Data Protection Policy

VCX Tech Limited is committed to protecting the privacy and security of personal data. This policy outlines how we collect, use, store, and protect personal information in compliance with applicable data protection laws, including Ghana's Data Protection Act, 2012 (Act 843).

We adhere to the following data protection principles:

• Lawfulness: We process data lawfully, fairly, and transparently
• Purpose Limitation: Data is collected for specific, legitimate purposes
• Data Minimization: We collect only necessary data
• Accuracy: We keep data accurate and up to date
• Storage Limitation: Data is kept only as long as necessary
• Security: We implement appropriate security measures
• Accountability: We demonstrate compliance with data protection principles

We process personal data based on the following legal grounds:

• Consent: When you have given clear consent
• Contract: When processing is necessary for contract performance
• Legal Obligation: When required by law
• Legitimate Interest: When necessary for our legitimate business interests

Under Ghana's Data Protection Act and other applicable laws, you have the following rights:

• Right to be informed about data processing
• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

We implement comprehensive security measures including:

• Encryption of data in transit and at rest
• Access controls and authentication systems
• Regular security assessments and updates
• Staff training on data protection
• Incident response procedures
• Secure data disposal methods

When we transfer personal data outside Ghana, we ensure appropriate safeguards are in place, including:

• Adequacy decisions by relevant authorities
• Standard contractual clauses
• Binding corporate rules
• Certification schemes

In the event of a data breach, we will:

• Assess and contain the breach immediately
• Notify the Data Protection Commission within 72 hours if required
• Inform affected individuals without undue delay if there's high risk
• Document the breach and our response
• Review and improve our security measures

For any data protection queries or to exercise your rights, contact our Data Protection Officer: