Privacy policy and data safeguards

This Privacy Policy sets forth the privacy and data protection principles of Nafex Hub Ghana Limited ("Nafex Hub", "we", "us", or "our"), a commercial entity duly incorporated under the Companies Act, 2019 (Act 992) of the Republic of Ghana, with our principal operating headquarters situated in Accra, Greater Accra Region, Ghana.

Nafex Hub acts as the designated Data Controller within the meaning and statutory definitions of the Ghana Data Protection Act, 2012 (Act 843). In this capacity, Nafex Hub determines the purposes and means of processing personal data collected from registered buyers, verified merchants, trade suppliers, logistics riders, and site visitors across our marketplace platform, web applications, and related mobile interfaces.

Our data processing operations are strictly benchmarked against and conform to the following statutory enactments and regulatory guidelines of the Republic of Ghana:

• Data Protection Act, 2012 (Act 843): Enforcing the fundamental principles of accountability, lawfulness, purpose specification, data minimization, data quality, security safeguards, and data subject participation.
• Electronic Transactions Act, 2008 (Act 772): Governing electronic commerce, contractual validity of digital signatures, pre-contractual consumer disclosures, and intermediary safe harbors.
• Payment Systems and Services Act, 2019 (Act 987): Enacted by the Parliament of Ghana and regulated by the Bank of Ghana (BoG), governing electronic money transactions, escrow facilitation, and integration with licensed payment service providers.
• Protection Against Unfair Competition Act, 2000 (Act 589): Safeguarding consumers and legitimate merchants against deceptive representations, intellectual property infringement, and counterfeit merchandise.
• International Data Standards & GDPR Adequacy: Where transactions involve diaspora buyers or cross-border B2B trade partners within the ECOWAS sub-region or the European Union, we uphold compliance standards aligned with Regulation (EU) 2016/679 (GDPR).

Depending on your role and engagement on the Nafex Hub marketplace, we collect and process the following categories of personal data:

We also automatically collect standard telemetry and diagnostic data, including client IP addresses, browser types, session cookies, operating system signatures, and referral URLs to ensure network integrity and combat automated fraud.

Pursuant to Section 18 of the Data Protection Act, 2012 (Act 843), personal data is processed solely under the following lawful conditions:

Nafex Hub operates an advanced, non-custodial marketplace escrow protection system engineered in partnership with Paystack Ghana Ltd, a licensed Payment Service Provider authorized by the Bank of Ghana under the Payment Systems and Services Act, 2019 (Act 987).

To guarantee mutual security for buyers, sellers, and dispatch couriers, Nafex Hub enforces a strict 6-Digit Delivery OTP Protocol:

1. When a seller dispatches an order and marks it Out for Delivery, our automated server generates a unique, cryptographically random 6-digit numeric OTP (deliveryOtp) valid for a 24-hour window.
2. This OTP is instantly delivered to the buyer via authenticated email and in-platform notification.
3. Critical Security Notice: The buyer must inspect the merchandise upon courier arrival to verify quantity, condition, and quality. Do not share your 6-digit OTP until you have physically inspected and accepted the delivered items.
4. When the buyer provides the OTP to the rider and it is verified in the system, the order transitions to Delivered, and the payment escrow engine automatically schedules the seller's payout release.

Nafex Hub does not sell, rent, or monetize your personal information to marketing brokers. Personal data is shared strictly on a need-to-know basis with audited sub-processors who adhere to confidentiality agreements and security standards:

Nafex Hub deploys an automated AI Customer Support Assistant to deliver 24/7 self-service resolutions for order tracking, FAQ inquiries, returns guidance, and seller support.

• Data Capture: Text prompts and conversation logs are indexed within our database (ai_conversations and ai_messages) to contextualize support inquiries and streamline ticket escalations.
• Human Escalation: If the AI assistant cannot resolve your inquiry or if you request human review, the conversation transcript and metadata are automatically routed to our human support representatives.
• No Unsanctioned Profiling: We do not deploy automated decision-making systems that produce legal or similarly significant effects concerning data subjects without human oversight.

In compliance with Section 28 of the Data Protection Act (Act 843), we enforce institutional, organizational, and technical safeguards designed to protect personal information against loss, unauthorized access, destruction, or disclosure:

We retain personal data only for as long as is necessary to fulfill the operational purposes for which it was gathered, or to comply with statutory legal, accounting, or regulatory requirements:

• Active Account Profiles: Retained for the active lifetime of your registration on Nafex Hub.
• Tax & Invoicing Ledgers: In strict compliance with the Ghana Revenue Authority (GRA) statutory obligations and the Companies Act, 2019, transaction logs, electronic receipts, tax summaries, and completed order archives are retained for a mandatory minimum period of six (6) years.
• Dispute Records & Evidentiary Proof: Maintained for twenty-four (24) months after dispute resolution to handle legal reviews, chargeback appeals, or formal law enforcement requests.
• Temporary Delivery OTPs: Automatically invalidated upon successful delivery or purged 48 hours post-expiration.

Under Part V (Sections 32 through 40) of the Data Protection Act, 2012 (Act 843) and international privacy standards, you enjoy the following enforceable rights:

To exercise your statutory rights, you may submit a written notice to privacy@nafexhub.com. We will respond within twenty-one (21) business days as stipulated by Act 843.

To receive a copy of your personal data, or to ask for your account to be erased, write to privacy@nafexhub.com from the email address on your account. Records the law requires us to keep, such as completed payment records, are retained for the period the law sets.

Nafex Hub utilizes cookies, web beacons, and local storage tokens to deliver a responsive, secure session experience:

• Strictly Necessary Cookies: Essential for authenticating session JWTs, maintaining your shopping cart across browsing sessions, and CSRF attack mitigation.
• Operational & Functional Preferences: Preserving your language preferences, currency view (GHS), and active delivery region selections.
• Analytical & Diagnostic Telemetry: Aggregated, non-identifying measurements of server response times, load balancing efficiency, and UI interaction heatmaps.

You may adjust your browser settings to reject cookies; however, essential features including authentication, shopping cart persistence, and escrow payment authorization may fail to function correctly.

Through our Nafex Trade Connect B2B portal, buyers may initiate Requests for Quotation (RFQs) and source wholesale merchandise from international and regional suppliers across West Africa and overseas manufacturing hubs.

Pursuant to Sections 45 through 50 of the Data Protection Act (Act 843), personal data transferred across borders is safeguarded through standard contractual clauses ensuring that foreign recipients adhere to data protection standards substantially equivalent to Act 843. Supplier communications remain encrypted and indexed solely for transaction fulfillment and customs declaration records.

We periodically review and enhance this Privacy Policy to mirror technological updates, workflow refinements, and statutory amendments enacted by the Parliament of Ghana or the Data Protection Commission (DPC).

When material modifications are made, we will provide at least fourteen (14) calendar days of advance notice via registered email notifications or prominent platform banners before the revised terms become effective.

For any inquiries, requests to exercise your statutory rights, or compliance concerns, please contact our Data Protection Officer directly: