Legal Notice & Privacy
Last updated : 2026-07-14
Legal notice
Site publisher : Iconiq Brains — [legal form (LLC/SAS), share capital, RCCM number and IFU to be completed].
Dalili is a product published by Iconiq Brains.
Publication manager : Ibrahim Ouédraogo.
Registered office : Ouagadougou, Burkina Faso — [full address to be completed]
Contact : contact@daliliatlas.com.
Hosting : Cloudflare Pages (Cloudflare, Inc.), 101 Townsend Street, San Francisco, CA 94107, USA. The site is static and served via the Cloudflare network.
Applicable legal framework
The site and its publisher are governed by the law of Burkina Faso, in particular Law No. 045-2009/AN of 10 November 2009 regulating electronic services and transactions, Law No. 001-2021/AN of 30 March 2021 on the protection of personal data (supervisory authority: Commission de l'Informatique et des Libertés – CIL), and the OHADA Uniform Acts. Where applicable, Regulation (EU) 2016/679 (GDPR) applies when data of individuals located in the European Union is processed.
Intellectual property
All site content (text, interface, logos, the "Dalili Atlas" trademark, brand guidelines, proprietary methodologies such as the Dalili QA rules engine, the water-module Revenue Assurance Engine, the Trust Score and the Decision Readiness Note, source code, documents) is the exclusive property of Iconiq Brains or its partners. Any reproduction, representation or adaptation, in whole or in part, is prohibited without prior written authorisation.
Liability
Information on the site is provided for guidance only and may change. The tools, scores and notes produced by Dalili are a decision-support aid: neither a legal or statistical certification, nor a guarantee of donor compliance. Iconiq Brains cannot be held liable for decisions made on the basis of these deliverables, nor for damages arising from access to or use of the site.
Hyperlinks
The site may contain links to third-party sites over which Iconiq Brains has no control and disclaims any responsibility. Creating a link to daliliatlas.com requires Iconiq Brains' prior consent.
Governing law and jurisdiction
This notice is governed by the law of Burkina Faso. Any dispute falls under the jurisdiction of the courts of Ouagadougou, unless a mandatory legal provision states otherwise.
Privacy policy
Data controller : Iconiq Brains — [entity, registered office and contact to be completed]. Contact: contact@daliliatlas.com. [Data Protection Officer (DPO): to be appointed if applicable.]
Our two roles
For data from this site and the commercial relationship, Iconiq Brains is the data controller. For field data entrusted by clients (audits), Iconiq Brains acts as a processor: the client remains the controller and decides the purposes. This distinction shapes the whole policy.
1. Our principle: privacy-first
Dalili is built to minimise — or eliminate — the data you have to share: limited sample, anonymised data, on-site audit, Local Audit Toolkit (local processing with no upload), self-hosting or secure SaaS. The mode is chosen with you based on your sensitivity level.
2. Data processed by the site and the commercial relationship
If you email or contact us, we process the data provided (name, email, organisation, message) to answer your request, prepare a quote and manage the relationship — on the basis of consent, pre-contractual steps or our legitimate interest. Contract and billing data is processed to perform the contract and meet our accounting and tax obligations. We apply minimisation, never resell your data and do not use it for third-party advertising.
3. Data entrusted for audit (Dalili = processor)
When a client entrusts us with a field dataset (Kobo, ODK, Excel, DHIS2, CSV), the client remains the controller and Iconiq Brains acts as a processor, on documented instructions and under a data processing agreement (DPA). We process the data only to deliver the service, favour exposure-minimising modes (anonymisation, sample, local processing, self-hosted), keep raw files separate from transformed data, log access, let the client hash identifiers themselves, and never train external models without explicit consent. At the end, data is returned and/or deleted per the DPA.
4. Rapid Ground-Truthing (WhatsApp verification)
For a targeted field micro-verification at a client's request, participation is voluntary and based on informed, freely withdrawable consent. We document the authorised channel (WhatsApp), the purpose, and keep a record of consent and any withdrawal. Every result carries the notice: "This result is not representative of the whole population; it is a rapid verification with qualified respondents in a given area." WhatsApp is provided by Meta and subject to its terms.
5. Recipients and sub-processors
Your data is accessible only to authorised Iconiq Brains staff. We may use technical providers acting on our behalf: Cloudflare (hosting), [email/contact-form provider, e.g. Resend — to confirm], [analytics tool if used — to confirm], [WhatsApp/Meta for direct contact], [scheduling tool if used]. Each is bound by confidentiality and security obligations. We do not sell or rent your data.
6. International data transfers
Some providers (e.g. Cloudflare) may process data outside Burkina Faso. We frame such transfers with appropriate safeguards and, where data of individuals located in the EU is involved, with GDPR safeguards (standard contractual clauses). The privacy-first mode (local / self-hosted processing) can, where needed, avoid any transfer.
7. Retention & deletion
Retention periods are set per purpose and per project: contact requests [e.g. 3 years — to confirm]; contract and billing data for the contract term then per legal obligations [e.g. 10 years — to confirm]; data entrusted for audit for the engagement term, then return/deletion per the DPA. On expiry, data is irreversibly deleted or anonymised.
8. Security
We implement reasonable technical and organisational measures: strict per-organisation/project separation, access control, logging, separation of raw and transformed files, encryption in transit, and local/self-hosted processing options for sensitive data. In the event of a breach posing a risk, we comply with legal notification obligations (notifying the CIL and, where applicable, the affected individuals).
9. Cookies
The site uses [only strictly necessary cookies / analytics cookies subject to your consent — to confirm based on tooling]. Non-essential cookies are set only after your consent, which you can withdraw at any time. The font may be loaded from a third-party provider, which may expose your IP address.
10. Your rights
Under Law No. 001-2021/AN and, where applicable, the GDPR, you have the right to access, rectification, erasure, objection, restriction, portability and withdrawal of consent. To exercise them, email us at the address below. If you are an individual whose data was entrusted by a client (e.g. a beneficiary), please address your request to the client acting as controller; we assist them as a processor.
11. Complaint to the supervisory authority
If you believe your rights are not respected, you may contact the Commission de l'Informatique et des Libertés (CIL), Ouagadougou, Burkina Faso (cil.bf). Individuals in the EU may contact the supervisory authority of their country of residence.
12. Contact
For any question about your data: contact@daliliatlas.com.