Privacy Policy

Vendor-Pulse is an independent digital goods and data bundle reselling platform operating in the Republic of Ghana. For the purposes of the Data Protection Act, 2012 (Act 843), Vendor-Pulse acts as the Data Controller for personal data collected through our platform, except where we process customer information strictly on behalf of dealer storefronts (see Section 12).

If you have any questions about this Privacy Policy or how your personal information is handled, you may reach our team directly via WhatsApp Support (+233 59 854 4791) or via in-app support tickets from your user dashboard.

We only collect personal information that is reasonably necessary to provide you with fast, secure and reliable services. The information we collect falls into the following categories:

We collect information about you in three principal ways:

• Directly from you: Information you provide when registering an account, purchasing a bundle as a guest, submitting an AFA registration form, topping up your wallet, contacting support, or modifying your profile settings.
• Automatically when you use the Service: Technical details such as your IP address, browser type, referral URLs, and pages visited are recorded in secure server logs. We also store light/dark theme choices and session tokens in your browser.
• From third parties & network partners:
  • Paystack: Confirmation callbacks containing payment transaction status, reference numbers, and currency amount.
  • Telecom SIM Name Enquiry: When you enter a recipient phone number, our automated name lookup query may retrieve the registered account name directly from the telecom network in real time to assist you in confirming recipient accuracy before dispatch.
  • Wholesale Suppliers: Delivery receipts, network transaction IDs, and bundle fulfillment status updates.

Under Section 18 of the Data Protection Act, 2012 (Act 843), we only process your personal data where there is an established legal basis. We rely on the following lawful grounds:

• Contractual Necessity: Processing required to perform our contract with you — including creating your account, crediting your prepaid wallet, routing data bundles to your specified recipient phone number, and delivering digital vouchers.
• Legal & Regulatory Compliance: Fulfilling statutory obligations under Ghanaian law, including the Electronic Transactions Act, 2008 (Act 772), Anti-Money Laundering legislation, Ghana Revenue Authority (GRA) tax keeping, and National Communications Authority (NCA) SIM KYC regulations for AFA registrations.
• Legitimate Interests: Protecting platform integrity, detecting and thwarting fraudulent payments, investigating unauthorized access, preventing duplicate sign-up bonus exploits, monitoring service reliability, and resolving failed delivery disputes.
• Consent: Where you have expressly given consent, such as opting in to optional promotional messages, notifications, or specific dealer marketing campaigns. You may withdraw consent at any time.

We prioritize the security of your money and financial information above all else:

• No Storage of Sensitive Payment Credentials: Vendor-Pulse does not collect, view, process, or store your debit/credit card number, CVV code, expiration date, or Mobile Money authorization PIN.
• PCI-DSS Certified Processing: All electronic card and mobile money checkouts are handled directly by Paystack Payments Limited, a PCI-DSS Level 1 certified payment service provider licensed by the Bank of Ghana.
• Handset Authorization: When you pay via Mobile Money (MTN MoMo, Telecel Cash, AT Money), the approval PIN prompt appears solely on your personal handset or device. Your secret PIN is entered directly into your telecom operator's encrypted USSD session and never passes through our servers.
• Manual MoMo Transfers: If you fund your wallet via manual transfer to an authorized administrator account, we only log the reference transaction ID, sender phone number, amount, and timestamp to verify and credit your wallet ledger.

We do not sell, rent, lease, or trade your personal information to third-party data brokers or marketing companies under any circumstances.

We share personal data strictly on a need-to-know basis with trusted service providers and partners who assist us in operating our platform:

• Telecommunications Network Operators & Wholesale Gateways: We transmit the recipient phone number, network code, and bundle volume to MTN Ghana, Telecel Ghana, AirtelTigo (AT), or authorized telecommunications aggregators so they can deliver the mobile data bundle to the line.
• Payment Gateways: Paystack receives payment amounts, customer email, and unique transaction references to process charges and disburse refunds.
• Transactional Messaging Providers:
  • SMS Gateways (FrogAPI/Wigal, SMSOnlineGH, USMS-GH): To deliver one-time sign-in PINs, account activation codes, and purchase confirmation SMS.
  • WhatsApp Messaging Gateways (Green API / Twilio): To transmit instant order status alerts and facilitate customer support inquiries.
• Dealer Storefronts: If you place an order on an independent dealer storefront powered by Vendor-Pulse, the dealer who owns the store has access to your order details (recipient phone number, package purchased, date, and fulfillment status) to manage their customer service.
• Legal & Regulatory Authorities: We may disclose information if required to do so by Ghanaian law, valid subpoena, court order, or formal request from the Ghana Police Service, Cyber Security Authority (CSA), Economic and Organised Crime Office (EOCO), or the Data Protection Commission in connection with suspected financial fraud, identity theft, or criminal activities.

When you apply for an AFA (Agent Fixed Allowance) registration on behalf of yourself or a client, telecom regulations in Ghana require proof of national identity:

• You must provide the applicant's full legal name as shown on their Ghana Card, their Ghana Card personal identification number (PIN), and photographic uploads of the card (front and back).
• These identity materials are used solely to complete the official AFA registration with the relevant telecommunication operator.
• Uploaded images are saved in protected server directories with direct HTTP access disabled. Only authorized compliance personnel can review these documents to process the application.
• We do not utilize Ghana Card images for marketing, credit scoring, profiling, or any secondary purpose.
• By submitting an AFA registration on behalf of a third party, you confirm and guarantee that you have obtained their explicit, informed consent to collect and share their identity documentation with Vendor-Pulse and the network operator.

Cookies are small text files placed on your computer or mobile device when you access websites. Vendor-Pulse uses a minimal, strictly necessary set of cookies:

We do not deploy third-party advertising cookies, cross-site tracking scripts, or behavioural surveillance trackers. You can set your browser to refuse or block cookies; however, disabling essential session cookies will prevent you from signing in to your account.

We implement robust technical and organizational security measures designed to protect your personal data from unauthorized access, accidental loss, alteration, or disclosure:

• Transport Layer Security (TLS/HTTPS): All web traffic, payment callbacks, and API communications are encrypted using high-grade 256-bit TLS encryption in transit.
• Cryptographic Password & PIN Hashing: User account PINs and passwords are never stored in plaintext. They are cryptographically hashed using standard, modern one-way hashing algorithms.
• Restricted Access & Role Segmentation: Access to user personal data within our administration dashboard is restricted using fine-grained, role-based access permissions. Staff members can only access data strictly required to complete their designated tasks.
• Audit Logging: Administrative actions, sensitive balance adjustments, password resets, and login attempts are recorded in tamper-evident activity logs to detect and prevent unauthorized actions.
• Data Breach Notification: In the highly improbable event of a security compromise impacting your personal information, we will notify affected individuals and the Data Protection Commission in accordance with our statutory obligations under Act 843.

We retain your personal information only for as long as is necessary to accomplish the purposes outlined in this Policy, or as required by applicable laws of Ghana:

• Account Information: Retained for the active lifespan of your account. If you request account closure, non-essential personal identifiers will be deleted or anonymized within 30 days, provided there are no unresolved disputes or outstanding negative balances.
• Transaction & Order Ledgers: In compliance with Ghanaian tax, accounting, and anti-fraud regulations, financial records (orders, payment references, wallet deposits, and refunds) are retained securely for a minimum of six (6) years following the transaction date.
• AFA Verification Documents: Once an AFA registration has been processed and accepted by the telecommunication operator, identity verification documents are retained for the duration mandated by telecom compliance directives, after which they are securely purged.
• System & Activity Logs: Server connection logs, IP records, and diagnostic traces are rotated regularly and automatically purged within 90 days.

Under the Data Protection Act, 2012 (Act 843), you have substantial rights regarding your personal data:

• Right of Access (Section 35): You have the right to request confirmation of whether we hold personal data about you, and to receive a clear copy of that data.
• Right to Rectification (Section 33): If any of your details (such as your phone number, email address, or name) are inaccurate, outdated, or incomplete, you have the right to request immediate correction.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your account and personal information, subject to our statutory duty to retain financial transaction records for tax and legal audits.
• Right to Object to Processing: You have the right to object to the processing of your personal information for direct marketing or where processing is based on legitimate interest.
• Right to Data Portability: You can export your order history and transaction records directly from your account dashboard.
• Right to Lodge a Complaint: If you believe your data has been handled in breach of Act 843, you have the statutory right to file a formal complaint with the Data Protection Commission (DPC) of Ghana.

Eligible dealers can operate branded online storefronts powered by Vendor-Pulse to sell data bundles to their own customers. If you are a dealer operating a storefront:

• You act as an independent data controller regarding the customer relationships you establish. You are responsible for ensuring your storefront respects customer privacy and complies with Act 843.
• You must never sell, harvest, or misuse customer phone numbers collected through your storefront for unsolicited marketing, third-party promotions, or bulk SMS spam.
• You must provide accurate contact and support information on your storefront so your buyers can reach you easily.
• Any dealer found abusing customer contact information will face immediate storefront suspension, forfeiture of unpaid platform bonuses, and potential reporting to law enforcement authorities.

The Service is designed and intended solely for individuals who are at least 18 years old and capable of entering into legally binding contracts in Ghana. We do not knowingly solicit, collect, or store personal information from children or minors under the age of 18.

If we become aware that an account has been registered by a minor, or that personal data of a minor has been provided without verified parental or legal guardian consent, we will promptly deactivate the account and delete the associated personal data from our operational databases.

We may periodically update this Privacy Policy to reflect enhancements to our service, changes in operational practices, or new legal and regulatory mandates in Ghana. The date at the top of this document indicates when this Policy was last revised.

When significant revisions are made, we will provide prominent notice on our homepage, within your account dashboard, or via SMS/WhatsApp alerts. Your continued use of the Service after any posted updates signifies your acknowledgment and acceptance of the revised Privacy Policy.

If you have any questions, requests, or privacy concerns regarding this Policy or our data handling practices, please contact our team:

Data Protection Commission of Ghana

If you feel that your privacy concerns have not been adequately addressed by our team, you have the right to contact the national supervisory body: