Privacy Policy
1. Data controller
The Ghana Gold Board is the data controller for all personal data processed via the GoldBod platform. Data is processed in accordance with the Ghana Data Protection Act, 2012 (Act 843) and the EU General Data Protection Regulation where applicable.
2. Data we collect
- Identity data: full legal name, date of birth, nationality, government ID
- Contact data: email address, phone number, residential address
- Financial data: bank account, card details (tokenised), transaction history
- Technical data: IP address, device fingerprint, browser type
- Usage data: pages visited, features used, session duration
3. How we use your data
We process your data for: (a) account opening and KYC verification; (b) ongoing transaction monitoring and sanctions screening; (c) order execution and settlement; (d) regulatory reporting to the Bank of Ghana and SEC; (e) customer support; and (f) fraud prevention. We do not sell personal data to third parties.
4. Data retention
KYC data is retained for the duration of your account plus 7 years. Transaction data is retained for 10 years for regulatory purposes. Sanctions screening records are retained for 5 years. You may request deletion of non-regulatory data after account closure.
5. Your rights
Under the Ghana Data Protection Act and GDPR, you have the right to: access your personal data; rectify inaccurate data; object to processing; receive a portable copy; and withdraw consent. To exercise these rights, contact dpo@goldbod.gov.gh. Complaints may be escalated to the Ghana Data Protection Commission.
6. Security
Access is governed by role-based access control with mandatory multi-factor authentication, and privileged actions are recorded in an immutable audit trail. The platform is engineered to SOC 2 Type II and ISO 27001 standards; formal certification, encryption-at-rest and independent penetration testing are on the production roadmap.