Sumalytics Website Privacy Policy

Privacy Policy

Sumalytics website and marketing activities, including DaaFlow marketing pages

Last updated: 30 September 2026

Important scope: This Privacy Policy covers the Sumalytics marketing website and marketing/business-development activities. It does not by itself replace customer contracts, a DaaFlow Data Processing Agreement, product-specific notices or employment/privacy notices that may apply in other contexts.

1. Who we are and who is responsible for your data

Sumalytics is a Ghanaian technology business that develops and provides software, data and digital services, including DaaFlow. For personal data collected through www.sumalytics.com, DaaFlow marketing pages, contact forms, demo requests and our marketing communications, the responsible data controller is:

Legal entity

Sumalytics

Trading name

Sumalytics

Address

Kanvili, Tamale, Northern Region, Ghana

Email

info@sumalytics.com

Telephone

+233 (0) 55 253 7904

References in this Policy to “Sumalytics”, “we”, “us” or “our” refer to the responsible legal entity, not to the founder, shareholders, directors, employees or contractors in their personal capacities, except where applicable law expressly imposes personal responsibility.

Legal framework

This policy is intended to support compliance with applicable Ghanaian law, including the following, as amended or replaced from time to time:

the Constitution of the Republic of Ghana, 1992, including the constitutional right to privacy;

the Data Protection Act, 2012 (Act 843), including its data protection principles, registration, security, processor-contract, breach-notification and data-subject-rights requirements;

the Electronic Transactions Act, 2008 (Act 772), as amended, including requirements relevant to electronic transactions, privacy/security disclosures and unsolicited electronic commercial communications; and

the Cybersecurity Act, 2020 (Act 1038) and applicable directives, regulations or guidance issued by the Cyber Security Authority where relevant.

If another law, binding contract, regulatory requirement or customer-specific data processing agreement imposes a higher standard, Sumalytics will apply that requirement to the extent applicable.

2. Data protection principles we follow

We aim to process personal data consistently with the principles in section 17 of the Data Protection Act, 2012 (Act 843): accountability, lawfulness, purpose specification, compatible further processing, data quality, openness, security safeguards and data-subject participation.

3. Personal data we may collect

3.1 Information you provide directly

name, business email address, telephone number and contact details;

organisation name, job title, sector, location and other business-profile information;

information submitted through contact forms, demo requests, event registrations, partnership enquiries or newsletter sign-ups;

the content of emails, messages, meeting requests and other correspondence you send to us;

information you voluntarily provide during sales, partnership, customer-discovery or support conversations; and

recruitment information where a careers or job-application channel is made available through the website.

3.2 Information collected automatically

When you use the website, our hosting, security and analytics tools may generate technical information such as IP address, browser/device type, operating system, referring page, pages viewed, timestamps, approximate location derived from network information, cookie identifiers and security/event logs. We do not use this statement to imply that every listed technology is enabled at all times.

3.3 Information from third parties

We may receive limited business contact information from referrals, programme partners, public business directories, professional networks, event organisers or other lawful sources. Where personal data is obtained indirectly, we will handle it in accordance with Act 843 and provide required information as soon as reasonably practicable where applicable.

4. Why we process personal data

Purpose

Typical data

Basis / justification

Respond to enquiries, arrange demos and discuss services

Contact, organisation and correspondence data

Consent; steps requested before entering a contract; contract performance; or legitimate interests where permitted.

Business development and relationship management

Business contact details, meeting notes and engagement history

Legitimate business interests, subject to privacy rights and applicable law.

Marketing communications

Name, email/phone and communication preferences

Prior written/electronic consent where required. You may withdraw consent at any time.

Website security, fraud prevention and abuse detection

IP, device, logs, security events

Legitimate interests, legal obligations and protection of our systems and users.

Improve website content and understand usage

Limited technical/analytics information

Legitimate interests and, where required, consent for non-essential analytics technologies.

Recruitment

Applicant identity, CV/contact and application information

Steps requested before employment, legitimate interests and legal obligations.

Legal, regulatory and dispute management

Relevant records and correspondence

Legal obligations and legitimate interests in establishing, exercising or defending legal claims.

5. Data minimisation and accuracy

We seek to collect personal data that is necessary, relevant and not excessive for the stated purpose, and to keep material personal data reasonably accurate and up to date. Please do not submit sensitive or confidential personal data through a general website form unless we specifically request it through an appropriate channel.

6. Direct marketing

We will not use personal data for direct marketing in a manner prohibited by Ghanaian law. Where prior consent is required, including under the Data Protection Act and Electronic Transactions Act, we will seek that consent before sending marketing communications. Each electronic marketing message should provide a practical way to unsubscribe or withdraw consent. Withdrawal does not affect processing that was lawful before withdrawal.

7. Cookies and analytics

The website may use cookies or similar technologies that are necessary for security, functionality and session management. Where we enable non-essential analytics or advertising technologies, we will provide appropriate information and consent controls where required. Browser settings may also allow you to block or delete cookies, although some website functions may then operate differently.

