Personal data
Privacy Policy
This Privacy Policy describes how DEFENZ (“we”, “us”, “our”) processes your Personal Data when you use our website and the bug bounty platform services.
DEFENZ is the data controller. We collect only what is needed to run the platform: account, reports, triage and reward payments. We never sell your data and run no behavioural advertising.
Applicable framework: Cameroon Law No. 2010/013 of 22 December 2010 on electronic communications and personal data protection, Law No. 2010/012 on cybersecurity and cybercrime, ANTIC regulations, together with Regulation (EU) 2016/679 (GDPR) principles where we process data of individuals located in the European Union.
1. Why and how are your personal data collected and processed?
We process your Personal Data for the purposes below. They are collected from you (forms, reports, account) or generated automatically when you browse the site.
Unless stated otherwise, these processing operations rely on the performance of our services, our legitimate interest in running them securely, or compliance with a legal obligation.
| Purpose | Legal basis | Personal data processed | Retention |
|---|---|---|---|
| Technical and security management of the site | Legitimate interest (safety and proper operation of the site) | IP address, login date and time, technical logs, strictly necessary cookies | 6 months from your last access, then deleted |
| Account creation and management (researcher or company) | Performance of the contract | Email, username, password (hashed), role, language preference, verification status | Duration of the account, then deleted within 30 days unless legally required |
| Submission, triage and handling of vulnerability reports | Performance of the contract | Title, affected asset, reproduction steps, impact, CVSS score, proofs (PoC), comments | Duration of the program + 3 years (traceability, disputes, audit) |
| Identity verification (KYC) and trust levels | Performance of the contract and legal obligation | Phone number (encrypted), verification level, city and university (optional) | Duration of the account |
| Reward payouts | Performance of the contract and accounting obligations | Payout number (encrypted), amount in USD, transaction reference, status. | 10 years (OHADA accounting obligations) |
| Platform notifications (email / SMS) | Legitimate interest, unless you object | Notification content, delivery channel, recipient | 12 months |
| Contact and business-to-business outreach | Legitimate interest | Name, professional email, phone, company, message | 3 years from the last contact |
| Handling of data-rights requests and disputes | Legal obligation and legitimate interest in defending our rights | Request, supporting documents, reply | 6 years from our reply |
2. Who are the recipients of your personal data?
Your data is shared on a need-to-know basis with the relevant internal teams (triage, administration, finance) and with the processors below, who act only for the purposes described in section 1.
We do not sell your data or pass it to third parties for advertising. Verification OTP codes are generated and checked by the platform: no third-party SMS provider is involved today.
| Recipient | Purpose | Location |
|---|---|---|
| DEFENZ — authorised staff | Triage, administration, finance | Cameroon |
| Hosting provider (server infrastructure) | Hosting, operations, backups | Cameroon |
| Payment provider | Reward payouts | Cameroon |
| Transactional email platform | Sign-in, notifications, alerts | As contracted with the provider |
| Competent authorities (ANTIC, courts) | Legal obligation, court order | Cameroon |
3. How are your personal data protected?
We apply widely recognised technological and operational security standards to preserve your Personal Data from loss, misuse, alteration or destruction during processing.
Your data will not be used, exploited or disclosed to any third party for a purpose other than those set out in this policy.
- Sensitive personal data encrypted at rest (AES-256-GCM), keys isolated from the database
- Passwords hashed, two-factor (OTP) required for privileged roles
- Role-based access control (RBAC), least privilege, periodic access review
- Tamper-evident audit log (append-only) retained for 3 years, anomaly alerts
- Encrypted backups and restore plan, encrypted transit (HTTPS) on the public domain
4. What are your rights?
Under the applicable rules you may exercise the following rights:
- Right to withdraw your consent at any time
- Right of access, rectification and erasure of your data
- Right to restriction of processing
- Right to data portability
- Right to object to processing
- Right to issue instructions on your data in the event of death
To exercise a right, use the Contact page and state the right concerned, attaching proof of identity where necessary; we reply within one (1) month.
You may lodge a complaint with the competent data protection authority (ANTIC / the ministry in charge of electronic communications).
5. Contact and data protection officer
For any question about this policy or the processing of your data, contact us through the platform's Contact page:
Open the Contact page6. Are there cookies on our site?
We only use strictly necessary cookies: authentication session, language preference, anti-forgery protection (CSRF). No prior consent is required for them.
No analytics, profiling or advertising cookies are set today. You may delete cookies at any time in your browser settings; this may end your session.
7. Are your data transferred outside Cameroon?
Storage and payments are carried out in Cameroon. Should a processor process your data outside Cameroon, we would put in place an appropriate transfer mechanism (standard contractual clauses or equivalent) and update this policy.
8. Updating of this privacy policy
This policy may be updated periodically and without notice; the applicable version is the one published on this page. Changes take effect upon posting.
We process your Personal Data in accordance with the policy in effect at the time of their collection.
Version dated 21 September 2026