Privacy Policy

• Identity and contact details: full name, phone number, email, gender, date of birth.
• Business details (for Enterprise and Startup members): business name, registration number, sector, address, and related business information you provide.
• Membership records: membership category, payment history, dues status, event and programme participation.
• Communications you send us: support tickets, forum posts, letter requests, survey responses.
• If you turn on phone notifications: a notification address issued for that device by your browser or phone maker, so that we can send alerts to it. You can turn this off at any time from your profile, and it is removed when you sign out on that device.
• Technical data collected automatically for security purposes: login timestamps, device and IP address on check-in/check-out actions (staff and visitor records only).

We process your data to administer your GCYE membership: verifying eligibility, collecting dues, organizing events and programmes, communicating updates, operating the B2B Directory (for members who opt in), and maintaining statutory and financial records.

We rely on your consent (given at registration and renewable at any time) and on contractual necessity — processing that is required to administer the membership relationship you have with GCYE.

We use the following third parties strictly to deliver the services below, and only share the minimum data each needs to function:

• Paystack — processes membership dues and payments. Card details are entered directly on Paystack's secure payment page and never touch GCYE's servers.
• mNotify — delivers SMS communications you have not opted out of.
• Resend — delivers email communications you have not opted out of.

• Your browser or phone maker's notification service (Google, Apple or Mozilla) — delivers phone notifications you have turned on. Each message is encrypted so that only your device can read it, and carries a headline and a link only.

We do not sell or rent your personal data to any third party.

We retain membership records for as long as your account remains active, and for a reasonable period afterward to satisfy statutory, financial, and dispute-resolution requirements. You may request erasure at any time (see Section 7). When an account is deleted, your profile, documents, messages and activity are removed. Records of payments received are kept as financial records, as the law requires, but are no longer linked to you: they carry only the membership number they were paid under.

When you open your digital membership card, a copy is saved in the browser or app on that device so that you can still show it without an internet connection. It stays on your device, is not sent anywhere, and is removed when you sign out.

Under Ghana's Data Protection Act, 2012 (Act 843), you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Withdraw consent and object to direct marketing (SMS/Email) at any time from your profile settings.
• Request erasure of your data, subject to statutory retention requirements.

Members can submit a request directly from their dashboard (Profile → "Request My Data" or "Request Account Deletion"), which creates a tracked request routed to our administrators. We delete your account and personal data within 30 days of a deletion request. You may also contact the GCYE Data Protection Supervisor.

We use industry-standard security measures including encrypted password storage, two-factor authentication for administrative accounts, account lockout after repeated failed login attempts, and a full audit trail of administrative actions on member data.

We may update this policy from time to time. Material changes will be communicated to members.