Privacy Policy
What personal data Densu collects, why, and how it is protected.
Effective 30 April 2026
Densu Privacy Policy
Effective Date: 30 April 2026 | Version: 1.0 | Legal Framework: Ghana Data Protection Act, 2012 (Act 843)
1. Introduction and Data Controller Identity
Densu ("we", "us", "our") is committed to protecting the personal data of its users and their customers in accordance with the Ghana Data Protection Act, 2012 (Act 843) ("DPA") and applicable international best practices.
Data Controller: Densu operates as the data controller for personal data collected from registered users (business operators and staff members) who use the Platform directly. For personal data of end-customers entered into the Platform by a Business, Densu acts as a data processor and the Business is the data controller.
Contact for Data Matters: privacy@densu.shop | Densu, Accra, Ghana
This Privacy Policy ("Policy") explains what personal data we collect, why we process it, how long we retain it, and what rights you have.
2. Scope and Applicability
This Policy applies to:
- All users who register an account on densu.shop or any Densu subdomain.
- All staff members added to a Business account by an Account Owner.
- Visitors to our marketing website who submit enquiry forms or subscribe to communications.
This Policy does not directly govern how Businesses process their end-customers' data through the Platform. Businesses are responsible for providing their own privacy notices to end-customers and for lawfully processing that data. See Section 4 (Data Controller vs. Processor Roles) for further details.
3. Legal Framework
Densu processes personal data in compliance with the Ghana Data Protection Act, 2012 (Act 843), which establishes the following core principles that we adhere to:
- Accountability — We are accountable for the personal data we hold and process.
- Lawfulness — We process data only on a lawful basis (see Section 6).
- Purpose Specification — We collect data for specified, explicit purposes.
- Compatibility — We do not use data in ways incompatible with those purposes.
- Quality — We take steps to ensure data is accurate and up to date.
- Openness — We are transparent about how we process data (this Policy).
- Data Subject Participation — We respect your rights to access and correct your data.
- Security — We apply appropriate technical and organizational safeguards.
Where relevant, we also apply GDPR-aligned practices for users whose data may be subject to EU/UK jurisdiction.
4. Data Controller and Processor Roles
Where Densu is the Data Controller:
Densu is the data controller for personal data you provide when registering, configuring your account, contacting support, or interacting with our marketing communications. We determine the purposes and means of processing this data.
Where Densu is the Data Processor:
When a Business enters customer data (names, phone numbers, transaction histories, health notes, etc.) into the Platform, the Business is the data controller and Densu processes that data on the Business's instructions. Densu does not access, use, or disclose that data except as necessary to provide the Platform or as required by law.
Businesses are solely responsible for:
- Informing their customers about how their data is used.
- Obtaining any required consents.
- Complying with Act 843 and applicable sector-specific regulations (e.g., health data requirements).
5. Personal Data We Collect
5.1 Account and Registration Data
Name, email address, phone number, job role, business name, business address, business registration number, tax identification number, bank account details (for payment processing via Paystack).
5.2 Identity Verification Data
Where required for compliance or payment processing: government-issued identification details, proof of address, business incorporation documents.
5.3 Operational and Transaction Data
Transaction records, service records, payment amounts, payment methods, receipt data, staff-to-transaction associations, credit sales balances, and subscription billing history.
5.4 Communications Data
Support enquiries, feedback forms, emails, and chat messages sent to Densu.
5.5 Technical and Device Data
IP address, browser type and version, operating system, device identifiers, referral URLs, session duration, pages visited, and error logs.
5.6 Authentication and Security Event Data
Login timestamps, 2FA events, failed login attempts, token issuance and revocation events, and audit logs of sensitive actions.
5.7 Cookie and Tracking Data
Data collected through cookies and similar technologies as described in our Cookie Policy.
5.8 Business-Entered Customer Data (as Processor)
Names, phone numbers, email addresses, purchase histories, credit balances, and any custom notes entered by Businesses about their customers. We process this data as a processor only.
