Privacy Policy

1 Introduction

MP1 Digital Limited is a software development, fintech and enterprise technology company providing digital solutions to businesses, financial institutions, cooperatives, microfinance organisations, retailers, schools, hospitals, NGOs and other organisations.

This Privacy Policy applies to personal information processed through MP1 websites, applications, software platforms, customer portals, APIs, subscription systems, support channels and other services operated or controlled by MP1.

This Policy should be read together with our Terms & Conditions and any product-specific agreements that apply to your use of our services.

2 Data Controller and Responsible Entity

For personal data processed directly by MP1 in connection with our own business operations, MP1 Digital Limited may act as the relevant data controller or equivalent responsible entity under applicable law.

Where MP1 provides software to a business or organisation that uses the software to collect and process information about its own customers, members, employees or users, that organisation may determine the purposes for which the information is processed.

3 Legal Basis for Processing

MP1 processes personal information only where there is an appropriate legal basis under applicable law.

Depending on the circumstances, this may include:

• Your consent.
• Performance of a contract or provision of requested services.
• Compliance with legal or regulatory obligations.
• Legitimate business interests where permitted by applicable law.
• Protection of the security, rights or property of MP1, our Customers or other persons.

Where processing is based on consent, you may withdraw consent where permitted by law. Withdrawal of consent does not necessarily affect the lawfulness of processing carried out before withdrawal.

4 Information We Collect

The information we collect depends on the services you use and how you interact with MP1.

5 How We Collect Information

We may collect information when you:

• Create or manage an MP1 account.
• Purchase or subscribe to our services.
• Submit an enquiry or request support.
• Use our websites or applications.
• Submit forms or documents.
• Communicate with MP1 by telephone, email, messaging or other authorised channels.
• Make payments or transactions.
• Connect a third-party service or integration.

We may also receive information from Customers, authorised business administrators, service providers, payment providers and other lawful sources.

6 How We Use Personal Information

We may use personal information to:

• Create and manage accounts.
• Provide software and technology services.
• Authenticate users and protect accounts.
• Process subscriptions and payments.
• Provide customer and technical support.
• Send service-related communications.
• Monitor system performance and reliability.
• Detect fraud, abuse and security threats.
• Improve our products and services.
• Conduct analytics and operational reporting.
• Meet legal, regulatory and contractual obligations.
• Protect the rights and security of MP1 and its users.

7 Financial and Transaction Information

Certain MP1 platforms support financial management, accounting, savings, lending, payments, POS, microfinance, cooperative and other financial technology functions.

Depending on the product and the Customer's configuration, MP1 systems may process information such as account references, transaction amounts, payment references, customer records, loan records, savings records, invoices and related financial information.

Customers using MP1 financial software are responsible for ensuring that their collection and processing of financial and personal information complies with the laws and regulatory requirements applicable to their own organisation.

8 Cookies and Tracking Technologies

MP1 websites and applications may use cookies, local storage, pixels, analytics tools and similar technologies.

These technologies may be used to:

• Keep users signed in.
• Remember preferences.
• Improve website functionality.
• Understand website usage.
• Detect security threats and abuse.
• Improve service performance.

You may manage cookies through your browser or device settings. Disabling certain cookies may affect the functionality of some services.

9 When We Share Information

MP1 does not sell personal information as a business practice.

We may disclose or provide access to personal information where reasonably necessary for legitimate business, contractual, security or legal purposes.

This may include sharing information with:

• Authorised employees and service teams.
• Cloud hosting and infrastructure providers.
• Payment processors and financial technology providers.
• Mobile-money and telecommunications providers.
• SMS, email and communication providers.
• Security, authentication and identity providers.
• Professional advisers and auditors.
• Government, regulatory or law-enforcement authorities where legally required.

Third parties receiving personal information are expected to process it only for legitimate purposes and to apply appropriate confidentiality and security safeguards.

10 Third-Party Service Providers

MP1 may use external technology and service providers to operate parts of its services.

