Privacy notice

ARCFLUS is a business management service for shops in Ghana, provided by [Company legal name], a company registered in Ghana under number [registration number], with its registered office at [registered address] (“ARCFLUS”, “we”, “us”).

ARCFLUS is registered (or is registering) with the Data Protection Commission of Ghana as required by the Data Protection Act, 2012 (Act 843). Registration number: [DPC registration number].

Act 843 treats us differently depending on whose data it is:

• Your account data (if you own or work in a shop that uses ARCFLUS): we are the data controller. We decide how this data is used and we answer your requests about it directly.
• Records a shop keeps about its own customers (names, phone numbers, purchases, balances): the shop is the data controller and ARCFLUS is its data processor. We process this data only to provide the service to the shop, on the shop’s instructions, under the data processing terms in our Terms of service (Act 843, section 30).
• Payment records for mobile money collected through ARCFLUS’s integration with Paystack: we keep these as a controller (or joint controller) for verification, reconciliation, dispute handling and fraud prevention. [To be confirmed by counsel.]

If you are a shop’s customer and want to see, correct or delete what a shop holds about you, please ask the shop first. We will help the shop answer you.

What we do not collect

We do not collect your phone contacts, your location, advertising identifiers or biometric data. If you unlock the app with a fingerprint or face, that stays on your phone and is never sent to us. A shop customer’s phone number is optional.

Children

ARCFLUS is for business users aged 18 or over.

Under section 20 of Act 843 we rely on:

• Contract: to provide the service you signed up for;
• Legal obligation: for example keeping financial records;
• Legitimate interests: keeping accounts secure, preventing fraud and improving the product, balanced against your rights;
• Consent: where we ask for it, such as marketing messages. You can withdraw consent at any time.

We do not sell personal data. We do not use shops’ customer data for our own marketing.

We use trusted service providers (“sub-processors”) under written contracts that require them to protect the data and use it only to provide their service to us:

We may also disclose data when the law requires it, for example to a court or regulator, and only as much as is required.

ARCFLUS’s main database and files are stored in the European Union (Germany and the Netherlands). Some providers are based in the United States. Our registration with the Data Protection Commission lists these countries, and we require every provider outside Ghana to protect data to the standard Ghanaian law requires (Act 843, section 30(4)).

Shops can export their complete records to a device in Ghana at any time.

Shops must keep their own financial records for at least six years under the Revenue Administration Act, 2016 (Act 915). Before a shop deletes its business, we offer a full export so it can keep those records.

Under Act 843 you can:

• Access your personal data and get a copy (we respond within 40 days, as section 35 requires);
• Correct data that is wrong, out of date or incomplete;
• Delete data we no longer have a reason to keep;
• Object to processing, including any direct marketing (we send none without your agreement, and every message includes a way to stop);
• Not be subject to decisions made only by a computer that significantly affect you. ARCFLUS makes no such decisions.

You can edit your profile, export your shop’s records and delete your account in the app. For anything else, email support@arcflus.com. We will check your identity before acting, to protect your account.

If you are a shop’s customer, contact the shop first; it controls your records and we will help it respond.

• Data is encrypted when it travels over the internet and when it is stored.
• Each shop’s records are kept separate from every other shop, checked in the application and again in the database.
• Inside a shop, staff see only what their role allows, and important actions are logged.
• On phones, offline data is stored in an encrypted database.
• Passwords are stored only as secure hashes. We never ask for your MoMo PIN.
• Our own team’s access is limited, protected with two-step sign-in and recorded.

If we believe personal data has been accessed by someone who should not have it, we will tell the Data Protection Commission and the people affected as soon as reasonably practicable, as section 31 of Act 843 requires. Where the data belongs to a shop’s customers, we will tell the shop immediately and help it inform its customers. Our internal target is to notify within 72 hours of confirming a breach.

When you record your customers’ details in ARCFLUS, you are the data controller for them. Act 843 expects data controllers to register with the Data Protection Commission, to tell customers how their data is used, and to keep it accurate. [Guidance for small traders to be confirmed by counsel.] Only send customers messages they have agreed to receive.

Please contact us first so we can try to put things right. You can also complain to the Data Protection Commission, Ghana (dataprotection.org.gh).

We will post any changes here and, for significant changes, tell you in the app or by SMS or email before they take effect.

[Company legal name], [registered address], Ghana.
Email: support@arcflus.com
Phone: +233300000000