6. Lawful Bases for Processing
| Processing Activity | Lawful Basis |
|---|---|
| Account creation and authentication | Performance of contract (DPA Section 20) |
| Delivering subscription services | Performance of contract |
| Processing payments via Paystack | Performance of contract; Legal obligation |
| Fraud detection and security monitoring | Legitimate interest; Legal obligation |
| Sending transactional emails and SMS | Performance of contract |
| Sending marketing communications | Consent (opt-in) |
| Maintaining financial records | Legal obligation (Bank of Ghana, GRA requirements) |
| Responding to support enquiries | Legitimate interest; Performance of contract |
| Analytics and product improvement | Legitimate interest (privacy-balanced) |
| Compliance with regulatory requests | Legal obligation |
7. How We Use Your Data
We use personal data for the following purposes:
- Providing the Platform: Account management, service delivery, payment processing, receipt generation, and all core Platform functionality.
- Security and Fraud Prevention: Monitoring for suspicious activity, enforcing acceptable use, preventing unauthorized access, and complying with AML/CFT obligations.
- Customer Support: Responding to your enquiries, resolving disputes, and providing technical assistance.
- Billing and Financial Records: Generating invoices, collecting fees, and maintaining financial records as required by Ghanaian law.
- Communications: Sending service notifications, security alerts, product updates, and (where consented) marketing messages.
- Legal and Regulatory Compliance: Satisfying obligations under Ghanaian law, responding to court orders, and cooperating with law enforcement requests.
- Product Improvement: Analysing anonymised or aggregated usage data to improve the Platform's features and performance.
We do not use personal data to make solely automated decisions that produce significant legal effects on you, unless you are notified and given the right to request human review.
8. Data Sharing and Disclosure
We share personal data only where necessary and with appropriate safeguards:
8.1 Payment Processors
Paystack Limited receives the personal and financial data necessary to process transactions and comply with KYC/AML obligations. Paystack operates under its own Privacy Policy and is regulated by the Bank of Ghana.
8.2 Cloud Infrastructure Providers
Our hosting, database, and storage providers (operating in Ghana or under adequate protection frameworks) process data to provide infrastructure services.
8.3 Communication Providers
SMS providers (such as Arkesel or equivalent) receive phone numbers and message content necessary to deliver transactional or opted-in marketing messages.
8.4 Professional Advisors
Legal counsel, auditors, and compliance advisors may access data under confidentiality obligations.
8.5 Law Enforcement and Regulators
Where required by valid legal process, court order, or regulatory authority, we may disclose personal data. We will notify you of such requests where legally permitted.
8.6 Business Transfers
In the event of a merger, acquisition, or sale of substantially all assets, your data may be transferred to the successor entity, subject to equivalent privacy protections.
We do not sell personal data. We do not share personal data with third parties for their own marketing purposes.
9. International Data Transfers
Our primary data processing occurs within Ghana or in jurisdictions with adequate data protection frameworks. Where data is transferred outside Ghana (e.g., to cloud infrastructure providers with regional nodes), we ensure:
- Contractual safeguards (data processing agreements with standard contractual clauses where applicable).
- Technical security measures equivalent to those applied within Ghana.
- That the transfer is necessary for the performance of your contract or is otherwise permitted under Act 843.
You may request details of international transfer safeguards by contacting privacy@densu.shop.
10. Data Retention Schedule
| Category | Retention Period | Legal Basis |
|---|---|---|
| Account and profile data | Duration of account + 12 months post-termination | Contract; GRA requirements |
| Transaction records | 7 years from transaction date | Bank of Ghana; GRA requirements |
| Payment and billing records | 7 years | Financial regulations |
| Authentication and audit logs | 2 years | Security and compliance |
| Support communications | 3 years | Legitimate interest |
| Marketing consent records | Until consent withdrawn + 1 year | DPA accountability |
| Business-entered customer data | Duration of Business account + 12 months | Contractual; Processor obligation |
| Anonymised analytics data | Indefinite (no personal data) | Legitimate interest |
Shorter retention periods apply if you exercise erasure rights and no overriding legal obligation requires us to retain the data.
