1. Scope and legal framework
This policy covers data collected through the flexeepay.tn preregistration, contact and newsletter forms, as well as technical data strictly connected with the website's operation and security.
It has been drafted with reference to Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data, together with its implementing texts. Processing carried out through the future Flexee Pay application will require separate documentation.
2. Data controller
The controller determines why and how personal data is processed.
Legal identity: , legal form to be confirmed, tax registration number 1948183/X - company holding the Flexee Pay and Flexee Academy brands
Legal representative: to be confirmed
Address (registered office): 10 rue de l'Île de Rhodes, Les Berges du Lac 2, 1053 Tunis, Tunisia
Contact: [email protected]
3. Data and planned purposes
We limit each collection to the data needed for the stated purpose. Consent boxes are never pre-ticked, and marketing communications are offered as a separate choice.
| Service | Data | Purpose | Consent and retention |
|---|---|---|---|
| Preregistration | First name, last name, phone number, email address, profile, age bracket or retailer category; consent evidence to be provided for. | Manage the waiting list, follow up about launch and understand the request. | Express consent for this purpose. Retention period to be confirmed. |
| Contact | Name, email address, subject and message content. | Receive and respond to the request. | Consent associated with the request. Retention period to be confirmed. |
| Newsletter | Email address and evidence of the user's choice. | Send Flexee Pay news. | Express, specific and optional consent until withdrawal, subject to an . |
| Website security | Technical logs to be confirmed; with Turnstile: IP address, TLS fingerprint, User-Agent, sitekey and origin as described by Cloudflare. | Protect forms from automated submissions and investigate incidents. | Processing strictly connected with security; legal basis, logs and period to be validated. |
| Audience analytics | Identifiers and browsing data depending on the final configuration. | Understand website use and improve its content. | Only after consent to optional cookies. Tool, cookies and periods to be confirmed. |
4. Protection of minors
Anyone under 18 must not complete the preregistration form alone. They should ask a parent or legal guardian to use the parent journey.
The preregistration form is intended for adults (18 and over), parents/guardians, and professionals (partner merchants).
Registration for 12-17 year-olds happens exclusively through the parent journey: a parent or legal guardian creates the account and gives consent, in line with Article 28 of Organic Law No. 2004-63 on the processing of a child's data.
5. Cookies, Turnstile and analytics
Strictly necessary cookies
These support operation, security and storage of the user's privacy choice. Their exact names, providers and lifetimes must be inventoried before publication.
Cloudflare Turnstile
flexeepay.tn uses Cloudflare Turnstile to distinguish human visitors from bots. Cloudflare processes technical signals (IP address, TLS, User-Agent) for this check, but not the content entered into form fields. See Cloudflare's Turnstile Privacy Addendum.
Optional cookies
Google Analytics, or any other analytics service, loads only after the user selects "Accept all". Selecting "Necessary cookies only" blocks it. Users can change their choice at any time via "Manage my cookie choices".
6. Recipients, vendors and transfers
Access to personal data is limited to authorised Flexee Pay personnel and vendors strictly necessary for hosting, email, security and, after consent, audience analytics.
The site's host and email provider are both Oxahost (Tunisia). Any other processors are still to be specified, if applicable.
Using Cloudflare Turnstile and, if applicable, Google Analytics involves processing of browsing data - not personal data - outside Tunisia.
7. Retention and security
Retention periods must be defined for each purpose, aligned with any applicable declarations or authorisations, and applied in practice to mailboxes, backups, logs and any tracking systems. Data must then be deleted or destroyed in accordance with the applicable legal process.
Any security measures described here must match actual practice: encrypted communications, access controls, secrets kept outside public code, updates, appropriate logging and protected backups.
8. Your rights
Subject to the conditions in Tunisian law, individuals may in particular:
- withdraw consent at any time for future processing;
- access their personal data and receive an intelligible copy;
- request correction, updating or deletion where data is inaccurate or processed unlawfully;
- object to processing for valid, legitimate and serious reasons, and object to disclosure to third parties for advertising purposes.
Requests may be sent to [email protected]. The identity verification process and operational response period still need to be formalised.
9. Sources, complaints and contact
The principal texts and resources used for this policy are:
Anyone who believes that their rights have not been respected may contact Tunisia's National Authority for Personal Data Protection (INPDP):
INPDP - 1 rue Mohamed Moalla, 1002 Mutuelleville, Tunis, P.O. Box 525Email: [email protected]
Phone: +216 71 799 853 / +216 71 799 711
Website: www.inpdp.tn
Last updated: September 22, 2026.
