How We Handle Your Information

DataGuard Ghana (“we,” “us,” or “our”) is committed to protecting the privacy, confidentiality, and security of personal information entrusted to us. This Privacy Notice explains how we collect, use, share, and protect your personal information when you visit our website, complete our data protection readiness checks, or communicate with us via email, phone, and WhatsApp. As a professional compliance consultancy, we act as a Data Controller under the Data Protection Act, 2012 (Act 843) of Ghana. This notice ensures transparent data management practices in absolute alignment with the statutory guidance of Ghana's Data Protection Commission (DPC).

To support your compliance journey and deliver our services, we collect various types of personal information, including: • Communication Data: Your name, email address, phone number, job title, and organisation name when you contact us via email, phone calls, or WhatsApp. • Consulting Context: Information regarding your organisation’s current operations, departments, systems, databases, and identified compliance gaps that you share during enquiries, pilot programs, or consultation bookings. • Quiz Data: Your raw responses to our client-side 2-minute readiness check (note that quiz responses are processed entirely locally and are not persisted or analysed on our servers unless you explicitly choose to share them with us via WhatsApp). • Technical Data: Basic network configuration metadata, including IP addresses, browser types, and standard access logs collected passively by our hosting provider for cybersecurity monitoring and service delivery purposes.

Under Section 18 of the Data Protection Act, 2012 (Act 843), we process your personal information only when a valid lawful basis is established. We rely on the following bases: • Consent (Section 20): Where you choose to share your readiness quiz results with us, subscribe to educational updates, or request direct consultation. • Performance of Contract: To prepare professional consulting proposals, execute training workshops, deliver readiness assessments, or carry out our services as defined in our client engagements. • Legitimate Interests: To administer, protect, and optimize our digital brochure site, coordinate secure communications, maintain our professional files, and defend our systems against unauthorized access. • Legal Obligation: To fulfill statutory tax reporting with the Ghana Revenue Authority (GRA) or corporate registry filings under the Office of the Registrar of Companies (ORC).

We process your personal data for the following specific purposes: • To respond to your direct consultations, quotes, and advisory requests. • To evaluate your readiness quiz responses and propose tailored compliance actions. • To plan, organize, and deliver executive briefings, staff training workshops, and gap assessments. • To manage ongoing outsourced Data Protection Officer (DPO) contracts and annual reviews. • To secure our systems, prevent fraudulent activity, and analyze website uptime and access metrics.

We enforce strict professional confidentiality. We do not sell, rent, lease, or trade your personal information with third-party marketing companies. We only disclose personal data in the following restricted scenarios: • Secure Service Providers: Trusted hosting platforms, encrypted communication tools (like WhatsApp/Meta Business), or professional business suite providers acting as Data Processors under strict confidentiality agreements. • Professional Partners: Certified Data Protection Supervisors (DPS), corporate lawyers, cybersecurity auditors, or records-management specialists, but only when their expert intervention is formally requested and authorized by you. • Statutory Mandates: When required by the Data Protection Commission (DPC), law enforcement, or courts under the applicable laws of the Republic of Ghana.

Consistent with Section 20 of Act 843 and our internal security policies, we implement robust administrative, technical, and physical controls to protect your data, including: • End-to-end device and laptop encryption. • Multifactor authentication (MFA) across all professional business accounts, emails, and cloud storage folders. • Distinct database and file segmentation, keeping each client’s documentation in separate secure silos. • Password managers to protect access controls and enforce secure, unique credentials. • Standard principles of data minimization—we only inspect your database configurations or files to assess them, avoiding capturing full copies where possible.

We store personal information only for as long as necessary to fulfill the purposes for which it was collected, as well as to satisfy legal, accounting, tax, or professional advisory requirements. • Inactive Enquiries: Information shared during initial WhatsApp or email enquiries that do not proceed to a formal engagement is securely deleted or anonymized within twelve (12) months. • Active Clients: Project documentation, training logs, and gap analysis evidence are retained for the duration of our contract, and thereafter for statutory recordkeeping periods (typically up to six years under Ghanaian corporate laws) before being permanently destroyed.

Ghana’s Data Protection Act, 2012 grants you powerful and enforceable rights as a data subject. You have the right to: • Right of Access (Section 21): Request confirmation of whether we process your data and receive a clear copy of your records. • Right of Correction/Rectification (Section 31): Direct us to correct or update inaccurate, incomplete, or out-of-date personal files. • Right of Erasure/Deletion (Section 32): Request that we permanently delete or destroy your personal data under certain criteria. • Right of Objection (Section 28): Oppose the processing of your personal data for direct marketing, educational mailings, or profiling. • Right to Object to Automated Decisions (Section 30): Protect yourself against significant decisions made solely by automated tools. To exercise any of these rights, please email us. If you believe your rights have been violated, you also maintain the absolute statutory right to lodge a formal complaint with the Data Protection Commission (DPC) at www.dataprotection.org.gh.

If you have questions, concerns, or requests regarding this Privacy Notice, our information handling practices, or to exercise your rights under Act 843, please contact our Managing Consultant at: • Email: enquiry@dataguardghana.com • Phone & WhatsApp: +233 24 505 2539 • Delivery Model: On-site and remote consulting services • Location: Accra, Greater Accra Region, Ghana Last Updated: August 2026