11. Data Security
Densu applies the following technical and organisational measures to protect personal data:
- Encryption in transit: All data transmitted between your device and Densu is encrypted using TLS 1.3.
- Encryption at rest: Sensitive fields (credentials, bank details, API keys) are encrypted using AES-256.
- Access controls: Role-based access control (RBAC) limits data access to authorized personnel.
- Audit logging: All sensitive data access and modification events are logged with timestamps and actor identifiers.
- Multi-tenant isolation: Each Business's data is logically isolated; cross-business data access is architecturally prevented.
- Penetration testing: The Platform undergoes periodic third-party security testing.
- Incident response: We maintain an incident response plan and will notify affected users of material data breaches.
Data Breach Notification: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay and, in any case, within 72 hours of becoming aware of the breach (subject to the requirements of Act 843 and any guidance from the Data Protection Commission of Ghana).
12. Your Rights as a Data Subject
Under the Ghana Data Protection Act, 2012 (Act 843), and where applicable under equivalent legislation, you have the following rights:
12.1 Right of Access. You have the right to request a copy of the personal data we hold about you, together with information about how it is processed.
12.2 Right of Correction. You have the right to request correction of inaccurate or incomplete personal data.
12.3 Right of Deletion (Erasure). You may request deletion of your personal data where it is no longer necessary for the purpose it was collected, where you withdraw consent (if processing was consent-based), or where processing is unlawful. This right is subject to overriding legal obligations to retain data.
12.4 Right to Restriction. You may request that we restrict processing of your data while a correction request is being assessed or a complaint is pending.
12.5 Right to Data Portability. You may request a machine-readable copy of personal data you have provided to us, where processing is based on consent or contract.
12.6 Right to Object. You may object to processing based on legitimate interest, including profiling and direct marketing.
12.7 Right to Withdraw Consent. Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
12.8 Right to Complain. You have the right to lodge a complaint with the Data Protection Commission of Ghana (www.dataprotection.org.gh) if you believe your data protection rights have been violated.
13. How to Exercise Your Rights
Submit data subject requests by email to privacy@densu.shop with:
- Your name and the email address associated with your account.
- A description of your request and the right you are exercising.
- Sufficient information to verify your identity (we may request additional verification).
We will respond within 30 days. Complex requests may require up to 60 days, with notice of the extension provided within the initial 30-day window.
There is no fee for exercising your rights. We may charge a reasonable fee where requests are manifestly unfounded or excessive.
14. Children's Privacy
The Platform is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a person under 18, please contact privacy@densu.shop and we will promptly delete it.
15. Marketing Communications
We send marketing emails and SMS only to users who have explicitly opted in. You may withdraw consent and unsubscribe at any time by:
- Clicking "Unsubscribe" in any marketing email.
- Sending a request to privacy@densu.shop.
- Updating your notification preferences in your account settings.
Transactional communications (receipts, security alerts, billing notifications) are sent regardless of marketing preferences as they are necessary to perform the contract.
16. Automated Decision-Making
Densu does not make solely automated decisions that produce significant legal effects on you. Subscription limit enforcement and fraud risk scoring involve automated checks, but these are subject to human review upon request. If you believe you have been adversely affected by an automated decision, contact support@densu.shop to request human review.
17. Updates to This Policy
We may update this Policy from time to time to reflect changes in our practices, legal obligations, or regulatory guidance. Updated versions are published with a revised effective date and version number. Material changes will be notified via in-app notice or email. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.
Last Updated: 30 April 2026
Effective Date: 30 April 2026
Version: 1.0
Contact: privacy@densu.shop