Privacy policy

PURA Numbers reads the contacts on your phone so it can find the numbers The Gambia’s numbering change applies to. That reading happens on the device. Your address book is never uploaded, copied off the phone, or shared with anyone, including us.

This policy is written to meet section 25 of The Gambia’s Personal Data Protection and Privacy Act, 2025, which sets out what you must be told about the handling of your personal data. Your rights under Part 3 of that Act are listed below, along with how to exercise them.

Who is responsible for your data

PURA Numbers is published by PURA, The Gambia’s Public Utilities Regulatory Authority, which is the data controller for the processing described on this page.

• 94 Kairaba Avenue, Kanifing Municipality, The Gambia
• info@pura.gm
• +220 4399601, or 148 toll-free

As a public authority, PURA designates a data protection officer under section 34 of the Act. Questions about this policy, and any request about your data, may be sent to the address above marked for the attention of the Data Protection Officer.

What PURA Numbers reads

With your permission, PURA Numbers reads the names and phone numbers stored in your device’s address book. It uses them only to work out which numbers gain a prefix and to show you each proposed change. If you would rather not grant access to all contacts, you can select only some; PURA Numbers will tell you which ones it could not see.

This happens entirely on your phone, under your control. Your contacts are not transmitted to PURA, and PURA never receives, sees or stores them.

PURA Numbers does not read your location, your messages, your call history, your photos, or any other data on the phone.

What PURA Numbers stores on your phone

• Undo records. Before writing anything, PURA Numbers saves a copy of each number as it was, so a run can be restored later.
• Your settings — appearance, language and similar preferences.
• No account, and no device identifier. There is no sign-in to keep, and PURA Numbers sends no identifier for this phone — neither one it made up nor the one the phone issues. There is nothing for such an identifier to be attached to.

You can erase the undo history at any time from Settings. Erasing removes every restore point; it does not touch your contacts.

What PURA Numbers sends, and when

PURA Numbers makes no network request at all unless you choose to send a report. There is one, and only one:

• A report you choose to send. If PURA Numbers inserted the wrong digits, you can tell us which operator block was wrong. The report carries the operator block, never the number it came from and never a contact.

The report itself carries the masked operator block, the digits the app inserted, the version of the numbering plan and of the app, an optional short note you write yourself, and whether the app is running on iOS or Android. It carries no device identifier, no phone name, no model, no contact, no name and no phone number. The database that holds it has no column that could store one.

Your IP address. Like any request over the internet, sending a report discloses your IP address to the server that receives it. We do not store it. It is immediately converted into a one-way keyed hash using a secret held only in the server environment, and that hash is used for one purpose: counting how many reports have come from the same connection in the current hour, so that the endpoint cannot be flooded. The hash is recorded against the hour rather than the moment, is never attached to a report, and is deleted on the next write once the hour has passed. It cannot be turned back into your address, and nothing links it to anything you sent.

Earlier builds also fetched settings and translations on launch. This one does not: the wording, the published numbering plan and the legal links are all in the app itself. Nothing is checked with us when you open it.

Everything else happens on the phone. Scanning, reviewing, saving and undo all work with no connection at all — PURA Numbers does not ask permission to change your contacts, and cannot be stopped from doing it by a network that is not there.

Why we are allowed to process it

Section 5 of the Act requires a lawful basis for each purpose. Ours are:

• Reading your contacts — your consent. Nothing is read until you grant the permission your phone asks for, and nothing is written until you confirm each change.
• A report you send — your consent. Reports are never sent automatically. You choose to send each one, and you can use the app indefinitely without sending any.
• Guarding the report endpoint — a task in the public interest. Keeping the reporting channel open during the migration is part of PURA’s exercise of its official authority over the numbering plan, under section 5(2)(e).

How long it is kept

• Undo records and settings — on your phone, until you erase them from Settings or delete the app. We cannot see or reach them.
• Reports — kept while the numbering plan is being maintained and corrected, so a block reported more than once can be recognised as a pattern.
• The hashed address used for throttling — the current hour only, then deleted.

Who else receives it

Reports are not sold, shared, published or disclosed to any third party. They are read only by the people who maintain the numbering plan.

The website and the endpoint that receives reports run on hosting and database services operated on PURA’s behalf. Those providers act as processors under section 27: they process only on instruction and for no purpose of their own.

PURA Numbers contains no advertising, no analytics and no third-party trackers.

Processing outside The Gambia

The hosting and database services described above are located outside The Gambia, so a report you send is processed abroad. Section 37 of the Act permits this where an appropriate level of protection is ensured, and requires the controller to assess and document that protection. What crosses the border is a report that identifies no person, together with the keyed hash described above; your contacts never leave your phone at all.

Your rights

Part 3 of the Act gives you the right to:

• Know and access — confirmation of whether your personal data is being processed, and a copy of it, free of charge (section 9);
• Rectification, erasure and restriction — correction of data that is wrong, and erasure of data that should no longer be held (section 10);
• Object to processing (section 11);
• Not be subject to a decision made solely automatically (section 12). PURA Numbers makes no such decision about anyone;
• Assistance from the Information Commission in exercising any of these (section 13);
• Be represented by an organisation of your choosing (section 14);
• A remedy, including compensation for material or non-material damage caused by an infringement (section 15).

How to exercise them, and how to complain

Write to info@pura.gm, or to the postal address above, for the attention of the Data Protection Officer. We answer within one month, as section 9 requires. If a request is complex we may take one further month, and we will tell you why before the first month is up.

In practice there is very little for us to give you: the app has no account, and a report identifies no one, so there is usually no record held here that relates to you. Where that is the answer, we will say so plainly rather than leaving you to wonder.

If you are not satisfied, you may complain to the Information Commission, which is responsible for data protection under the Act, and you may seek a judicial remedy. Going to the Commission does not prevent you going to court.

Withdrawing your permission

You may withdraw your consent at any time, and section 8 requires us to tell you how. Turn off contacts access for PURA Numbers in your phone’s settings, and the app can no longer read your address book. Simply not sending a report withholds consent for that. Withdrawing does not undo processing that has already happened lawfully, and it does not affect changes already written to your contacts — those you reverse from the History tab.

No accounts

PURA Numbers has no sign-in and no account. There is no registration screen and no password, so there is no personal record of you on any PURA Numbers server to hold, export or delete. The app keeps everything it needs on your own phone, and you remove all of it by deleting the app.

What we never collect

• Your contacts, or any part of them
• Your location
• Advertising identifiers
• Any identifier for your phone or for you
• Analytics on how you use the app

Children

Under the Act a child is a person under eighteen. PURA Numbers is a utility for updating stored phone numbers. It is not directed at children, collects no information about a user’s age, and does no marketing or profiling of anyone.

If something goes wrong

If a personal data breach occurs that is likely to put your rights and freedoms at high risk, section 33 requires us to tell you without undue delay, in plain language, what happened and what you should do. We will also notify the Information Commission as section 32 requires.

Changes to this policy

If what PURA Numbers reads, stores or sends changes, this page changes with it and the date above is updated. Material changes will be stated in the app as well as here.

Contact

Questions about this policy, or a request about your data, go to info@pura.gm. We reply in English, Wolof or Mandinka.