Privacy notice

1. Who we are

The Office of Federal Identity Services (OFIS) was established by Federal Africa to issue and maintain the Federal ID. For the purposes of data-protection law the controller is Africa One E-Portal Limited, Plot 113 Semawata Road, Kampala, Uganda. Data-protection registration: [YK: data-protection registration]. You can reach the privacy contact at privacy@federal.africa.

2. What this notice covers

This notice covers the Federal ID service at identity.federal.africa, the Federal ID sign-in at auth.federal.africa, their sandbox copies, and this website. It does not cover the community platform at federalafrica.com or any partner application; each has its own notice.

3. What we collect, and why

To create and maintain your Federal ID. Your email address, a display name, your member state, your country of origin and your date of birth. Email confirms you can be reached and is required before any partner can enroll you. Date of birth is used only to apply the age rules: no Federal ID under 16, guardian consent at 16 and 17, verification from 18. It is stored and never returned to anyone, including partners.

To verify your identity, when you ask for it. A face video of three to five seconds and, for Level 3 only, photographs of an identity document and of you holding it. From the video we compute a face fingerprint, a numeric template that lets us check that no other Federal ID has your face. We also take a phone number and confirm it over WhatsApp: you message OFIS from that number and enter the code we send back. WhatsApp (Meta) sees that a message passed between you and OFIS; it does not see your case. The community platform tells us whether your membership is active; it does not tell us what you paid or how.

To let partners rely on your Federal ID. The consent records you create when you approve a partner, and a log of each assertion and lookup a partner makes.

To run the service safely. An audit log of issuance, level changes, suspensions, reviewer decisions and their reasons; the IP address and user agent of requests to the service, for security and rate limiting.

On this website: nothing. It sets no cookies, runs no analytics and loads nothing from third parties.

4. The legal basis

Creating and maintaining your Federal ID, and letting partners rely on it, is performance of the agreement you enter under the terms of use. Verification, including the face video and face fingerprint, happens only with your explicit consent, given on the consent screen before any capture, and you can withdraw it by closing your case or your Federal ID. The audit log and security data are kept under our legitimate interest in running an identity service that can be trusted and in preventing fraud. Where a law in your country requires a different basis, that law applies.

5. Who sees your data

Partners see only the attributes you have consented to, as a signed statement: whether you are verified, your level, your member state code, your status, your country, and your membership tier. A partner that already holds your Federal ID can also read its level, status, state and membership tier without consent; none of these identify you on their own. Partners never receive your name, email, phone, date of birth, video, photographs or fingerprint.

OFIS reviewers see the evidence of the case they are reviewing. Their access is logged.

Infrastructure providers host the service and deliver messages: a hosting provider in Germany, an email provider, and WhatsApp for the phone confirmation. Media is encrypted before it reaches storage, with keys held by OFIS. Providers cannot read it.

Authorities, where a law that binds us requires disclosure. We will tell you unless the law forbids it.

We do not sell or rent data, and we use no third-party identity-verification company.

6. Where your data is kept

The service runs on servers in Germany. If you are outside the European Union this is a transfer across borders, made so that one service can serve every member state. [YK: data-protection registration] records the arrangements.

7. How long we keep it

The retention schedule lists every category. In short: face videos and photographs are deleted 90 days after the final decision on a case; the face fingerprint is kept while your Federal ID exists, and for two years after a refusal for fraud; account data while your Federal ID exists; the audit log for a period after that which OFIS has still to set.

8. Your rights

You can see what we hold, obtain a copy, correct it, withdraw consent, revoke any partner, and close your Federal ID. How to exercise each right. We answer within [YK: response time]. If you are not satisfied, write to grievance@federal.africa or to the data-protection authority in your country.

9. Children

A Federal ID is not issued to anyone under 16. At 16 and 17 a parent’s or guardian’s consent is required, and no verification and no face capture takes place before 18.

10. Changes

We will post changes here with the date, and tell holders of a Federal ID by email about any change that affects what we collect or who sees it.