How Coris Bourse collects, uses and protects the personal data of its visitors, prospects and clients.
Draft version — this text is being reviewed by the Coris Bourse compliance department.
Last updated: 24 October 2026
1. Who we are
The controller of your personal data is Coris Bourse, a management and intermediation company (SGI) licensed by the WAMU Financial Markets Authority (AMF-UMOA) under no. SGI/2010-02, with its registered office at Avenue Loudun, Rue 05, Immeuble Coris Bourse, 01 BP 6585 Ouagadougou 01, Burkina Faso.
This policy applies to the coris-bourse.com website, the client area and the procedures carried out online (account opening, subscriptions, orders, service requests, contact and complaints).
2. Legal framework
We process your data in accordance with Burkina Faso Law no. 001-2021/AN of 30 March 2021 on the protection of individuals with regard to the processing of personal data, under the supervision of the Commission de l'Informatique et des Libertés (CIL), and with the equivalent legislation of the other WAEMU countries in which we operate.
As a financial intermediary, we are also subject to the regulations of the WAMU regional financial market and to anti-money laundering and counter-terrorist financing (AML/CFT) legislation, which require us to verify our clients' identity and to retain certain information.
3. Data we collect
We only collect the data required for each procedure:
Account opening (KYC)
Identity, parentage, contact details, identity document, ID photo and selfie, signature specimen, occupation, income and source of funds, politically exposed person status, related parties; where applicable, data on the legal representative (minor's account), the authorised representative, and for a legal entity, its directors and beneficial owners.
Subscriptions (equities, bonds)
Identity, securities account number, investor category, amounts and quantities, proof of payment, signature of the subscription form.
Client area and transactions
Login email address and phone number, one-time verification codes, stock market orders, service requests, account fundings and related documents, login history.
Contact and complaints
Name, contact details, account number if you provide it, the content of your message and attachments.
Website browsing
Cookie-free visit statistics, with an anonymous fingerprint renewed every month; the IP address is not stored (see the section "Audience measurement and browser storage").
4. Why we use your data
Providing our services
Opening and maintaining your securities account, processing your subscriptions, orders and requests, keeping you informed of their progress. Legal basis: performance of a contract or of pre-contractual measures.
Meeting our obligations
Verifying your identity (KYC), fighting money laundering and terrorist financing, responding to regulatory, supervisory and tax authorities. Legal basis: legal obligation.
Securing and improving the website
Preventing fraud and abuse, protecting access, measuring traffic anonymously to improve our online journeys. Legal basis: Coris Bourse's legitimate interest.
Keeping you informed
Sending you our newsletters and news if you have subscribed. Legal basis: your consent, which you may withdraw at any time.
5. Who can access your data
Your data is only accessible to the people who need it to process your file:
authorised Coris Bourse staff, according to their role and with individual access rights;
regional financial market participants involved in executing your transactions (regional stock exchange, central depository, issuers and arrangers for subscriptions);
regulatory, supervisory, judicial or tax authorities, where required by law;
our technical service providers (hosting, email and SMS delivery), bound by contract and by confidentiality obligations.
We never sell your data.
6. Where your data is processed
Your data is hosted on servers controlled by Coris Bourse. It may be accessed by our offices in other WAEMU countries (Côte d'Ivoire, Mali, Togo) when your file is handled there, under the same confidentiality and security rules.
7. Audience measurement and browser storage
To understand how the website is used and improve our online journeys, we measure traffic with Umami, a tool hosted on Coris Bourse's own servers. No measurement data is shared with any third party.
This measurement sets no cookies and stores nothing in your browser. Your IP address is never stored: it is only used to estimate your country and city, then to compute an anonymous visit fingerprint, renewed every month, which lets us count visitors without identifying them. We measure the pages viewed, where visits come from (search engine, social network, link), the type of device, the language and the steps completed in online forms.
your client area and your transactions are never measured;
what you type into forms (identity, amounts, securities account number, contact details, messages) is never transmitted;
file references and personal links we send you are removed before any measurement;
visit data is deleted automatically after 13 months; nothing is kept beyond that.
The website sets no cookies. It uses your browser's session storage, cleared when you close the tab, only to keep you signed in to the client area, resume an account-opening form in progress or link a subscription to your account. Local storage is only used to remember your objection to audience measurement, if you express it below.
Your browser's "Do Not Track" setting is also respected.
Your choice is only stored on this device and in this browser.
8. How long we keep your data
Client file and transactions
Throughout the relationship, then 10 years after it ends or after the transaction is executed, in accordance with anti-money laundering obligations.
Unsuccessful account-opening request
The time required to process the request, then the period required by our legal obligations.
Contact and complaints
The time required to handle your request, then the period needed to follow up complaints and defend our rights.
Verification codes
A few minutes, until they expire.
Audience measurement
13 months, then deleted automatically.
9. How we protect your data
encrypted exchanges between your browser and our servers;
encryption of the most sensitive data in our databases;
documents stored in a private space, only viewable through temporary links, and scanned for viruses as soon as they are uploaded;
client-area sign-in with a one-time code, with no stored password;
staff access restricted by role, protected by two-factor authentication and recorded in an audit log.
10. Accounts opened for a minor
A minor's account is opened and managed by the child's legal representative, who provides the required information and documents and exercises the rights described below on the child's behalf.
11. Your rights
You have the following rights over your data:
right of access: to know what data we hold about you;
right to rectification: to have inaccurate or incomplete data corrected;
right to object: to object to certain processing, including audience measurement and newsletters;
right to erasure: to request the deletion of your data where no legal obligation requires us to keep it.
To exercise them, write to us at the address below, enclosing a copy of your identity document. If you believe your rights have not been respected, you may refer the matter to Burkina Faso's Commission de l'Informatique et des Libertés (CIL) or to the data protection authority of your country.
12. Contact us
For any question about this policy or your data: corisbourse@coris-bourse.com (subject "Personal data"), or by post to Coris Bourse, Avenue Loudun, Rue 05, Immeuble Coris Bourse, 01 BP 6585 Ouagadougou 01, Burkina Faso. Phone: +226 25 33 14 85.
13. Changes to this policy
We may update this policy, in particular when we launch a new service or when regulations change. The date of the last update is shown at the top of this page.
