INTRODUCTION
This Data Protection Policy describes how we (Broadspectrum LTD) will collect, use, share and otherwise process the personal data of anyone who interacts with our website and our services. Please read the following carefully to understand our practices regarding your personal data and how we will treat it. By using our website, you indicate your acceptance of this Data Protection Policy.
IMPORTANT INFORMATION AND WHO WE ARE
Broadspectrum LTD (“BSL”) is the controller responsible for your personal data (BSL, we, us or our in this notice). If you have any questions about this data protection notice, please contact us using the details set out below.
Contact details
Our full details are:
- Full name of legal entity: Broadspectrum LTD
- Postal address: P.O. Box CT 1031, Cantonments-Accra
- Telephone number: 0302304636
You have the right to make a complaint at any time to the Data Protection Commission (DPC), the Ghanaian regulator for any data protection issues arising from your use of our website.
Changes to the Data Protection Policy
We keep our Data Protection Policy under regular review.
It is likely that our Data Protection Policy may change and, if it does, those changes will be posted on this page. The new notice will be displayed on-screen and you may be asked to read and acknowledge your understanding of same to continue your use of our website.
Third-party links
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the Data Protection Policy of every website you visit.
THE TYPES OF PERSONAL DATA WE COLLECT ABOUT YOU
Personal data means any information about an individual from which that person can be identified. We collect, use, store and transfer different kinds of personal data about you. To make it easier for you to use this Data Protection Policy, we group these into the following categories.
- Identity Data, including first name, last name, any previous names, date of birth and gender.
- Contact Data, including email address, telephone number, billing/delivery address.
- Transaction Data, including details of our products and services that you may request from us.
- Technical Data, including Internet Protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating systems and platforms, device ID and other technology on the devices you use to access this website.
- Usage Data, including information about how you interact with and use our website, products and services, and cookies.
- Marketing and Communications Data, including information about your preferences in receiving marketing from us and our third parties and your communication preferences.
We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals’ Usage Data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offerings.
We do not intentionally collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data).
- HOW IS YOUR PERSONAL DATA COLLECTED?
We collect your personal data in the following ways:
- Your interactions with us. You may give us your personal data by filling in online forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you
- apply for our products or services;
- subscribe to our service or publications;
- request marketing to be sent to you;
- enter a competition, promotion or survey; or
- give us feedback or contact us.
- Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies.
- Third parties or publicly available sources. We will receive personal data about you from various third parties as set out below:
Technical Data is collected from the following parties:
- analytics providers,
- advertising networks, and
- search information providers.
Identity and Contact Data is collected from data brokers or aggregators.
HOW WE USE YOUR PERSONAL DATA
We will only use your personal data when we have a lawful basis to do so. Our lawful basis for each purpose for which we use your personal data is specified below. Most commonly we will use your personal data in the following circumstances:
- Where you have freely consented before the processing in a specific, informed and unambiguous indication of what you want.
- Performance of a contract. Where we need to process your personal data to perform a contract with you or where you ask us to take steps before we enter into a contract with you.
- Legitimate interests. Where it is necessary to conduct our business and to pursue our legitimate interests and your interests and fundamental rights do not override those interests. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests.
- Legal obligation. Where we need to use your personal data to comply with a legal or regulatory obligation. We will identify the relevant legal obligation when we rely on this legal basis.
DISCLOSURES OF YOUR PERSONAL DATA
We may share your personal data with the following third parties, only where it is necessary:
- Internal third parties. Other companies in the Broadspectrum Group, acting as joint controllers or processors and providing IT, system administration, and other services and undertake compliance reporting. Where we transfer your personal data between our group companies, we ensure your personal data is protected by requiring all our group companies to follow the same rules when processing your personal data.
- External third parties.
- Service providers, acting as data processors who provide IT and system administration services, hosting services for our website, fraud and identity verification providers, customer service support, email delivery and administration, and data storage and analysis.
- Our professional advisors, acting as data controllers including lawyers, auditors, insurers, consultants and other advisors who provide legal, accounting, insurance and other services.
- Marketing and promotional partners with whom we share data to enhance our offerings and identify prospective customers.
- Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
- Regulators, law enforcement, public authorities or other third parties based in Ghana, where necessary to exercise our rights or comply with a legal obligation.
We require all third parties to whom we may disclose your personal data to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third parties to use your personal data for their own purposes. We only permit third parties to process your personal data for specific purposes and in accordance with our instructions.
- INTERNATIONAL TRANSFERS
In line with Ghana’s Data Protection Act, 2012 (Act 843), we do not transfer your personal data outside Ghana.
- DATA SECURITY
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
- DATA RETENTION
According to Ghana’s Data Protection Act, 2012 (Act 843), we have to keep basic information about our customers for as long as is necessary to achieve the purpose for which we collected that information.
As such, we will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
- YOUR LEGAL RIGHTS
Under Ghana’s Data Protection Act, 2012 (Act 843), you have the following rights under in relation to your personal data.
- Request access to and/or a copy of the personal data we process about you (commonly known as a data subject access request). This enables you to check that we are lawfully processing it.
- Request correction of any incomplete or inaccurate data we hold about you. In such a case, we may need to verify the accuracy of the new data you provide to us.
- Request us to delete or remove personal data where there is no good reason for us continuing to process it. You can also ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we have processed your information unlawfully or where we need to erase your personal data to comply with law. In some cases, we may need to continue to retain some of your personal data where required by law. If these apply, we will notify you at the time of our response.
- Object to us processing your personal data where:
- we are relying on legitimate interests as the lawful basis and you feel the processing impacts on your fundamental rights and freedoms, or
- the processing is for direct marketing purposes.
In some cases, we may refuse your objection if we can demonstrate that we have compelling legitimate grounds to continue processing your information which override your rights and freedoms.
- Request that we restrict or suspend our processing of your personal data:
- if you want us to establish the data’s accuracy;
- where our use of the data is unlawful, but you do not want us to erase it;
- where we no longer require it, but you need us to hold onto it to establish, exercise or defend legal claims; or
- you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.
- Data portability. Request we transfer certain of your personal data to you or your chosen third party in a structured, commonly used, machine-readable format. This right only applies to information processed by automated means that we process on the lawful bases of consent or performance of a contract.
- Withdraw consent. Withdraw your consent at any time where we are relying on consent to process your personal data. Please know that this does not affect the lawfulness of any processing carried out before you withdraw your consent, and after withdrawal, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
- Complain to the data protection regulator. If you are unhappy with how we process your personal data, you should contact us first so that we have the chance to put it right. However, you also have the right to make a complaint to the Data Protection Commission at any time.
You can exercise any of these rights at any time by contacting us using the details set out under Clause 2 above.
