This Privacy Policy ("Policy") sets out the basis on which KolectPay ("the Platform," "we," "us," or "our") collects, processes, uses, stores, discloses, and safeguards personal and financial data in connection with your use of our mobile applications, web dashboard, and API services. This Policy is integrated into and forms part of the KolectPay Terms of Service.
1. REGULATORY SCOPE & LEGAL FRAMEWORK
KolectPay is dedicated to processing personal data in full compliance with Ghanaian statutory requirements:
- The Data Protection Act, 2012 (Act 843) of the Republic of Ghana.
- The Payment Systems and Services Act, 2019 (Act 987) under Bank of Ghana supervision.
- The Cybersecurity Act, 2020 (Act 1038) enforced by the Cyber Security Authority (CSA).
- The Anti-Money Laundering Act, 2020 (Act 1044) & Financial Intelligence Centre (FIC) directives.
2. CATEGORIES OF PERSONAL DATA COLLECTED
We collect and process the following categories of data strictly to deliver automated debit collection and settlement services:
A. Business & Merchant Identity (KYC):
- Full legal name, date of birth, gender, nationality, and phone number of the business owner.
- Ghana Card Number — verified in real time against National Identification Authority (NIA) records.
- Business registration documents, Tax Identification Number (TIN), industry classification, and operating address.
B. Financial & Settlement Payout Data:
- Verified Ghanaian commercial bank account numbers and Mobile Money merchant/agent wallet details for automated T+1 settlement disbursements.
- Transaction ledgers, debit references, commission deductions, and digital payment receipts.
C. Customer (Debtor) Data:
- Names, telephone numbers, principal loan or billing amounts, and electronic Mandate consent records uploaded by merchants.
4. LAWFUL BASES FOR PROCESSING
In accordance with Section 18 of Act 843, we process personal data solely on legitimate statutory grounds:
- Performance of a Contract: Executing payment mandates, calculating the 3% transaction fee, and disbursing T+1 settlement payouts.
- Compliance with Legal Obligations: Fulfilling Bank of Ghana AML/KYC directives, FIC transaction reporting, and statutory financial audits.
- Legitimate Interests: Preventing payment fraud, securing platform infrastructure, and resolving billing disputes.
5. DATA SECURITY & STORAGE ARCHITECTURE
In compliance with Section 28 of Act 843 and the Cybersecurity Act 2020:
- In Transit: All communication across our web and mobile applications is encrypted using TLS 1.3 with HSTS.
- At Rest: Customer PII, identity numbers, and gateway API keys are encrypted at rest with AES-256 GCM.
- Multi-Tenant Scoping: Strict architectural database scoping ensures zero cross-tenant data leakage.
- Authentication Security: Google Authenticator 2FA (TOTP) is enforced for sensitive operations, alongside intelligent rate-limiting and account lockout protections.
6. DATA RETENTION & DEACTIVATION LIFECYCLE
Pursuant to Bank of Ghana regulatory requirements, financial transaction ledgers, KYC documents, and collection receipts are retained for a minimum statutory period of seven (7) years following the transaction date.
When an account is deleted by a merchant, it is immediately deactivated and hidden from active operations. Historical audit ledgers are securely archived for regulatory compliance.
7. RIGHTS OF DATA SUBJECTS
Under the Data Protection Act, 2012 (Act 843), you have the right to:
- Right of Access: Request confirmation and copies of personal data held about you.
- Right to Rectification: Request correction of inaccurate or outdated information.
- Right to Erasure / Deactivation: Request account closure, subject to statutory 7-year financial record retention obligations.
- Right to Object: Object to processing where legitimate interest is the legal basis.
8. DATA PROTECTION OFFICER & DPC COMPLAINTS
For inquiries regarding this Policy or to exercise your statutory rights, contact our Data Protection Officer:
Email: privacy@kolectpay.com
This Privacy Policy was last reviewed and updated in August 2026.