Template notice. This document is a structured, good-faith template prepared for Sankofa Trade Technologies Ltd.. Sections marked [legal review] require jurisdiction-specific review by qualified counsel before publication in each corridor market (Ghana, Nigeria, Côte d’Ivoire).
On this page
- 011. Data controller and Data Protection Officer
- 022. The personal data we collect
- 033. Lawful basis for processing (Act 843)
- 044. How we use your data
- 055. Who we share data with
- 066. Cross-border transfers (corridor expansion)
- 077. Data retention
- 088. Your data-subject rights
- 099. How we protect your data
- 1010. Children
- 1111. Complaints to the regulator
- 1212. Changes to this Policy
1. Data controller and Data Protection Officer
Sankofa Trade Technologies Ltd., of Accra, Ghana, is the data controller responsible for your personal data under the Data Protection Act, 2012 (Act 843). We are registered with Ghana’s Data Protection Commission (DPC). Where we process data on behalf of an institutional partner for their own purposes, that partner is a separate controller and their notice also applies.
Contact our Data Protection Officer for any privacy question or to exercise your rights:
privacy@sankofatrade.africa2. The personal data we collect
- Identity & KYC data
- Name, date of birth, nationality, Ghana Card / national ID number, photograph, proof of address and verification results — required to open an account and meet AML obligations.
- Business (KYB) data
- Company registration details, beneficial ownership, directors and authorised representatives, and business documents.
- Financial & transaction data
- Bank and mobile-money account details, trade invoices, settlement history, repayment behaviour and the data used to build your risk score.
- Device & usage data
- IP address, device fingerprint, log-in and security events, and how you use the Platform — used for security, fraud prevention and service improvement.
- Communications
- Records of your contact with support, compliance and complaints teams, including call and message logs.
3. Lawful basis for processing (Act 843)
We process personal data only where the law permits. Our bases under Act 843 and equivalent corridor laws are:
| Purpose | Lawful basis |
|---|---|
| Opening and operating your account; providing financing and settlement | Performance of a contract with you |
| Identity verification, AML/CFT screening, sanctions and fraud checks | Compliance with a legal obligation |
| Creditworthiness and risk scoring | Contract performance and our legitimate interest in prudent lending |
| Service improvement, security and analytics | Legitimate interest, balanced against your rights |
| Marketing to businesses about relevant products | Consent, which you may withdraw at any time |
4. How we use your data
- To verify who you are and that your business is legitimate before providing any facility;
- To assess creditworthiness and price facilities to your risk tier;
- To execute cross-border settlement via PAPSS and licensed payment partners;
- To detect, investigate and prevent fraud, money laundering and sanctions breaches;
- To meet our legal, regulatory and reporting obligations to the Bank of Ghana, the DPC and other authorities; and
- To provide support, communicate service changes, and improve the Platform.
5. Who we share data with
- Bank of Ghana–licensed partner institutions that originate or hold facilities;
- PAPSS and licensed payment and mobile-money providers to settle transactions;
- Identity-verification, credit-reference and sanctions-screening providers;
- Regulators, law-enforcement and courts where we are legally required or permitted to disclose;
- Professional advisers and service providers (e.g. cloud hosting) under written data-processing agreements; and
- A successor entity in the event of a reorganisation, merger or sale, subject to this Policy.
We do not sell your personal data.
6. Cross-border transfers (corridor expansion)
Sankofa Trade operates across trade corridors, today Ghana and, on rollout, Nigeria and Côte d’Ivoire. Cross-border settlement and multi-country operations may involve transferring personal data outside Ghana. Under Act 843 we transfer personal data abroad only where an adequate level of protection exists, or under contractual safeguards, or with your consent, or where the transfer is necessary to perform a contract with you (for example, to settle a cross-border trade).
7. Data retention
We keep personal data only for as long as necessary for the purpose it was collected, then delete or anonymise it. Where AML, financial-services or tax law prescribes a minimum retention period, we keep the relevant records for that period.
| Record type | Retention |
|---|---|
| KYC / identity and AML records | At least 6 years after the relationship ends (AML statutory minimum) |
| Facility and settlement transaction records | At least 6 years after the transaction |
| Support and complaints records | Up to 6 years from resolution |
| Marketing consent and preferences | Until you withdraw consent, then suppression-list only |
| Security and access logs | Up to 24 months, unless needed for an investigation |
8. Your data-subject rights
Subject to the conditions in Act 843 (and equivalent corridor laws), you have the right to:
- Be informed about how your data is used (this Policy);
- Access the personal data we hold about you;
- Correct inaccurate or incomplete data;
- Object to processing based on legitimate interest, and to direct marketing at any time;
- Request erasure or restriction where the law allows;
- Prevent processing likely to cause unwarranted damage or distress; and
- Complain to the Data Protection Commission.
To exercise any right, contact privacy@sankofatrade.africa. We will respond within the statutory timeframe and may need to verify your identity first. Some rights are limited where we must retain data to meet AML or other legal obligations.
9. How we protect your data
We apply encryption in transit and at rest, role-based access controls, multi-factor authentication, network segmentation, logging and continuous monitoring. Access to personal data is restricted to staff who need it for their role. Our security practices are described further on the Security & Compliance page.
10. Children
The Platform is for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 18.
11. Complaints to the regulator
If you are not satisfied with how we handle your data, you may complain to Ghana’s Data Protection Commission. In corridor markets you may complain to the equivalent authority — the Nigeria Data Protection Commission or, in Côte d’Ivoire, ARTCI. We ask that you contact our DPO first so we can try to resolve the matter.
12. Changes to this Policy
We may update this Policy to reflect changes in law or our practices. We will post the updated version with a new “Last updated” date and notify you of material changes.