Privacy Policy

1. Introduction

Welcome to TrustCredit GH. This Privacy Policy (“Policy”) explains how TrustCredit GH (“we,” “us,” or “our”) collects, uses, discloses, and protects your personal data when you use our mobile application, website, and related financial services (collectively, the “Services”). We are committed to safeguarding your privacy and ensuring the security of your personal information in accordance with the Data Protection Act, 2012 (Act 843) of Ghana and the Bank of Ghana’s guidelines on mobile financial services and consumer protection.

This Policy applies to all users of our Services within the Republic of Ghana. By accessing or using our Services, you acknowledge that you have read, understood, and agreed to the practices described in this Policy.

Effective Date: September 20, 2026

2. Information We Collect

2.1 Basic Information

When you register for and use our services, we may collect:

• Personal identification information: full name, date of birth, nationality, phone number, email address, and residential address.
• Government‑issued identification: Ghana Card number, driver’s license number, or passport number.
• Financial information: mobile wallet account details (MTN MoMo, Vodafone Cash, AirtelTigo Money), bank account information, and transaction history.

2.2 Device and Application Information

2.2.1 Device Information

To maintain platform security, verify your identity, and conduct risk control and anti‑fraud analysis during your use of this application, we may collect specific device information. This includes, but is not limited to: Android ID, MAC address, device model, phone serial number, IMEI, GAID, RAM, IP address, Wi‑Fi information, battery level, screen resolution, language settings, time zone, device manufacturer, network type, and mobile carrier name. This information is strictly necessary to improve the accuracy of identity recognition and risk assessment.

Your Choice: Providing this information is optional and will not affect your use of the application’s basic functions. However, declining to provide it may limit our system’s ability to accurately assess risks and personalize service recommendations.

2.2.2 List of Installed Applications

To enhance our risk control capabilities, detect fraudulent activities, and ensure the security and compliance of our lending services, we may collect the list of applications installed on your device only upon receiving your explicit authorization. The collected data includes app names, package names, installation and update timestamps, version numbers, system app status, app tags, and installation paths.

Data Protection: This information is used exclusively for risk assessment. All data will be encrypted and securely transmitted to and stored at https://www.trustcreditgh.com in accordance with applicable laws. We will not use this information for any purposes unrelated to this service, nor will we share it with any unrelated third parties without your explicit authorization.

2.2.3 Approximate Location Permission

With your explicit consent, we may collect your approximate location information to determine whether you are within our service coverage area and to assist with credit assessment and risk control. This helps us enhance the compliance and precision of our services.

Data Protection: We commit to never using your location information for any purposes unrelated to this service, nor will we share it with any third party without your explicit consent.

2.2.4 Camera Permission

During the identity verification process, we may request access to your device’s camera. This permission is used solely to capture and upload photos of your ID card and your face to verify your identity, prevent identity theft, and deter fraudulent activities.

Data Protection: Captured photos are used exclusively for a one‑time identity verification and will not be repurposed. All image data will be encrypted during transmission to our servers (https://www.trustcreditgh.com) and securely stored. We will not use this information for any unrelated purposes, nor share it with any third party without your prior consent.

2.2.5 Contact Information

With your explicit consent, we may access and collect your device's contact list information. This data includes names and phone numbers stored in your contacts, which we use to verify your identity, facilitate emergency contact verification, and enhance the security of our lending services. The collected contact information is limited to names and phone numbers only and does not include any message content or other private data.

Data Protection: All contact information is used exclusively for identity verification and risk assessment purposes. The data will be encrypted and securely transmitted to and stored at https://www.trustcreditgh.com in accordance with applicable laws, including the Data Protection Act, 2012 (Act 843) of Ghana. We will not sell, rent, or share your contact information with any third party for marketing purposes, nor will we use it for any purposes unrelated to this service without your explicit consent.

Your Choice: Providing this information is optional and will not affect your use of the application's basic functions. However, declining to provide this information may limit certain security verification features.

2.3 Usage and Transaction Data

• Log data: IP address, browser type, access times, pages viewed, and referring URLs.
• Transaction records: loan application history, repayment records, mobile wallet transfer details, and service fees.

3. How We Use Your Information

We process your personal data for the following purposes:

• Service Provision and Loan Processing: To facilitate loan applications, disbursements, and repayments.
• Identity Verification and KYC Compliance: To verify your identity in accordance with Know Your Customer (KYC) and Anti‑Money Laundering (AML) regulations.
• Risk Assessment and Credit Scoring: To evaluate your creditworthiness and determine appropriate loan terms.
• Fraud Detection and Prevention: To identify, prevent, and mitigate fraudulent activities and financial crimes.
• Regulatory Compliance: To comply with directives from the Bank of Ghana and the Data Protection Commission of Ghana.
• Service Improvement and Customer Support: To enhance our Services, troubleshoot issues, and respond to your inquiries.
• Legal Obligations: To fulfill statutory reporting requirements and respond to lawful government requests.

4. Legal Basis for Processing

Under the Data Protection Act, 2012 (Act 843), we process your personal data based on the following legal grounds:

• Consent: Where you have provided explicit consent for specific processing activities, such as accessing device permissions.
• Contractual Necessity: Where processing is necessary to perform our lending agreement with you.
• Legal Obligation: Where processing is required to comply with applicable laws and regulatory requirements.
• Legitimate Interests: Where processing is necessary for our legitimate business interests, including fraud prevention and risk management, provided such interests are not overridden by your fundamental rights and freedoms.

