Manufar sirri

The controller for the processing described here is Parousia Group, whose head office is at 157, avenue du Livre, Kinshasa – Gombe, Democratic Republic of the Congo. It can be reached at contact@parousiagroup.com and on +243 892 844 000.

The group operates regional companies which handle the enquiries and applications of their own market: Parousia West Africa (Lagos, Nigeria), Parousia East Africa (Nairobi, Kenya), Parousia Europe (London, United Kingdom), Parousia America (United States), Parousia Middle East (Dubai, United Arab Emirates) and Echad Technologies (Singapore). Where your message is handled by one of them, that company is named in the reply you receive.

This policy covers www.parousiagroup.com and the regional sites operated on the same codebase: westafrica, eastafrica, europe, americas, middleeast and apac.parousiagroup.com. The processing described is the same on all of them, because it is the same application, configured for a different entity.

It does not cover the products operated under the group’s six solutions — NetVox Intelligence, Global Technology Africa, Afrika Plaza, PAGEXPRESS, PAGPay and INTIC — nor their own websites. Those services process data under their own notices and, where they carry a contract, under that contract. Following a link out of this site takes you out of this policy.

This site collects what you type into one of its three forms, and one language code. There is no account to create, no login, and nothing is collected from you for simply reading a page.

• No audience measurement or analytics. No product of that kind is installed, and the site’s content security policy allows connections to its own origin only.
• No advertising, no advertising identifier, no retargeting, no data broker.
• No profiling within the meaning of Article 4(4) of the GDPR, and no scoring of visitors, candidates or enquiries.
• No personal data is sold, and none is shared for cross-context behavioural advertising within the meaning of Cal. Civ. Code § 1798.140.
• No personal data is written to the application logs. The three form routes log the outcome of a submission and, for an application, the role applied for — never a name, an address, a message or a file.
• No special categories of data under Article 9 of the GDPR are requested. A CV may contain such data if its author has chosen to put it there; the group does not use it as a selection criterion.

The table below is the whole of it. A purpose that is not in this table is not pursued on this site.

Where the basis is consent — the newsletter, and a speculative application kept on file — you can withdraw it at any time under Article 7(3) of the GDPR. Withdrawal is as easy as giving consent: one link in every newsletter, or one message to contact@parousiagroup.com. Withdrawing does not affect the lawfulness of what was done before.

Where the basis is legitimate interest, the interest is stated in the table rather than left to be guessed: answering a message that was addressed to the group, and keeping the forms usable. Neither involves building a profile, and you may object under Article 21 of the GDPR.

The same operations are carried out under the equivalent bases of the other laws that apply to the group: the lawful bases of the Nigeria Data Protection Act 2023, those of the Kenya Data Protection Act 2019, the consent and legitimate purpose rules of the Democratic Republic of the Congo’s digital code, Article 4 of UAE Federal Decree-Law No. 45 of 2021, and the consent and deemed consent provisions of Singapore’s Personal Data Protection Act 2012. Where two laws set different requirements for the same operation, the group applies the stricter one rather than the more convenient one.

There is no automated decision-making, including profiling, within the meaning of Article 22(1) of the GDPR. No message, subscription or application is accepted, ranked, scored or rejected by an automated process. An application is read by a person, and the decision on it is taken by a person.

Two automated checks do run, and neither decides anything about a person: a honeypot field which discards submissions made by robots, and the rate limit described in the record. A submission stopped by either is refused with an explicit error, and can be sent again to contact@parousiagroup.com or careers@parousiagroup.com.

Two rows of that table name a system that is not connected yet. Until a form is connected to an upstream system, the site tells you so in the response it gives you — it does not display a confirmation for something it could not deliver. When a system is connected, it is entered in this table before it receives its first record, not after.

The group has its head office in the Democratic Republic of the Congo and companies in Nigeria, Kenya, the United Kingdom, the United States, the United Arab Emirates and Singapore. A message or an application sent from the European Economic Area is therefore likely to be read outside it.

Where the European Commission has adopted an adequacy decision under Article 45 of the GDPR covering the destination, the group relies on it. Where it has not — and no adequacy decision covers the Democratic Republic of the Congo — the transfer rests on the standard contractual clauses of Commission Implementing Decision (EU) 2021/914, supplemented, where the assessment required by the judgment in Case C-311/18 shows it necessary, by additional measures. Transfers from the United Kingdom rest on the International Data Transfer Agreement or on the UK Addendum to those clauses. The derogations of Article 49 are not used as a standing basis for routine transfers.

