Privacy Policy

1. Introduction and Purpose

Baobab Microfinance Limited (hereinafter referred to as "Baobab", "we", "us", or "our") is a licensed microfinance institution operating in Ghana, regulated by the Bank of Ghana under the Banks and Specialised Deposit-Taking Institutions Act, 2016 (Act 930). We are committed to protecting the privacy, confidentiality, and security of all personal information entrusted to us by our clients, employees, partners, and other stakeholders.

This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. This policy is issued in compliance with the Data Protection Act, 2012 (Act 843) of Ghana, the Bank of Ghana Data Protection Directive, the Bank of Ghana Cybersecurity Directive, and all other applicable laws and regulatory requirements governing data privacy and protection in Ghana.

By using our services, visiting our offices, accessing our digital platforms, or otherwise engaging with Baobab Microfinance Limited, you acknowledge that you have read, understood, and agreed to the terms of this Privacy Policy.

2. Scope and Application

This Privacy Policy applies to:

• All clients and prospective clients of Baobab Microfinance Limited
• All employees, contractors, consultants, and third-party service providers
• All visitors to our offices, branches, and websites
• All users of Baobab's digital platforms, mobile applications, and electronic services
• All parties who provide personal data to Baobab through any channel

This policy covers personal data collected both online (via websites, mobile apps, and email) and offline (via physical forms, in-branch interactions, and telephone communications).

3. Data Controller Information

For all data protection enquiries, requests, or complaints, please contact our Data Protection Officer (DPO) at the contact details above.

4. Categories of Personal Data Collected

4.1 Identity and Contact Information

• Full name, date of birth, gender, and nationality
• National Identification Number (Ghana Card / Voter ID / Passport)
• Residential and mailing address
• Phone number(s) and email address(es)
• Photograph and signature

4.2 Financial Information

• Bank account details, mobile money wallet information
• Income details, employment status, and employer information
• Credit history, loan application data, and repayment records
• Transaction records and financial statements
• Collateral details and guarantor information

4.3 Operational and Technical Data

• CCTV footage captured at our branches and ATM points
• IP addresses, device identifiers, and browser/application data
• Login credentials and access logs for digital platforms
• Cookies and similar tracking technologies on our websites

4.4 Sensitive Personal Data

In limited circumstances, and only where strictly necessary, we may process sensitive categories of personal data including health information (e.g., for insurance or disability accommodation purposes) and biometric data where required by regulatory mandate. Such data is processed only with your explicit consent or as required by law.

5. Lawful Basis for Processing Personal Data

Baobab Microfinance Limited processes personal data on the following lawful bases as recognised under the Data Protection Act, 2012 (Act 843):

6. Purposes of Data Processing

We collect and process your personal data for the following purposes:

6.1 Core Banking and Financial Services

• Opening and managing savings, current, and loan accounts
• Evaluating and processing loan and credit applications
• Processing financial transactions and maintaining accurate records
• Providing mobile banking, agency banking, and digital payment services
• Sending account statements, receipts, and transaction confirmations

6.2 Regulatory Compliance and Risk Management

• Conducting Know Your Customer (KYC) and Customer Due Diligence (CDD) checks
• Complying with Anti-Money Laundering (AML) and Counter-Financing of Terrorism (CFT) obligations
• Reporting to the Bank of Ghana, Financial Intelligence Centre (FIC), and other regulatory bodies
• Credit risk assessment and credit bureau reporting
• Internal audit and compliance monitoring

6.3 Security and Fraud Prevention

• Detecting, investigating, and preventing fraudulent activities and financial crimes
• Monitoring and securing our IT systems, networks, and digital assets
• CCTV surveillance for the safety of staff, clients, and assets
• Access control and authentication management

6.4 Communication and Customer Service

• Responding to enquiries, complaints, and service requests
• Sending service notifications, product updates, and account alerts
• Conducting customer satisfaction surveys (with consent)
• Marketing and promotional communications (where consent has been obtained)

6.5 Business Operations and Improvement

• Training and quality assurance for staff
• Business analysis, reporting, and strategic planning
• Legal proceedings and dispute resolution
• Systems administration, IT support, and service continuity

7. Data Retention

Baobab Microfinance Limited retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law and regulation. The following general retention periods apply:

Upon expiry of the applicable retention period, personal data will be securely deleted, anonymized, or destroyed in accordance with our Data Disposal Procedure.

8. Data Sharing and Disclosure

8.1 Internal Sharing

Personal data is shared internally within Baobab Microfinance Limited on a need-to-know basis, restricted to staff whose functions require access to fulfil the purposes described in this policy. Access is governed by our Access Control and Information Classification Policies.

