Privacy Policy
Last updated 13 November 2026
This policy explains what personal data Bright SecureTech Limited collects, why we collect it, who we share it with, and the rights you have under the Data Protection Act, 2012 (Act 843). It covers businesses that use Bright SecureTech Payments (“merchants”), their team members, and the customers who pay them through our checkout.
1. Who is responsible for your data
Bright SecureTech Limited, Accra, Ghana, is the data controller for the data described here. You can contact us about your data at support@brightsecuretech.com. Please write “Data protection” in the subject so it reaches the right person.
When we process customer data on behalf of a merchant (for example, to send that merchant’s receipts), the merchant is also responsible for that data.
2. What we collect
From merchants and their team members:
- Name, email address, phone number, password (stored only as a secure hash) and two-step verification settings.
- Business details: name, registration number, TIN, address, industry and website.
- Identity documents: Ghana Card numbers and images, selfies for starter businesses, director and owner details, certificates and forms from the Registrar of Companies, and proof of address.
- Payout wallet details and payout history.
- Sign-in records, device and browser information, IP address, and activity in the dashboard.
From customers who pay a merchant:
- Name, email address and phone number, as entered at checkout or provided by the merchant.
- Payment details: mobile money number, or a masked card number (first six and last four digits). Full card numbers and PINs are entered on our banking partner’s secure page and are never stored by us.
- Transaction details: amount, date, merchant, status, and device and network information used to prevent fraud.
3. Why we use it
- To provide the service: process payments, pay out merchants, send receipts and alerts, and handle refunds and disputes (performance of a contract).
- To verify identities and meet anti-money-laundering, Bank of Ghana and tax obligations (legal obligation).
- To detect and prevent fraud, including blacklists and automatic blocking rules (legitimate interest and legal obligation).
- To keep our systems secure and improve our services (legitimate interest).
- To send product news, only where you have agreed (consent). You can opt out at any time.
5. How long we keep it
We keep transaction and verification records for at least six years after the end of our relationship with a merchant, as required by anti-money-laundering law. Other data is kept only as long as needed for the purpose it was collected for, then deleted or anonymised. Dashboard API logs are kept for 30 days.
6. How we protect it
Data is encrypted in transit and at rest. Identity documents are kept in private storage and shown to our staff only through short-lived links. Access is limited to staff who need it, every staff action is logged, and all accounts use two-step verification. Card entry happens on our banking partner’s secure page.
7. Your rights
Under the Data Protection Act, 2012 (Act 843) you can:
- Ask for a copy of the personal data we hold about you.
- Ask us to correct data that is wrong or incomplete.
- Ask us to delete data, where we are not required by law to keep it.
- Object to direct marketing at any time.
- Complain to the Data Protection Commission.
To use these rights, email support@brightsecuretech.com with “Data protection” in the subject. We will reply within 21 days. If you are a customer of a merchant, you can also contact the merchant directly.
9. Changes to this policy
We will post any changes here and, for significant changes, email merchants at least 30 days in advance.
10. Contact us
Bright SecureTech Limited, Accra, Ghana. Email: support@brightsecuretech.com (subject “Data protection”).