1. Data controller
The data controller is Kaicedra Consulting SAS.
Point of contact for any question about data protection: contact@map-action.com
2. Data collected
| Category | Data |
|---|---|
| Report data | Incident geolocation, photos, videos, voice notes, text descriptions, timestamp |
| Citizen account | Phone number (verified by OTP code) or, when signing in with Google/Apple, the email address and name linked to that third-party account |
| Field agent account | Phone number, PIN code (stored securely on the server side, never in plain text on the device), affiliated organisation |
| Institutional user account | Name, email address, organisation, role and permission level |
| Technical data | Login identifiers and session tokens, used to keep the user signed in and to secure exchanges with the server |
| Local history | History of reports made without an account, stored only on the user's device until they delete it |
A user can submit a report without creating an account. In that case, only the report data itself (photo, description, geolocation) is sent, without any identifying data.
3. Purposes of processing
Data is collected and processed in order to:
- Enable environmental incident reports to be sent and tracked
- Send reports to the competent Malian authorities responsible for environmental protection
- Produce impact analyses (potentially exposed population, sensitive infrastructure within the impact radius) to guide the institutional response
- Authenticate users and secure access to their account
- Communicate on environmental issues and showcase the Platform's results, including through the public release of report images under the conditions set out in the Terms of Use
- Analyse, in aggregated or anonymised form, the impact of reported incidents for research and awareness purposes
4. Legal basis
Personal data is processed in accordance with Law No. 2013-015 of 21 May 2013 on the protection of personal data in the Republic of Mali.
Processing is based on two grounds:
- the user's consent, obtained at registration and upon acceptance of the Terms of Use
- a public-interest mission, the Platform being deployed in support of the technical services of the Malian State responsible for sanitation and the control of pollution and nuisances
In accordance with Articles 33 and 57 of Law No. 2013-015 of 21 May 2013, the processing carried out by Map Action was the subject of a request for prior authorisation filed with the Personal Data Protection Authority (APDP) of the Republic of Mali, registered under references DAU-2024-0034/APDP (database management) and DAU-2024-0035/APDP (Map Action application).
5. Data sharing
Data relating to a report (photos, videos, geolocation, description) is shared with the competent authorities and organisations responsible for handling the incident, within the limits of their geographical and thematic area of responsibility.
Apart from this, your personal data is disclosed to third parties only with your consent or where required by law.
Images released publicly for communication purposes contain no data identifying their author.
Kaicedra Consulting SAS does not sell users’ personal data and does not use it for any advertising purpose.
6. Data retention
| Data | Duration |
|---|---|
| Report data (photo, geolocation, description) | Kept long-term, as this data forms an environmental record needed to analyse recurring incidents and identify hotspots |
| Citizen account data | Lifetime of the account; deleted within 30 days of the deletion request |
| Field agent and institutional account data | Duration of the assignment or affiliation with the organisation; deleted within 30 days of the request by the organisation or the user |
| Session tokens and technical identifiers | 12 months maximum |
| Local history on the device | Until deleted by the user or the application is uninstalled |
When an account is deleted, reports already sent are kept separately from their author's identity, to preserve the continuity of environmental monitoring without keeping a link to an identified person.
Information that the law requires to be kept is retained for the applicable legal period.
7. Data security
Appropriate technical and organisational measures are in place to protect your data: encrypted connections, time-limited authentication tokens, secure storage of credentials, role- and permission-based access management.
As no system is completely secure, users remain responsible for keeping their login credentials confidential.
8. User rights
In accordance with applicable regulations, you have the right to access, correct and delete your personal data. You can also request the deletion of your account at any time.
To exercise these rights: contact@map-action.com
Every request receives a reply within 30 days.
9. Data of anonymous users
Users who report an incident without creating an account are not identified by the Platform. No identifying data is sent or stored on the server side for these reports.
A history of their reports is stored locally on their device, for personal follow-up, and is not linked to any identity on the server side.
10. Protection of minors
The Platform is not intended for people under 18 and does not knowingly collect their personal data.
Report photos and videos must show environmental situations and must not target identifiable people, especially children.
If personal data concerning a minor comes to our attention, it is deleted without delay. Any content that threatens the safety or dignity of a child is handled under the priority procedure described in the Terms of Use.
No image showing an identifiable minor is ever released publicly, under any circumstances.
11. Hosting and data transfers
Data collected by the Platform is hosted and processed by technical providers selected according to appropriate security and confidentiality requirements. Details of hosting locations and providers involved in processing the data are available on request from contact@map-action.com.
12. Supervisory authority
You have the right to lodge a complaint with the Personal Data Protection Authority (APDP) of the Republic of Mali.
APDP · Quartier du Fleuve, Avenue Moussa Travélé, Porte 462, BP E 4596, Bamako
Phone: 20 23 86 15 · contact@apdp.ml
13. Changes to the privacy policy
Kaicedra Consulting SAS reserves the right to amend this Privacy Policy at any time. Any substantial change is brought to users' attention by in-app notification or by email, and the version in force is dated at the top of this document.
14. Contact
Questions about this Policy or the processing of your data: contact@map-action.com
Reporting inappropriate or illegal content: abus@map-action.com