8. When we share personal data

We do not sell personal data. We may disclose personal data only where reasonably necessary to:

hosting, cloud, email, website, analytics, communications, document-storage or other service providers acting for us;

professional advisers such as lawyers, accountants, auditors and insurers where necessary;

business or programme partners where you have requested, consented to, or would reasonably expect the introduction and the disclosure is lawful;

a successor or purchaser in a genuine corporate restructuring, investment, merger or sale, subject to appropriate confidentiality and legal safeguards;

a court, regulator, law-enforcement body or public authority where disclosure is required or authorised by law; or

protect the rights, systems, users, property or safety of Sumalytics or others where lawful.

Where a service provider processes personal data on our behalf, we seek to use written arrangements requiring confidentiality and appropriate security, consistent with sections 29 and 30 of Act 843.

9. International and cross-border processing

Some service providers or infrastructure may be located outside Ghana. Where personal data is processed or stored outside Ghana, we will take reasonable steps to ensure that the processing remains subject to applicable Ghanaian data-protection requirements and appropriate contractual, organisational and technical safeguards. The country or region used for a particular customer deployment may also be governed by the applicable customer contract or Data Processing Agreement.

10. DaaFlow customer and end-user data

This website Privacy Policy is not intended to be the sole privacy document for customer data processed inside the DaaFlow application. Depending on the use case, a DaaFlow customer may determine why and how operational data about its farmers, suppliers, staff or customers is processed and may therefore act as data controller, while Sumalytics may act as a data processor for that customer. Separate service terms, a Data Processing Agreement and/or product-specific privacy notice should govern those processing activities. Sumalytics may act as controller for limited account-administration, security, billing and legal-compliance data where Sumalytics determines the purpose and means of processing.

11. How long we retain personal data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, or for a longer period where required or permitted by law, contract, dispute-preservation needs or legitimate business records. As a working rule, unless a longer period is justified:

general enquiries and demo leads may be retained for up to 24 months after the last substantive interaction;

marketing contact data may be retained until consent is withdrawn or the contact becomes inactive, after which a minimal suppression record may be retained to respect the opt-out;

routine website/security logs may ordinarily be retained for up to 12 months unless needed for an incident, investigation or legal requirement;

unsuccessful recruitment records may ordinarily be retained for up to 12 months unless consent or law supports a longer period; and

contracts, invoices and compliance records may be retained for the period required by law or reasonably necessary to protect legal rights.

At the end of an applicable retention period, we aim to securely delete, destroy or de-identify the personal data in a manner appropriate to the medium and risk.

12. Security safeguards

We apply reasonable technical and organisational measures proportionate to the nature and risk of the data. These may include access controls, authentication, encryption in transit, server-side secret handling, role restrictions, logging, environment separation, backup and recovery measures, vulnerability management and staff/contractor confidentiality controls. No internet service can guarantee absolute security, and this Policy does not make such a guarantee.

13. Security incidents and personal-data breaches

If we have reasonable grounds to believe that personal data has been accessed or acquired by an unauthorised person, we will assess the incident and, where Act 843 applies, notify the Data Protection Commission and affected data subjects as soon as reasonably practicable, subject to any lawful delay directed by the Commission or security agencies. We will also take reasonable steps to restore the integrity of affected systems and reduce further risk.

14. Your rights

Subject to applicable law and appropriate identity verification, you may have the right to:

ask whether we hold personal data about you and request access to it;

request correction of inaccurate, incomplete, misleading, excessive, out-of-date or unlawfully obtained personal data;

request deletion or destruction where we are no longer authorised to retain the data;

object to processing in circumstances recognised by law;

require us to stop direct marketing and withdraw marketing consent;

request information about recipients or categories of recipients of your data; and

exercise rights concerning certain decisions based solely on automated processing where the decision significantly affects you.

We may need to retain limited information where necessary to comply with law, establish or defend legal claims, honour an opt-out, protect security, or meet a lawful contractual obligation. Nothing in this Policy limits rights that cannot lawfully be limited.

15. Children

The Sumalytics marketing website is directed primarily to businesses and professional users and is not intended to solicit personal data from children. If you believe a child has provided personal data through the website without an appropriate lawful basis or authorisation, contact us so that we can assess and take appropriate action.

16. Third-party websites and services

Our website may link to websites, social-media platforms or services operated by third parties. Their privacy and security practices are controlled by them, not by Sumalytics. A link does not mean that we accept responsibility for a third party’s privacy practices, content or security.

17. Changes to this Policy

We may update this Policy when our services, technologies, vendors, legal obligations or business practices change. The current version will be posted on the website with the “Last updated” date. Material changes may also be communicated through another appropriate channel where required.

18. Contact, complaints and regulatory rights

Privacy enquiries and requests should be sent to info@sumalytics.com with the subject “Privacy Request”. We may ask for reasonable information to verify identity before disclosing or changing personal data.

You may also lodge a complaint with the Data Protection Commission of Ghana if you believe your personal data has been processed contrary to applicable law. Contact details published by the Commission should be checked at the time of the complaint.

19. Legal effect and corporate responsibility

This Policy is intended to explain our privacy practices and support compliance with applicable law. It does not create a personal guarantee by any founder, shareholder, director, employee or contractor, and it does not expand liability beyond what applicable law or a binding contract requires. Nothing in this Policy excludes or limits any right, duty or liability that cannot lawfully be excluded or limited.