The same movement of data is subject, in the other jurisdictions, to their own cross-border rules: the transfer provisions of the Nigeria Data Protection Act 2023, those of the Kenya Data Protection Act 2019, those of the Democratic Republic of the Congo’s digital code, Article 22 and following of UAE Federal Decree-Law No. 45 of 2021, and the transfer limitation obligation of Singapore’s Personal Data Protection Act 2012.

The durations are those set out in the record above. They are fixed by this policy: they are not a description of what a supplier happens to do by default. Each runs from the event named in the table — the last exchange, the unsubscribe request, the close of a recruitment, receipt.

When a duration expires the record is deleted, not archived and not anonymised into a form the group could still act on. Where a system holds a copy, the deletion instruction is passed to that system. Where a longer period is imposed by a law the group is subject to — an accounting or a limitation rule — only what that law requires is kept, and only for as long as it requires.

Article 32 of the GDPR requires measures appropriate to the risk. The measures below are stated because they are verifiable in the code that serves this page, not because they sound reassuring.

• Every submission is validated again on the server. Browser-side validation is a convenience for you and is never treated as a guarantee.
• No personal data is written to the application logs — not a name, not an address, not a message, not a file name.
• A CV is accepted only if its first bytes match the format it claims to be: PDF, the ZIP container of a DOCX or ODT, or the OLE2 container of an old DOC. The size is capped at 5 MB. This is a format check and it is not an antivirus; it is stated as what it is.
• The file name sent with a CV is stripped of path separators and of characters that a downstream system could interpret.
• The forms are rate limited by IP address, as recorded in the register.
• Transport is encrypted and pinned by a two-year HTTP Strict Transport Security policy with preload. The content security policy allows scripts, styles, images, fonts and connections from this origin only; framing is denied outright; the permissions policy denies camera, microphone, geolocation and interest-cohort access.
• The site ships no third-party JavaScript, loads no remote image and no remote font, and calls no external mapping or font service. The office map is drawn from data held in the repository.

If a personal data breach occurs and is likely to result in a risk to the rights and freedoms of the people concerned, the group notifies the competent supervisory authority within 72 hours under Article 33 of the GDPR, and informs the people concerned directly where Article 34 requires it. The equivalent notification duties of the Nigerian, Kenyan, Emirati and Singaporean laws are met in the same movement.

• Access — obtain confirmation that data concerning you is processed, a copy of it, and the information in this policy applied to your own case (Art. 15).
• Rectification — have inaccurate data corrected and incomplete data completed (Art. 16).
• Erasure — have data deleted where one of the grounds in Article 17 applies, in particular where you withdraw the consent on which the processing rests.
• Restriction — have processing frozen while a contest over accuracy or over a legitimate interest is resolved (Art. 18).
• Portability — receive the data you provided in a structured, commonly used and machine-readable format, and have it sent to another controller where that is technically feasible (Art. 20).
• Objection — object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (Art. 21).
• Withdrawal of consent — at any time, without giving a reason, and as easily as it was given (Art. 7(3)).
• Not to be subject to a decision based solely on automated processing (Art. 22). None is taken here, as the section “Automated decisions” states.

The Nigerian, Kenyan, Congolese, Emirati and Singaporean laws grant rights of the same nature — access, correction, deletion, objection, withdrawal of consent — and they are exercised by the same route. Residents of California have the additional rights set out in the section that concerns them.

You do not have to go through the group first, and nothing in this policy limits that right. Article 77 of the GDPR, and the equivalent provisions of the other laws, allow you to complain directly to your authority.

This section is given under the California Consumer Privacy Act as amended by the CPRA. In the categories of Cal. Civ. Code § 1798.140(v), the site collects identifiers (name, email address, telephone number, IP address), professional or employment-related information (the content of an application and the CV attached to it), and the content of electronic communications you choose to send through the contact form. It collects no biometric information, no geolocation data, no government identifier and no financial account information.

The sources are you, and only you: the site receives no personal information from a data broker, an advertising network or a social platform. Each category is collected for the purpose stated against it in the record above, disclosed only to the recipients listed in the section “Who receives the data”, and kept for the period stated in the record.

These sites are addressed to institutions, clients, journalists and candidates for employment. They are not directed at children, no service here is offered directly to a child within the meaning of Article 8 of the GDPR, and the group does not knowingly collect data from a person below the age at which their country allows them to work. Where the group learns that it holds such data, it deletes it.

This document carries a version number, a review date and an effective date, and all three are displayed. A change that adds a purpose, a recipient, a transfer or a longer retention period raises the version number and is announced on the site before it takes effect. A correction of wording that changes nothing in substance raises the minor number only.

Earlier versions are kept, and a copy of the version in force on a given date is sent on request to contact@parousiagroup.com. A privacy policy that cannot be produced as it stood on the day of the processing is of no use to anyone examining that processing afterwards.