security assessments and penetration testing;
• Data minimisation — we do not retain data beyond what is necessary;
• Staff training on data protection and confidentiality obligations;
• Contractual data protection obligations imposed on all third-party processors.

13.2 No security system is impenetrable. We cannot guarantee the absolute security of your data. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, BlnBDI), our competent supervisory authority, within 72 hours of becoming aware of the breach, as required by GDPR Art. 33;
• Notify you without undue delay if the breach is likely to result in a high risk to your rights and freedoms, as required by GDPR Art. 34, including a description of the nature of the breach, the data involved, likely consequences, and the steps we are taking.

14Supervisory Authority and Complaints

14.1 You have the right to lodge a complaint at any time with a data protection supervisory authority. As GB24 operates from Berlin, Germany, our competent supervisory authority is:

• Authority: Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, BlnBDI)
• Address: Alt-Moabit 59–61, 10555 Berlin, Germany
• Website: datenschutz-berlin.de
• Email: mailbox@datenschutz-berlin.de

14.2 You may also lodge a complaint with the supervisory authority of the EU Member State where you reside or work, or where an alleged infringement occurred.

14.3 We ask that you contact us at privacy@globalbuy24.com before lodging a formal complaint so we have the opportunity to address your concern directly. We will respond within 30 calendar days and escalate internally if needed.

15Changes to This Policy

15.1 We may update this Policy from time to time to reflect changes to the Service, applicable law, or our data practices. All changes will be published at globalbuy24.com/privacy with a new "Last Updated" date.

15.2 For material changes (changes that affect how we use your data or your rights), we will notify you via in-app notification and/or email at least 14 calendar days before the change takes effect for existing users.

15.3 Continued use of the Service after a material change takes effect constitutes acceptance of the revised Policy. If you do not accept the changes, you must stop using the Service before the effective date. You may also request deletion of your account and data as described in Section 9.3.

16Contact Us

For all privacy-related enquiries, data rights requests, or concerns:

• Controller: GlobalBuy24 — Data Protection, Marzahner Promenade 8, 12679 Berlin, Germany
• Email: privacy@globalbuy24.com
• Website: globalbuy24.com/privacy
• General support and order queries: support@globalbuy24.com

Most account actions, including notification preferences and account deletion, can be managed directly through the GB24 app (Settings → Privacy / Account).