These providers may include hosting companies, payment processors, banks, mobile-money providers, telecommunications companies, analytics providers, email providers, SMS gateways, identity providers, security services and other technology partners.

Third-party providers may process information in accordance with their own contractual terms and privacy policies.

Where a service requires a third-party integration, certain information may necessarily be transmitted to that provider to complete the requested service.

11 International Data Transfers

Some MP1 technology providers or infrastructure partners may operate outside Ghana. Consequently, personal information may be processed or stored in jurisdictions outside Ghana.

Where applicable, MP1 will take reasonable steps to ensure that international data transfers are subject to appropriate contractual, technical or legal safeguards.

By using services that depend on international infrastructure, you acknowledge that data may be processed in jurisdictions where our authorised service providers operate, subject to applicable law.

12 Information Security

MP1 uses reasonable technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss and destruction.

Depending on the service, these measures may include:

• Encryption in appropriate circumstances.
• Authentication and access controls.
• Role-based permissions.
• Security monitoring and logging.
• Secure infrastructure and network controls.
• Backups and recovery mechanisms.
• Software updates and vulnerability management.

13 Data Retention

MP1 retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including contractual, operational, security, accounting, legal and regulatory purposes.

Certain records may need to be retained for longer periods because of legal, regulatory, financial, audit, dispute-resolution or security requirements.

When personal information is no longer required, MP1 may securely delete, anonymise or otherwise dispose of it in accordance with applicable retention requirements and technical processes.

14 Your Privacy Rights

Subject to applicable law and relevant exceptions, individuals may have rights concerning their personal information.

Requests may be subject to identity verification, legal restrictions, contractual obligations, regulatory requirements and reasonable processing procedures.

15 Marketing Communications

Where permitted by law, MP1 may send information about products, services, updates, promotions or business opportunities.

You may opt out of non-essential marketing communications by using the unsubscribe mechanism provided in the communication or by contacting us.

Even if you opt out of marketing communications, we may continue to send essential service messages, including security notifications, billing notices, transaction alerts, system announcements and legally required communications.

16 Children's Privacy

Unless a particular service is specifically designed for educational or child-related use, MP1 services are not intentionally directed at children.

We do not knowingly request personal information from children where such collection would be unlawful.

Organisations operating educational or other child-related services through MP1 platforms remain responsible for obtaining appropriate permissions and complying with applicable child-protection and privacy requirements.

17 Business and Customer Data

When a business or organisation uses an MP1 platform to process information about its customers, members, employees or users, MP1 may process that information on behalf of the organisation in order to provide the contracted service.

The business Customer remains responsible for:

• Providing appropriate privacy notices.
• Obtaining required permissions or consent.
• Determining lawful purposes for processing.
• Configuring access permissions appropriately.
• Managing authorised users.
• Responding to its customers' privacy requests where required.
• Complying with applicable sector-specific regulations.

18 Data Security Incidents

If MP1 becomes aware of a confirmed security incident involving personal information under our control, we will assess the incident and take reasonable steps to contain, investigate and remediate it.

Where notification is required by applicable law or regulatory requirements, MP1 will make the required notifications within the applicable timeframe.

Customers using MP1 software remain responsible for promptly notifying MP1 where they become aware of unauthorised access, compromised credentials or other security incidents involving an MP1 service.

19 Third-Party Websites and Services

Our websites or applications may contain links to third-party websites, applications or services.

MP1 is not responsible for the privacy practices, security, content or policies of third-party websites that we do not control.

You should review the privacy policy of any third-party service before submitting personal information to it.

20 Changes to This Privacy Policy

MP1 may update this Privacy Policy from time to time to reflect changes in our services, technology, business operations, legal requirements or privacy practices.

The updated version will be published on this page together with a revised effective date.

Where required by applicable law, MP1 will provide additional notice of material changes or obtain consent where necessary.

21 Privacy Contact Information

If you have questions about this Privacy Policy, wish to exercise a privacy right, report a suspected privacy issue or request information about how your personal data is processed, please contact MP1 Digital Limited.