Privacy Policy

"ASC 2026" app and registration platform of the African Startup Conference, 5th edition, Abdelatif Rahal International Conference Centre, Algiers, 5 to 7 December 2026.

Data controller: the Ministry of Knowledge Economy, Startups and Micro-enterprises, organiser of ASC 2026.

Technical provider (processor): SARL Benos Technologie, 05 route Benachour, 13000 Tlemcen, Algeria, which built the platform, hosts it on a ministry server in Algeria and runs it on behalf of the ministry.

For any question or request about your data: support@africanstartupconference.org.

You give us this data when you register:

• identity: surname, first name, gender, date of birth, nationality;
• contact details: email address, verified once at sign-up with a one-time code, and mobile number, to reach you during the event and, if you choose, on WhatsApp (it is not verified);
• password: the one you choose after confirming your address; it is used for your next sign-ins;
• portrait photograph;
• ID document: national ID number (NIN) or passport number, and a copy of the identity page for a passport;
• professional profile, depending on your role: job title, organisation, sectors, fund and investment theses, startup presentation, website;
• for exhibitors: the company's postal address (mandatory, it appears on the invoice) and tax identification number (NIF, optional);
• your consents (participation terms, privacy policy, image rights, directory visibility).

It is then completed by your use of the app:

• badge and passages at access control points;
• favourites, session registrations, questions and votes during live sessions;
• meeting requests, meetings, messages exchanged with other attendees, documents placed in a deal room;
• for exhibitors: scanned contacts, and the tags and notes you add to them; desk orders, invoices (paid and proforma) and, for bank transfers, the transfer receipt you upload;
• for members of official delegations: flight, accommodation and invitation letter, entered or issued by the protocol team to organise their reception;
• your phone's notification token, if you enable notifications;
• if you report a message or an attendee: the reason, your optional comment and a copy of the reported message; if you block an attendee: the block;
• technical data: IP address, device and browser type, in security logs.

We do not collect your location, your contacts, your photo library or health data. We neither receive nor keep bank card numbers: card payment takes place on the bank payment gateway's page (SATIM for CIB and Edahabia cards, the organiser's international gateway for foreign cards), and we receive only the result. The app contains no advertising and no advertising tracker.

We do not use your data for advertising and do not sell it.

• Other attendees see your name, role, organisation, country and the profile fields provided for your role. Your email and mobile number are shown to them only after an accepted meeting, unless a role-specific rule applies (an investor sees the contact details of the people they scan). A person you scan, or who scans you, is informed of it.
• Messages can be read only by the participants in the conversation. If one of them reports a message, an encrypted copy of that message is handed to the moderation team, which alone can read it; each reading is logged.
• A report is not disclosed to the person reported. A block is not announced to them: they only find that they can no longer write to you or propose a meeting; if an upcoming meeting linked you, they learn that it is cancelled, without your name.
• Your ID document number is never shown to an attendee. It is decrypted only for the security export, which requires two different administrators, is protected by a passphrase, expires after 48 hours and leaves a trace in the log.
• Your portrait and the copy of your ID document can be viewed only by the authorised organising team; each view is logged.
• Organising teams see the data needed for their mission, according to their role (moderation, protocol, security, communication).

• Hosting: the platform and its data are hosted on a ministry server, in Algeria.
• Emails: they are sent from the ministry's mail server.
• Desk bookings: Algeria Venture (EPIC) collects payment for desk bookings and issues the invoices; it receives the orders and the transfer receipts.
• Card payment: the bank payment gateway (SATIM for CIB and Edahabia cards, the organiser's international gateway for foreign cards) receives the card data you type on its page; we receive only the payment result.
• Notifications: if you enable them, your phone's token and a neutral text (no sensitive content: "you have a new notification") pass through Apple's or Google's notification service. The details are displayed after you open the app, from our servers.
• No data is passed to an advertiser or a data broker.
• Authorities receive data only under the conditions set by Algerian law.