8.2 Third-Party Sharing

We may share your personal data with carefully selected third parties in the following circumstances:

• Regulatory and Law Enforcement Bodies: Bank of Ghana, Financial Intelligence Centre (FIC), Credit Reference Bureaux, Ghana Revenue Authority, and law enforcement agencies, as required by law.
• Credit Reference Bureaux: XDS Data, CreditInfo Ghana, and other licensed credit bureaux for credit assessments and reporting.
• Technology and Service Providers: Core Banking System vendors, IT service providers, cloud service providers, and cybersecurity firms — bound by data processing agreements.
• Financial Partners: Correspondent banks, mobile money operators, and payment processors for transaction processing.
• Professional Advisers: Auditors, legal counsel, and consultants under strict confidentiality obligations.
• Insurance Partners: Where you have subscribed to insurance products offered through Baobab.

8.3 International Data Transfers

Where personal data is transferred outside Ghana (e.g., to cloud service providers or international correspondents), Baobab ensures that adequate protections are in place consistent with the requirements of the Data Protection Act, 2012 (Act 843), including contractual safeguards, data processing agreements, and where applicable, adequacy determinations.

9. Your Rights as a Data Subject

Under the Data Protection Act, 2012 (Act 843), you have the following rights with respect to your personal data:

To exercise any of these rights, please submit a written request to our Data Protection Officer using the contact details in Section 3. We will respond within 30 days of receiving your request.

10. Data Security

Baobab Microfinance Limited implements appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, destruction, or accidental loss. These measures include:

10.1 Technical Controls

• Encryption of sensitive data in transit and at rest
• Firewalls, intrusion detection/prevention systems, and endpoint protection
• Multi-factor authentication for privileged system access
• Regular vulnerability assessments and penetration testing
• Secure backup and disaster recovery systems
• VLAN segmentation and network access control

10.2 Administrative and Organisational Controls

• Role-based access control and least privilege principles
• Annual and periodic staff cybersecurity awareness training
• Data classification and handling procedures
• Incident response and data breach notification procedures
• Vendor due diligence and data processing agreements
• Regular internal IT audits and compliance reviews

11. Cookies and Digital Tracking

Our websites and digital platforms may use cookies and similar tracking technologies to enhance your user experience, analyse site traffic, and deliver relevant content. Types of cookies used include:

• Strictly Necessary Cookies: Essential for the operation of our digital services and cannot be disabled.
• Performance Cookies: Help us understand how visitors interact with our website (used in anonymised, aggregated form).
• Functionality Cookies: Allow the website to remember your preferences and settings.
• Targeting/Marketing Cookies: Used to deliver relevant advertisements and marketing content (only with your consent).

You may control or disable non-essential cookies through your browser settings or our cookie consent management interface. Disabling certain cookies may affect the functionality of our digital services.

12. Children's Privacy

Baobab Microfinance Limited does not knowingly collect personal data from individuals under the age of 18 without the consent of a parent or legal guardian, except where required for the administration of permitted youth savings products or other regulated services. If we become aware that we have inadvertently collected personal data from a minor without appropriate consent, we will take prompt steps to delete such data.

13. Employee Data Privacy

Personal data collected from employees and contractors of Baobab Microfinance Limited is processed solely for legitimate employment and HR management purposes, including recruitment, payroll, performance management, benefits administration, compliance monitoring, and legal obligations. Employee data is handled in accordance with this Privacy Policy and the organisation's internal HR Data Policy.

14. Regulatory Framework and Compliance

This Privacy Policy has been developed in compliance with the following laws, regulations, and guidelines:

• Data Protection Act, 2012 (Act 843) — Ghana
• Banks and Specialised Deposit-Taking Institutions Act, 2016 (Act 930)
• Bank of Ghana Cybersecurity Directive
• Bank of Ghana Anti-Money Laundering / Counter-Financing of Terrorism Directives
• Anti-Money Laundering Act, 2008 (Act 749) and its amendments
• Electronic Communications Act, 2008 (Act 775)
• Payment Systems and Services Act, 2019 (Act 987)
• Financial Intelligence Centre Act, 2019 (Act 1018)
• Consumer Protection Agency Act, 2020 (Act 1038)

15. Policy Governance and Review

This Privacy Policy is owned by the IT and Security Department of Baobab Microfinance Limited and is subject to periodic review to ensure continued compliance with applicable laws, regulatory developments, and best practices. The policy will be reviewed at least annually or whenever a material change in law, operations, or risk profile necessitates an update.

All significant amendments to this policy will be communicated to clients and other affected stakeholders through appropriate channels, including notices at our branches, updates on our website, and direct communications where required.