Data protection
How we meet the Data Protection Act, 2012 (Act 843) in practice — in plain detail, including where we still have work to do.
Our position under Act 843
Auto Import GH is a data controller: we decide what personal data the business collects and why. Act 843 requires a controller to be registered with the Data Protection Commission. Our registration is in progress — the certificate number will be published here when it is issued. Until it is issued we still apply the Act’s rules, and this page says exactly which ones and how.
The eight principles, and what we do about them
| Act 843 requires | What that means here |
|---|---|
| Lawful and fair collection | Forms state why each field is needed. Marketing is opt-in and unticked by default. |
| Purpose limitation | An enquiry is used to answer the enquiry and source the car. It is not sold, rented or traded. |
| Minimal collection | No date of birth, no ID numbers, no card data. Photo uploads are optional. |
| Accuracy | You can correct your details from the account page, or by email. |
| Retention limits | Fixed periods, published in the privacy notice, with automatic deletion of visitor data after 90 days. |
| Security safeguards | See “How we protect data” below. |
| Data subject rights | Access, correction, deletion and objection, answered within 30 days. |
| Accountability | An audit trail of every staff change, a visitor log with hashed identifiers, and this page. |
How we protect data
- Passwords are handled by our authentication provider and stored only as a one-way hash — we never see them.
- Staff accounts have roles. An editor cannot see the audit log or change settings; a manager cannot change rates or users; only the system administrator can. The database enforces this, not just the screen.
- Every staff change to a vehicle, a price, a rate, a role or a setting records who did it, what changed, when, and why. Those records cannot be edited or deleted from the interface.
- Visitor measurement stores a salted hash and an approximate city, never a raw IP address.
- Enquiries are written only by our server, never directly by the browser.
- Forms are rate-limited, use a hidden honeypot field and optionally a challenge, and give the same answer whether or not an account exists.
- Data is encrypted in transit (HTTPS) and at rest by our providers.
Who processes data for us
| Provider | What it does | Data it holds |
|---|---|---|
| Netlify | Website hosting and the small server functions (form intake, visitor counting) | Request data in transit, function logs |
| Supabase | Database, file storage and authentication | Accounts, enquiries, catalogue, audit and visitor records |
| Email provider | Sends verification, reset and notification email | Email address, message content |
Each of these providers is bound by a data-processing agreement and may use data only on our instructions. We will name the email provider here once the sending domain is live.
Your rights, and how to use them
- Email [email protected] with “Privacy request” in the subject.
- Tell us what you want — a copy, a correction, a deletion, or an objection.
- We may ask you to confirm your identity, so we do not give your data to someone else.
- We reply within 30 days. If we need longer we will tell you why.
- If you are unhappy with the answer you can complain to the Data Protection Commission.
If data is breached
If personal data is exposed, we contain it first, then tell the Data Protection Commission and the people affected without undue delay, describing what happened and what we have done. We keep a record of every incident, including the ones we contained without harm.
Our open work
- Complete DPC registration and publish the certificate number.
- Publish the named email provider and its processing terms.
- Have this page and the privacy notice reviewed by a Ghanaian lawyer, then remove the draft banner and version them as final.
Related: Privacy notice · Cookies
Questions about this page, or want a copy in another format? Email [email protected] or call +233 20 528 8750.