5. Data Sharing and Disclosure

We may share your personal data with the following categories of recipients:

• Service Providers and Partners: Mobile network operators (MTN, Vodafone, AirtelTigo), payment processors, and technology vendors who assist in delivering our Services under strict confidentiality and data protection obligations.
• Regulatory Authorities: The Data Protection Commission, Bank of Ghana, Ghana Police Service, and other competent authorities as required by law or regulatory directive.
• Credit Bureaus: Licensed credit reference bureaus in Ghana, in compliance with Ghana’s credit reporting regulations, to facilitate responsible lending.
• Legal Requirements and Enforcement: When necessary to enforce our terms, protect our rights, or comply with legal processes, court orders, or governmental requests.

6. Data Security

We implement robust technical and organizational measures to protect your personal data, including:

• SSL Encryption: All data transmitted between your device and our servers is encrypted using industry‑standard Secure Sockets Layer (SSL) technology.
• Access Controls: Strict role‑based access controls and multifactor authentication to limit access to personal data on a need‑to‑know basis.
• Regular Security Audits: Periodic vulnerability assessments, penetration testing, and third‑party security audits to identify and remediate potential risks.
• Employee Training: Comprehensive data protection and security awareness training for all employees and contractors with access to personal data.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Policy or as required by law:

• Loan and Transaction Records: Retained for a minimum of seven (7) years from the date of final loan settlement, in accordance with Bank of Ghana record‑keeping requirements.
• KYC and Identity Verification Data: Retained for the duration of your relationship with us and for five (5) years thereafter.
• Device and Application Data: Retained for no longer than twenty‑four (24) months, unless required for ongoing legal or regulatory proceedings.
• Deletion Procedures: Upon expiry of the applicable retention period, personal data is securely deleted or anonymized in accordance with our data disposal policy. You may request earlier deletion subject to legal and regulatory retention obligations.

If you wish to delete your personal information, please contact us at support@trustcreditgh.com. We will respond to your request within ten (10) working days.

8. Your Rights Under Ghana Data Protection Act, 2012 (Act 843)

As a data subject under Act 843, you have the following rights:

• Right to Be Informed: To receive clear and transparent information about how we process your personal data.
• Right of Access: To request confirmation of whether we process your personal data and to obtain a copy of such data.
• Right to Rectification: To request correction of inaccurate or incomplete personal data.
• Right to Erasure: To request deletion of your personal data where there is no compelling legal basis for continued processing.
• Right to Restrict Processing: To request limitation of processing in certain circumstances, such as when you contest the accuracy of your data.
• Right to Data Portability: To receive your personal data in a structured, machine‑readable format and transmit it to another controller.
• Right to Object: To object to processing based on legitimate interests or direct marketing.
• Right to Withdraw Consent: To withdraw previously given consent at any time, without affecting the lawfulness of processing prior to withdrawal.
• Right to Lodge a Complaint: To file a complaint with the Data Protection Commission of Ghana if you believe your data protection rights have been violated.

To exercise any of these rights, please contact us using the details provided in Section 12.

9. International Data Transfers

Where your personal data is transferred outside the Republic of Ghana, we ensure adequate safeguards are in place in accordance with Section 41 of the Data Protection Act, 2012 (Act 843). Such safeguards include:

• Standard contractual clauses approved by the Data Protection Commission.
• Binding corporate rules or equivalent internal group policies.
• Adequacy determinations by the Data Protection Commission for the receiving jurisdiction.
• Explicit consent for specific transfers where no other safeguard applies.

10. Children’s Privacy

Our Services are not intended for individuals under the age of eighteen (18). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a person under 18, we will take immediate steps to delete such data. If you believe we may have collected data from a minor, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or regulatory guidance. When we make material changes, we will:

• Notify you through the application, via email, or through other appropriate communication channels.
• Update the “Last Updated” date at the top of this Policy.

Your continued use of our Services following the publication of an updated Policy constitutes your acceptance of such changes. We encourage you to review this Policy periodically.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact our Data Protection Officer:

Data Protection Officer
TrustCredit GH
Accra, Ghana
Email: support@trustcreditgh.com

13. Glossary

For the purposes of this Policy, the following terms shall have the meanings set forth below:

• “Personal Data” means any information relating to an identified or identifiable natural person (“data subject”) who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, or online identifier.
• “Processing” means any operation or set of operations performed on personal data, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.
• “Data Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• “Data Processor” means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the data controller.
• “Data Subject” means an identified or identifiable natural person whose personal data is processed.
• “Consent” means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they, by a statement or clear affirmative action, signify agreement to the processing of their personal data.
• “KYC” means Know Your Customer, the mandatory process of identifying and verifying the identity of clients when opening accounts and periodically over time.
• “AML” means Anti‑Money Laundering, the legal and regulatory framework designed to prevent criminals from disguising illegally obtained funds as legitimate income.
• “Data Protection Commission” means the independent regulatory authority established under the Data Protection Act, 2012 (Act 843) responsible for overseeing data protection compliance in Ghana.
• “Bank of Ghana” means the central bank of the Republic of Ghana, responsible for monetary policy, financial sector regulation, and supervision.