• Exchanges with the app are encrypted (HTTPS).
• The ID document number is encrypted with a key specific to each record, itself protected by a master key kept outside the database.
• The content of messages is encrypted in the database.
• Sensitive files (portrait, ID document, supporting documents) are in private storage, never reachable through a public address.
• Access to documents and exports is recorded in a chained audit log that makes tampering detectable.
• Verification codes are stored as a hash, with a limited number of attempts.
• Your password is never stored in clear text: only a hash (argon2id) is kept. Sign-in attempts are limited, and an account targeted by repeated attempts is locked for a few minutes.

In a conversation, "Report" appears under each message you receive and "Report this person" at the top of the thread; on an attendee's directory profile, "Report" sits next to the message button. You choose a reason (spam, harassment, hate speech, sexual content, fraud, other) and may add a comment of up to 500 characters. The moderation team reviews every report: it can dismiss it, remove the message or suspend the account concerned. A suspended account can only sign out or delete itself. You are told, without details, by a notification in the app, when your report has been reviewed.

"Block", in the same places, stops messages and meeting requests with that attendee in both directions. Pending meeting requests between you are closed and an upcoming accepted meeting is cancelled. The conversation remains readable. You can unblock at any time; unblocking does not restore what was cancelled.

Messaging is open only between registered attendees linked by an accepted meeting, or where their role allows it: the organisers, VIPs, and investors towards exhibitors and VIPs. Exhibiting startups, investors, speakers, media and VIPs are approved by the organisers before their badge; visitors and the teammates of an already approved startup are approved automatically. Every registration includes an ID document and a portrait.

We keep your data for as long as needed to organise ASC 2026 and follow it up, then we delete it. Security data (ID number, copy of the ID document, portrait) is deleted after the event. Data is deleted earlier on your request, unless a legal retention obligation applies.

When you delete your account (section 9), deletion is immediate. Only the following is kept:

• orders, payments and transfer receipts for a desk that has been paid or is being paid by bank transfer, for the legal retention period of accounting records: the invoice is made out to the company (company name, address, NIF), without your email or phone number; an invoice already issued is erased and re-issued under the same number, without a contact line. Proforma invoices are erased, as are the receipts of a cancelled order;
• the platform's security log, which cannot be altered afterwards (hash chain): it records actions, technical identifiers, the IP address and the user agent (device and browser type). Entries written before 10 October 2026 may contain an email address (account creation, invitation to a desk team);
• reports concerning your account, with the encrypted copy of the reported message, for attendee safety and fraud prevention: deleting an account does not erase the evidence of abuse. Reports you made stay with the moderation team with their reason and the copy of the reported message, but without any link to you and without the comment you wrote;
• stubs with no name or contact details: your account (status "deleted"), your cancelled registration and the identifier of your revoked badge, so that the gates keep refusing it.

Encrypted backups of the database and of the files (portrait, copy of the ID document, documents) keep a copy until their automatic rotation erases them after 30 days. Backups are used only to restore the platform after an incident.

Under Algerian law no. 18-07 on the protection of individuals in the processing of personal data, you may request access to your data, rectification, deletion where the law allows it, and object to processing on legitimate grounds. You may withdraw your consent at any time (without affecting what was done before).

To exercise your rights, write to support@africanstartupconference.org, giving the name and email address of your account.

You may also refer the matter to the National Authority for the Protection of Personal Data (ANPDP).

Deleting your account: you do it yourself, at any time, without going through the organisers. Sign in on the website or in the ASC 2026 app, open "My space", then, in the last card "Delete my account", read what is erased and what is kept, type DELETE and confirm. Deletion is immediate: your personal data is erased (identity, contact details, portrait, ID document, registration, conversations, meetings, scanned contacts, devices), your badge is revoked and you are signed out on all your devices. An account suspended by the moderation team can still sign in to delete itself.

The procedure is described, without signing in, on the page Delete your account. If you can no longer sign in, write to support@africanstartupconference.org.

The app is intended for professional attendees aged 18 and over.

This policy carries a version and a date. If it changes materially, the new version is presented to you and your consent is recorded with the version number.

Version 2, updated on 24 October 2026. Version 1 of 19 October 2026 described a verification code sent to the mobile; that code no longer exists, and sign-in uses a password. Version 2 reduces processing (no more third-party operator for the mobile) and only adds the hash of the password you choose: it is not presented to you again.