Privacy Policy

1. Roles: Data Controller vs. Data Processor

To ensure legal compliance under the Ghana Data Protection Act, 2012 (Act 843) and international data protection frameworks:

• EliteSmartBiz Technologies as Data Controller: We act as a Data Controller with respect to account registration data, subscriber contact information, merchant identity credentials, and billing records required to maintain your platform relationship with us.
• EliteSmartBiz Technologies as Data Processor: With respect to individual customer details, laundry order contents, patron phone numbers, and transactional slips entered into your store instance by you or your staff, You (the Merchant) are the Data Controller, and EliteSmartLaundry processes such data solely on your instructions and in accordance with your subscription agreement.

2. Information We Collect

We collect information across the following categories:

• Account & Profile Information: Full name, business email address, phone number, hashed authentication credentials, business name, physical store address, and currency preference.
• Operational & Order Data (Processor role): Customer names, phone numbers (for SMS order pickup alerts and digital receipts), garment descriptions, service pricing, payment statuses, and notes entered onto the POS counter.
• Payment & Billing Data: Transaction references, subscription plan identifiers, paid amounts, payment dates, and payment channel (Mobile Money or Card). Note: Sensitive credit card numbers and mobile money PINs are processed directly by our PCI-DSS-certified payment partner (Paystack) and are never stored on our servers.
• Usage & Diagnostic Logs: IP address, browser type, device information, access timestamps, and error logs collected automatically for operational stability, DDoS defense, and rate-limiting enforcement.

3. Legal Basis & Purpose of Processing

We process personal data only when we have a legitimate legal ground, including:

• Performance of Contract: To provision your tenant dashboard, authenticate logins, process billing, generate thermal/PDF receipts, and deliver order status updates.
• Security & Abuse Prevention: To protect against account takeovers, brute-force attacks, directory scraping, and unauthorized privilege escalation.
• Legal Compliance: To satisfy tax, accounting, and anti-fraud reporting obligations under Ghanaian law.
• With Consent: For specific optional features, such as opt-in marketing newsletters or automated SMS alerts where required.

4. Multi-Tenant Data Isolation & Security Measures

We implement industry-standard administrative, physical, and technical controls to protect data integrity:

• Row-Level Security (RLS): Multi-tenant isolation is strictly enforced at the database layer. No shop can view, query, or modify the customers, orders, or revenues of another shop.
• Cryptographic Safeguards: All web traffic is encrypted in transit via Transport Layer Security (TLS 1.3). Sensitive webhook payloads are verified using constant-time cryptographic HMAC signatures.
• Sanitized Public Endpoints: Public directory lookups are restricted to non-sensitive identifiers and protected by sliding-window rate limiters to prevent mass harvesting of phone numbers and emails.

5. Third-Party Service Providers

We do not sell personal information to third parties. We disclose data only to trusted sub-processors necessary for running the cloud platform:

• Database & Cloud Infrastructure: Supabase / PostgreSQL cloud hosting providers with SOC 2 compliance.
• Payment Processing: Paystack (PCI-DSS Level 1 certified payment gateway).
• Telecommunications & SMS: Authorized regional SMS aggregators for transactional SMS dispatch.
• Transactional Email: Resend / SMTP infrastructure for password resets and daily digest reports.

6. Data Retention & Deletion

We retain business account and transactional data for as long as your shop account remains active, or as required by law for accounting, tax audits, and dispute resolution.

Upon written request or permanent store deactivation, we will securely archive or permanently delete your customer records and business information within thirty (30) days, unless ongoing legal or regulatory requirements mandate retention.

7. Your Data Protection Rights

Under the Ghana Data Protection Act, 2012 (Act 843) and comparable international standards, you have the right to:

• Access: Request confirmation and copies of your personal data held by us;
• Rectification: Request correction of inaccurate, incomplete, or out-of-date personal data;
• Erasure: Request the deletion or removal of personal data under specific statutory conditions;
• Restriction & Objection: Object to processing of your personal data or request restriction of processing;
• Data Portability: Export your customer list, order history, and product catalogues in standard formats (e.g., CSV, PDF).

8. Merchant Obligations Regarding Laundry Patrons

Because you (the Merchant) collect customer phone numbers directly at the counter, you are responsible for ensuring your customers are aware that their details are entered into a digital management system to process their order, print their receipt, and notify them when garments are ready. You must honor any opt-out requests from customers who do not wish to receive automated SMS notifications.

9. Contact Our Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or wish to exercise your statutory rights, please reach out to our privacy officer: