Privacy notice
Draft for legal review
This describes how the platform works today. It will be finalised with legal counsel, including obligations under Ghana's Data Protection Act, 2012 (Act 843), before the platform opens to customers. Last updated 24 October 2026.
In short: we collect what the platform needs to run audits for you, keep it in Western Europe with providers bound to protect it, never sell it or track you, and delete it when it's no longer needed. Your organisation owns its audit content; we look after it on the organisation's behalf.
1. Who we are
Ebanta Comply is a product of Ebanta Africa (Accra, Ghana), which we call "we" or "us" here. [Registered name, company number and registered office to be added once registration is complete.]
For your account, billing and anything you send us through the website, we decide how your personal data is used: under the Data Protection Act, 2012 (Act 843) we are the data controller.
For the audit work an organisation keeps in the platform (engagements, evidence, comments, findings and reports), the organisation is the data controller and we are its data processor: we hold and process that data only to provide the service, on the organisation's instructions, under its agreement with us.
2. What we collect
- Your account: name, work email, the organisations and roles you belong to, and your email preferences. Your password is stored only as a salted, slow hash; we never see it. If you turn on two-factor sign-in, we keep the secret your authenticator app uses and your recovery codes.
- Sign-in and security records: the devices you're signed in on (browser, IP address, last activity), sign-in events, and an activity log of changes made in each organisation (who changed what, and when).
- Audit content: whatever an organisation's members put into the platform, such as assessments, evidence files, comments, findings, management responses and reports. Evidence can contain personal data about people at the audited institution.
- Billing: the plan, invoices and payment status. Card and mobile money details go straight to our payment provider, Paystack; we never receive or store them.
- Enquiries: when you use the contact form, your name, email, organisation, role and message.
We don't use advertising, tracking or analytics tools, and we don't sell personal data.
3. Why we use it
- To provide the service you or your organisation signed up for: accounts, audits, evidence requests, reports and notifications (our contract with you).
- To keep the platform and your data secure: sign-in checks, two-factor, the activity log, file checks and abuse prevention (our legitimate interest, and the security safeguards Act 843 requires).
- To bill for the service and keep financial records (our contract, and legal obligations under Ghana's tax laws).
- To answer enquiries and, if you ask us to, arrange a demo.
- To send service emails: invitations, sign-in codes, reminders and alerts. You can switch off most notification emails on your account page; security and account emails always go.
5. Where your data is kept, and who helps us
The hosted service runs in Western Europe. We use these service providers, each bound to protect the data and use it only to provide their service to us:
| Provider | What they do | Where |
|---|---|---|
| Railway | Runs the application and its database | Western Europe (EU) |
| Cloudflare R2 | Stores evidence files, reports and database backups, privately | Western Europe (EU) |
| Resend | Delivers the platform's emails | Ireland (EU) |
| Paystack | Takes payments (cards, mobile money) | Ghana and Nigeria |
| Better Stack | Checks the site is up; receives no customer data | European Union |
| Have I Been Pwned | Checks new passwords against known breaches; receives only the first 5 characters of a scrambled hash, never the password | Global (Cloudflare) |
Sending data outside Ghana is protected by the providers' contractual commitments and the security measures described on our Security page. Organisations that need their data kept in Ghana, or on their own servers, can arrange an in-country or self-hosted deployment under an Enterprise agreement.
Our staff tools show which organisations use the platform, with their plan and billing details. They can't open audit content. If you need help with something in your audit work, we'll ask you to share only what's needed.
6. How long we keep it
- Your account: until you delete it, which you can do yourself on your account page. Entries in an organisation's activity log stay with that organisation's records, no longer linked to your account.
- An organisation's audit content: while its subscription or trial is active. An owner can export everything, or delete the organisation and its files immediately. After a subscription ends, we keep the data for 90 days so it can be exported or reactivated, then delete it.
- Backups: daily copies of the database, kept for 30 days and then deleted automatically.
- Billing records: for as long as Ghana's tax laws require.
- Enquiries: up to 24 months after our last contact, unless you become a customer.
7. How we protect it
Encrypted connections, private file storage, separation between organisations checked by automated tests, two-factor sign-in, an append-only activity log, daily backups kept apart from the application, and monitoring around the clock. The Security page has the details. If a breach puts your personal data at risk, we'll tell you, the affected organisations and the Data Protection Commission without undue delay, as Act 843 requires.
8. Your rights
Under Act 843 you can:
- see the personal data we hold about you: your account page has an export of everything held about you;
- have it corrected if it's wrong, or deleted;
- object to how we use it, or withdraw consent where we relied on it;
- complain to the Data Protection Commission of Ghana if you're unhappy with how we handled your data.
For data in an organisation's audit work, ask that organisation first, since it decides what's kept; we'll help it respond. For anything else, email privacy@ebantaafrica.com. We reply promptly, and within the time Act 843 allows.
9. Changes and contact
We'll update this notice when how we handle data changes, with a new date at the top. If a change matters to you, we'll email account holders before it takes effect.
The platform is for professional use and isn't meant for anyone under 18.
Questions about privacy: privacy@ebantaafrica.com. Anything else: support@ebantaafrica.com.