Privacy Policy

Who We Are and What This Notice Covers

Data Protection Act, 2012 (Act 843)

Ananse WebWorks is a digital studio based in Airport City, Accra, Ghana. We design and build websites, business software, mobile applications, and cloud hosting for organisations in Ghana and abroad.

For the purposes of Act 843, Ananse WebWorks acts as the data controller for personal data collected through this website, our client portal, and the services we deliver. We maintain our registration as a data controller with the Data Protection Commission as the Act requires.

This notice explains what personal data we collect, why we collect it, how long we keep it, how we protect it, and the rights you can exercise over it. It applies to anansewebworks.com, the client portal, and any enquiry, booking, subscription, or job application you submit to us.

If you contact us on behalf of a client or employer, we may process your details as part of that business relationship. Please share this notice with anyone whose details you pass to us.

Information We Collect

We collect only the personal data we need to respond to you, deliver our work, and run our business.

• Identity and contact details — your name, email address, phone number, company name, job title, and location, given through our enquiry, booking, newsletter, and onboarding forms.
• Project and business information — briefs, requirements, feedback, brand assets, documents, and correspondence shared with us while we work together.
• Account information — login credentials, role, and activity inside the client portal where you hold an account with us.
• Billing information — invoices issued, payments recorded, and the company or tax details needed for billing. We do not store full card numbers on our systems; card payments are handled by our payment providers.
• Technical information — IP address, browser and device type, referring page, pages visited, and approximate region, collected automatically when you browse the site.
• Recruitment information — CVs, portfolios, references, and the answers you submit through our careers page.
• Preferences and consent records — cookie choices, service interests, communication settings, and the date you gave or withdrew consent.

Most of this information comes directly from you. A small amount reaches us indirectly — technical data from your browser, and details about a project shared by colleagues at your organisation.

How We Use Your Information and Our Lawful Basis

Act 843 — lawfulness and specification of purpose

Act 843 allows us to process personal data only for specified, lawful purposes, and only where we have a lawful basis for each purpose. The table below sets out both.

Where we rely on legitimate interest, we balance our business need against your rights and expectations, and you may object to that processing at any time.

The Data Protection Principles We Follow

We handle personal data in line with the core principles set out in Act 843:

• Accountability — we take responsibility for the data we hold and can demonstrate how it is protected.
• Lawfulness — every processing activity has a lawful basis and is carried out in a fair and transparent way.
• Specification of purpose — we collect data for stated purposes and do not use it for unrelated ones.
• Compatibility of further processing — if we reuse data for a new purpose, that purpose remains compatible with the original.
• Quality of information — we take reasonable steps to keep records accurate and up to date.
• Transparency — this notice, our forms, and our correspondence explain what we do with your data.
• Data security safeguards — we apply technical and organisational measures appropriate to the risk.
• Duty to the data subject — we honour your rights and respond to requests within the periods the Act allows.

When We Share Information

We do not sell, rent, or trade personal data. We share it only where it is necessary to run our business, and only with parties bound to protect it.

• Hosting and infrastructure providers who store our website, client portal, and project files.
• Payment, invoicing, and accounting providers who process billing and receipts.
• Email, scheduling, and communication providers who deliver our correspondence and bookings.
• Project collaborators and specialist contractors working on your project under confidentiality obligations.
• Professional advisers such as lawyers and auditors, where their advice is required.
• Regulators, courts, or law enforcement where disclosure is required by Ghanaian law or a valid legal request.
• A successor entity in the event of a merger, acquisition, or transfer of our business, subject to this notice.

Every processor we engage acts only on our documented instructions and applies appropriate security safeguards, as required by Act 843.

International Transfers

Act 843 — sections 16 and 17

Some of the infrastructure and communication providers we rely on store data on servers located outside Ghana. Where personal data is transferred outside Ghana, we do so only in line with sections 16 and 17 of Act 843.

In practice this means we transfer data only where the destination offers an adequate level of protection for personal data, where you have consented after being informed of the risks, or where the transfer is necessary for the performance of our contract with you.

We put contractual safeguards in place with our providers, keep transfers to the minimum needed to deliver the service, and choose regional storage where a project allows it.

How Long We Keep Information

We keep personal data only for as long as we need it for the purpose it was collected, or as long as Ghanaian law requires.

When a retention period ends, we delete or irreversibly anonymise the data, unless a legal claim, audit, or regulatory obligation requires us to keep it longer.

How We Protect Your Information

• All traffic to this website and the client portal is encrypted in transit using HTTPS and TLS.
• Stored files and databases are encrypted at rest, with access controlled by role.
• Only team members who need your data to do their work can reach it, under confidentiality obligations.
• Administrative accounts use unique credentials and multi-factor authentication.
• We run regular backups, review dependencies for vulnerabilities, and assess suppliers before we share data with them.
• Access is removed promptly when a team member leaves a project or the company.

If a personal data breach is likely to result in a risk to your rights, we will notify the Data Protection Commission and the affected individuals without undue delay, in line with Act 843.

Cookies and Similar Technologies

Electronic Communications Act, 2008 (Act 775)

We use a small number of cookies and similar technologies to keep the site secure, remember your preferences, and understand which pages are useful. Analytics cookies are only set where you have accepted them.

• Essential cookies — needed for the site and client portal to function securely. These cannot be switched off.
• Preference cookies — remember choices such as dismissed notices and saved form progress.
• Analytics cookies — collect aggregated, non-identifying statistics about page visits and performance.

You can clear or block cookies in your browser settings. Blocking essential cookies may stop parts of the site or portal from working. We do not use cookies to build advertising profiles about you.

Your Rights Under Act 843

Act 843 — sections 18 to 27

You have specific rights over the personal data we hold about you. Email us to exercise any of them and we will verify your identity before acting, so that we never release data to the wrong person.

Marketing and Direct Communication

Act 775 — direct marketing

We send marketing email only where you have subscribed, or where we have an existing client relationship and you have not opted out. Every marketing email includes a one-click unsubscribe link, and unsubscribes are actioned immediately.

We do not sell or rent mailing lists, and we do not pass your contact details to third parties for their own advertising.

Service messages about work you have commissioned — such as invoices, maintenance notices, and security alerts — are not marketing and are sent regardless of your marketing preferences.

Children's Data

Act 843 — protection of children

Our services are intended for organisations and adults. We do not knowingly collect personal data from anyone under 18, and our forms are not directed at children.

If you believe a child has given us personal data, contact us and we will delete it promptly once we have confirmed the request.

Third-Party Websites and Services

Our site links to external platforms such as social media, payment, and scheduling services, and we may embed content from them. Those platforms operate under their own privacy notices and set their own cookies.

We are not responsible for their practices. Please read their notices before sharing personal data with them.

Changes to This Notice

We review this notice at least once a year and whenever our processing changes. The version date at the top of this page always reflects the current notice.

Where a change materially affects your rights, we will notify account holders and subscribers by email before the change takes effect.