Privacy Policy
Last updated 11 September 2026
This policy explains what AgriCircle Ghana does with your personal information, and the rights you have over it under Ghana's Data Protection Act 2012 (Act 843).
Who is responsible
Spatial Sustainability Hub operates AgriCircle Ghana and is the data controller for the information described here.
Our Data Protection Officer is Jedidiah Tetteh Madjanor. Reach him at privacy@spatialsusty.com, or support@spatialsusty.com if that address bounces.
{# TO CONFIRM before launch — both are open actions in the company's own DPO log (DPO-ACT-001, DPO-ACT-002), and the second is marked Critical. Do not invent either: a registered office and a DPC certificate number are legal facts, and publishing a wrong one is worse than publishing none. #}Registered office: [TO CONFIRM: registered office from the Ghana business-registration record]. Data Protection Commission registration: [TO CONFIRM: certificate number — registration must be in place before processing at production scale].
What we collect, and why
| Information | Why we need it |
|---|---|
| Mobile number | It is your account name. We send your one-time sign-in codes to it, and it is where cash-outs are paid unless you change it. |
| Your PIN | Stored only as a one-way hash. We cannot read it, recover it, or tell it to you — if you forget it you set a new one. |
| Name, date of birth, gender | To identify you to your savings group and meet know-your-customer duties. |
| Region, district, community | To connect you with your group and its field officer. |
| Ghana Card number (if you give it) | To raise your verification level, which raises your transaction limits. You can use the platform without it at a lower tier. |
| Savings, contributions, loans, repayments, share-outs | These are the records of your money. They are also entries in your group's books, which is why they are kept even if you leave. |
| Meeting attendance and fines | Your group's own rules, recorded the way the paper ledger did. |
| Sign-in records: IP address, device/browser, time | To detect someone trying to break into your account, and to show you when it happened. |
| USSD session logs and SMS delivery reports | To make the *short-code service work and to prove whether a code we sent actually reached you. |
Who else sees it
We do not sell your information. We share only what a job requires:
- Your savings group. Officers of your group see your contributions, shares, loans and attendance — the same things they would see in the group's paper book. Other members see group totals.
- Paystack — to take a deposit from, or send a cash-out to, your mobile money wallet. They receive the amount and the number, not your savings history.
- Our SMS provider — receives your number and the text of the message, in order to deliver it.
- Our hosting provider — stores the database on our instruction and may not use it for anything else.
- Courts, regulators, or the police — only where the law requires it of us.
How long we keep it
Financial records — contributions, loans, repayments, share-outs — are kept for [TO CONFIRM: six] years after your last transaction, because they are part of your group's accounts and of our own statutory record-keeping.
Other records follow the company retention schedule: security logs for 12 months, application logs for 30 to 90 days, and records of requests you make about your data for 6 years. Everything else is deleted when your account is closed.
Your rights
Under Act 843 you may:
- See what we hold (s.32). Download it yourself from your privacy centre once signed in.
- Correct it (s.33) if it is wrong — from your profile, or by asking us.
- Ask us to delete it (s.33). We will, apart from the financial records described above, which we must keep and which your group's accounts depend on.
- Object to processing that causes you damage or distress (s.34), and stop marketing messages (s.35) at any time.
- Withdraw a consent you gave, without it affecting anything done while it was in force.
Write to privacy@spatialsusty.com. We aim to answer within 30 calendar days. If you ask us to stop sending you marketing messages we act immediately, and within five business days at the latest.
If you are not satisfied with how we answer, you can complain to the Data Protection Commission of Ghana.
How we protect it
- Your PIN is hashed, never stored in readable form.
- Signing in takes two steps — your PIN, then a code sent to your phone.
- Traffic is encrypted in transit (HTTPS).
- Cash-outs go only to your registered number, and changing that number requires a code sent to the new one plus a waiting period.
- Access to the administration system is restricted and logged.
Children
The platform is for adults. We do not knowingly open accounts for anyone under 18. If you believe a child has an account, tell us and we will remove it.
Changes
If we change this policy in a way that affects you, we will tell you on the site and, where it matters, by SMS.