Privacy Policy

• Identity and contact details: full name, phone number, email, gender, date of birth.
• Business details (for Enterprise and Startup members): business name, registration number, sector, address, and related business information you provide.
• Membership records: membership category, payment history, dues status, event and programme participation.
• Communications you send us: support tickets, forum posts, letter requests, survey responses.
• Technical data collected automatically for security purposes: login timestamps, device and IP address on check-in/check-out actions (staff and visitor records only).

We process your data to administer your GCYE membership: verifying eligibility, collecting dues, organizing events and programmes, communicating updates, operating the B2B Directory (for members who opt in), and maintaining statutory and financial records.

We rely on your consent (given at registration and renewable at any time) and on contractual necessity — processing that is required to administer the membership relationship you have with GCYE.

We use the following third parties strictly to deliver the services below, and only share the minimum data each needs to function:

• Paystack — processes membership dues and payments. Card details are entered directly on Paystack's secure payment page and never touch GCYE's servers.
• mNotify — delivers SMS communications you have not opted out of.
• Resend — delivers email communications you have not opted out of.

We do not sell or rent your personal data to any third party.

We retain membership records for as long as your account remains active, and for a reasonable period afterward to satisfy statutory, financial, and dispute-resolution requirements. You may request erasure at any time (see Section 7) — some records (e.g. payment records) may need to be retained longer where required by law.

Under Ghana's Data Protection Act, 2012 (Act 843), you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Withdraw consent and object to direct marketing (SMS/Email) at any time from your profile settings.
• Request erasure of your data, subject to statutory retention requirements.

Members can submit a request directly from their dashboard (Profile → "Request My Data" or "Request Account Deletion"), which creates a tracked request routed to our administrators. You may also contact the GCYE Data Protection Supervisor.

We use industry-standard security measures including encrypted password storage, two-factor authentication for administrative accounts, account lockout after repeated failed login attempts, and a full audit trail of administrative actions on member data.

We may update this policy from time to time. Material changes will be communicated to members.