DRAFT for legal review. Not for production use. Replace every
[BRACKETED]placeholder and have qualified counsel approve this document before publishing version 1.0.
Livesales Privacy Policy
This policy explains how [LEGAL ENTITY NAME] ("Livesales", "we") handles personal data about the people who use Livesales: business owners and their staff ("Users").
Two roles. For your account information (section 2), we are the controller ("data controller" under Ghana's Data Protection Act, 2012). For the data a business puts into Livesales about its own customers, suppliers and employees ("Customer Data"), that business is the controller and we are its processor under our Data Processing Agreement. For questions about Customer Data, contact the business you work with.
Which laws apply. We handle personal data in line with Ghana's Data Protection Act, 2012 (Act 843) and, where they apply to you, the UK GDPR and the EU GDPR. Where these laws differ, we follow the stricter requirement.
1. Contact
Controller: [LEGAL ENTITY NAME], [ADDRESS]. Email: [PRIVACY CONTACT EMAIL]. Data Protection Supervisor / Officer (if appointed): [NAME / EMAIL]. Registered with the Data Protection Commission of Ghana under registration number [DPC REGISTRATION NUMBER]. EU/UK representative (if required): [REPRESENTATIVE].
2. What we collect, why, and our lawful basis
Ghana's Act 843 (section 20) allows processing with your consent, or without it where processing is necessary for a contract with you, is required or authorised by law, protects your legitimate interests, or is necessary for the legitimate interests of the controller. The table gives the matching basis under each law. [Counsel to confirm the Act 843 section references.]
| Data | Purpose | Lawful basis: UK/EU GDPR Art. 6 | Lawful basis: Ghana Act 843, s. 20 |
|---|---|---|---|
| Name, email, password (stored only as a hash), role and organisation | Creating and running your account; signing you in | Performance of a contract (6(1)(b)) | Necessary for a contract with you |
| Invitation details (who invited you, when, for which role) | Onboarding and access control | Legitimate interests in secure access (6(1)(f)) | Legitimate interests of the controller |
| Records of your acceptance of our terms (document version, time, IP address, browser) | Showing that the terms were accepted | Legal obligation and legitimate interests (6(1)(c), (f)) | Required or authorised by law; legitimate interests of the controller |
| Sign-in attempts (email entered, IP address, browser and device, success or failure, time) | Detecting and stopping attacks on accounts, unlocking accounts, helping you sign in | Legitimate interests in securing accounts (6(1)(f)) | Legitimate interests of the controller; protects your legitimate interests |
| Active sessions (IP address, browser and device, last activity) | Letting you and your administrators see where you are signed in and end sessions | Legitimate interests in securing accounts (6(1)(f)) | Legitimate interests of the controller; protects your legitimate interests |
| Security and audit logs (sign-ins, lockouts, IP address, actions taken) | Security, fraud prevention, investigating incidents | Legitimate interests (6(1)(f)) | Legitimate interests of the controller |
| Error records when something goes wrong (time, the page or action involved, an error reference, and your account and workspace identifiers; never passwords, payment details or the contents of forms) | Finding and fixing faults, helping you when you quote an error reference | Legitimate interests in a reliable service (6(1)(f)) | Legitimate interests of the controller |
| Billing contact and payment references (card details are handled by our payment providers, not stored by us) | Subscriptions and invoicing | Contract (6(1)(b)); legal obligation for tax records (6(1)(c)) | Necessary for a contract with you; required by law (tax records) |
| Product and marketing emails | Telling you about features and offers | Consent (6(1)(a)), which you can withdraw at any time | Consent, which you can withdraw at any time |
You can object to processing that relies on legitimate interests (see section 6).
We do not use your data for automated decisions that have legal or similarly significant effects on you.
3. Who we share it with
We use service providers (sub-processors) listed at /legal/subprocessors, for example for email delivery, payments and hosting. They act on our instructions under contracts that protect your data. We may also disclose data where the law requires it.
4. International transfers
Some providers process data outside Ghana, the UK or the EEA. We transfer data only where the receiving provider is bound to protect it to the standard of the laws above: for UK/EU data through an adequacy decision or Standard Contractual Clauses with supplementary measures where needed, and for data covered by Act 843 through contracts that require equivalent protection. [Counsel to confirm the transfer mechanisms per provider and any Data Protection Commission requirements.]
5. How long we keep it
- Account data: while your account is active, then up to 30 days after it is closed.
- Records of terms acceptance: for the life of the account plus [6] years, as evidence.
- Sign-in attempts: 90 days, then deleted automatically.
- Error records: 30 days, then deleted automatically (records of an error we are still investigating are kept until it is resolved, then deleted 30 days later).
- Active session records: until the session ends, is ended by you or an administrator, or expires.
- Security audit records (including lockouts): according to our retention schedule, [RETENTION PERIOD].
- Billing records: as long as tax law requires.
6. Your rights
Subject to conditions in the law, you can ask to access your data, correct it, erase it, restrict or object to processing, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time; marketing consent can be changed in your profile. Contact [PRIVACY CONTACT EMAIL]. We reply within one month.
You can also complain to a supervisory authority: the Data Protection Commission of Ghana, the ICO (UK), or your local EU data protection authority.
7. Cookies
We use only cookies that are strictly necessary to sign you in and keep your session secure (session and CSRF cookies). We do not use advertising cookies. If analytics cookies are introduced, we will ask for your consent first.
8. Security
Measures include encryption in transit, hashed passwords, strict separation of each business's data, role-based access control, rate limiting with account lockout, session management and audit logging. No system is completely secure. We will notify you, the Data Protection Commission and other authorities of a personal data breach where the law requires it.
9. Changes
We will notify Users of material changes. The version and effective date are shown at the top of this policy.