Back to home

Privacy Policy

Last Updated:

Version Number: 1.0

1. Introduction

theSOFTtribe Limited ("theSOFTtribe", "we", "us", or "our") is a Ghanaian software development company established in 1991, specializing in enterprise and institutional software systems.

We are committed to protecting personal data in accordance with the Data Protection Act, 2012 (Act 843) of Ghana and, where applicable, international data protection standards including the GDPR.

theSOFTtribe Limited is registered with the Data Protection Commission (DPC) of Ghana.

This Privacy Statement explains how we collect, use, process, store, transfer, and protect personal data.

2. Our Role in Data Protection

We may act either as a Data Controller or Data Processor depending on the service provided.

As Data Controller: For website visitors, job applicants, direct contacts, and events managed directly by theSOFTtribe.

As Data Processor: For enterprise platforms (e.g., Payroll, ERP, Institutional Systems), where the Client Organization determines the purpose of processing and we act strictly under their documented instructions.

3. Categories of Personal Data We Process

  • Identity and Contact Information (name, email, phone, DOB, national ID, photos)
  • Professional/Institutional Information (employee/student ID, SSNIT, department)
  • Financial Information (bank details, salary, tax identifiers)
  • Technical and Usage Data (IP address, device info, system logs)
  • Cookies and authentication session data

4. Lawful Basis for Processing

We process personal data under the following lawful bases:

  • Contractual Necessity
  • Legal Obligation
  • Legitimate Interest (security, fraud prevention, system optimization)
  • Consent (where explicitly required)

5. How We Use Personal Data

We use personal data to:

  • Provide and administer access to our platforms
  • Authenticate users
  • Process payroll and statutory deductions
  • Deliver enterprise and institutional services
  • Provide support and troubleshooting
  • Improve system performance and security
  • Meet legal and regulatory obligations

We may use de-identified, aggregated data for analytics and system improvement. We do not use identifiable personal data for automated decision-making or AI training without lawful basis or explicit consent.

6. Sub-Processors and Data Sharing

We do not sell personal data.

We may share data with:

  • Client Organizations (Data Controllers)
  • Tier 1 Cloud Providers (e.g., AWS or Microsoft Azure)
  • Regulatory authorities where legally required
  • Authorized third-party integrations under contractual safeguards

7. International Data Transfers

Where data is transferred outside Ghana, appropriate safeguards are implemented including contractual data processing agreements and equivalent legal protection mechanisms ensuring protection equal to or higher than Act 843.

8. Data Retention

We retain personal data only as long as necessary to fulfill its purpose or comply with legal obligations.

Payroll and tax data are retained in accordance with statutory requirements.

System logs and support records are retained for operational, security, and audit purposes.

Data is securely deleted or anonymised when no longer required.

9. Security Measures

We implement appropriate technical and organisational safeguards including:

  • Encryption of data at rest and in transit
  • Role-based access controls (least privilege)
  • Multi-factor authentication where applicable
  • Continuous monitoring and logging
  • Vulnerability assessments
  • Incident response protocols
  • Staff data protection training

10. Data Breach Notification

In the event of a personal data breach posing risk to data subjects:

  • We will notify the relevant Data Controller without undue delay.
  • We will notify the Data Protection Commission where required.
  • Affected individuals will be informed in accordance with legal requirements.

11. Processing of Minors' Data

Where systems are used by educational institutions, the institution acts as the Data Controller. We process minors' data strictly under their lawful authority and documented instructions.

12. Your Rights Under Act 843

You have the right to:

  • Access your personal data
  • Request correction of inaccurate data
  • Request erasure where appropriate
  • Object to processing based on legitimate interest
  • Request data portability
  • Withdraw consent where processing is based on consent

Where we act as Data Processor, such requests should be directed to the relevant Client Organization.

13. Complaints

If you believe your data protection rights have been violated, you may contact us directly and/or lodge a complaint with the Data Protection Commission (DPC) of Ghana.

14. Contact Information

For inquiries or to exercise your rights:

David Bolton Email: david.boltonjnr@softtribe.com

Dabaindeh Findley-Antonio Email: dabaindeh.findley-antonio@softtribe.com

15. Updates

We may update this Privacy Statement from time to time to reflect changes in legal requirements, technology, or our services. The latest version will always be available on our platforms and website.