1. Responsible Party and Contact Information

AyaLend is a personal credit loan application developed by COSTECH PRIDE TECHNOLOGY LIMITED (hereinafter referred to as "we"). Our registration number is CS147350922, and our registered address is: P. O. Box 494, Weija-Accra. We act as the data controller for your personal data in accordance with Ghana’s Data Protection Act, 2012 (Act 843) and Anti-Money Laundering Act, 2020 (Act 1044), among other applicable laws and regulations. For any inquiries regarding privacy or data protection, please contact us via:

• Email: support@costechpride.co
• WhatsApp: +233 201729882
• Office Hours: Monday to Friday, 9:00 AM to 6:00 PM

2. Scope of Application

This Privacy Policy applies to the following parties:

• Users who use, browse, or access the AyaLend application to apply for or obtain loan services.
• This policy does not apply to information collected through offline channels or data not processed via the AyaLend application.

User Consent

• By using our services, you agree to the terms of this policy. If you do not agree, you may still use some features, but core services will be restricted.

3. Types of Personal Data Collected

To provide loan services, prevent fraud, fulfill legal obligations, and optimize user experience, we request and collect the following permissions and data (all encrypted and uploaded to our secure server at https://hs.ayalend.co). You have the right to access, modify, or delete your personal data by emailing support@costechpride.co, and we will process your request within 15 business days.

When requesting permissions and collecting data, the app will provide detailed explanations and offer "Agree" and "Decline" options. You have the right to decline, and while some features may still be available, core services will be restricted.

3.1 Camera Permission

• Used to capture ID documents or perform real-time liveness detection to meet Ghana’s financial regulations for KYC (Know Your Customer) requirements.
• Images are solely used for identity verification, and original files (ID photos or liveness detection files) are automatically deleted after 90 days (you may request earlier deletion).
• You can disable this permission at any time via your device’s app settings.

3.3 Other Data

• Beyond the permissions and data described above, which are necessary for providing loan services, we do not request or collect any other device information. We adhere to the principle of data minimization to maximize the protection of your privacy.

4. Purposes of Data Processing

We process your personal data for the following purposes:

4.1 Primary Purposes

• Identity Verification: To verify your identity through the KYC process, in compliance with Ghana’s Anti-Money Laundering Act, 2020 and Bank of Ghana regulations.
• Loan Services: To receive, register, and process loan applications, assess credit eligibility, disburse loans, and provide account statements.
• Customer Support: To resolve complaints, disputes, or inquiries related to loans and to record customer service interactions for quality assurance.
• Fraud Prevention: To detect and prevent fraud or other illegal activities, ensuring the security of loan services.
• Legal Compliance: To retain or disclose necessary information as required by the Data Protection Act, 2012 of Ghana or regulatory bodies (e.g., Bank of Ghana, Financial Intelligence Centre).

4.2 Secondary Purposes

We will not use your personal data for the following secondary purposes:

• Advertising or marketing activities.
• User profiling or targeted advertising.
• Market research or satisfaction surveys.

If we introduce secondary uses in the future, we will seek your explicit consent via email or in-app notifications. You may object to such uses at any time by contacting support@costechpride.co.

5. Data Sales

We solemnly pledge that AyaLend will not sell, trade, or transfer your personal data (including personal information and camera data) to any third party for commercial purposes. Your personal data is used exclusively for the primary purposes outlined in this policy (e.g., KYC verification, loan services, legal compliance) and will not be used for advertising, marketing, or other non-legal purposes.

If you have any questions about our data processing practices, you may contact us at support@costechpride.co, and we will respond within 15 business days.

6. Data Sharing

We only share your personal data in the following circumstances:

• Legal and Regulatory Requirements: In compliance with Ghana’s Anti-Money Laundering Act, 2020 (Act 1044), the Data Protection Act, 2012, or requests from regulatory bodies such as the Bank of Ghana, Financial Intelligence Centre, or courts, we may disclose personal information (e.g., name, ID number) or camera data. Unless prohibited by law, we will notify you via email or in-app notification prior to disclosure.
• Credit Agencies/Anti-Fraud Service Providers: To support business operations.

7. Data Transmission and Storage

7.1 Data Transmission

To complete KYC verification, camera data (ID photos, liveness detection videos) and related personal information are uploaded to our servers via a secure HTTPS connection (using TLS 1.3 encryption).

7.2 Data Storage

• Storage Location: Data is stored on servers that comply with Ghana’s Data Protection Act, 2012 and ISO 27001 security standards.
• Encryption: All stored data is protected using AES-256 encryption.
• Access Control: Only authorized personnel (bound by strict confidentiality agreements) may access the data, and only for KYC verification, customer support, or legal compliance purposes.

7.3 Local Data

Except for camera data and KYC-related personal information, no other data is collected or transmitted from your device. Local processing, such as camera capture, occurs on your device without involving additional permissions.

8. Data Security

We implement the following measures to protect your personal data:

• Encryption: Data transmission uses TLS 1.3, and storage uses AES-256 encryption.
• Access Restrictions: Role-based access control and 180-day operation logs are used to limit data access.
• Security Audits: Regular vulnerability scans and third-party penetration tests ensure compliance with ISO 27001 standards.
• Incident Response: In the event of a data breach, we will notify the Data Protection Commission of Ghana and affected users within 72 hours, in accordance with the Data Protection Act, 2012, and take remedial action.

9. Data Retention and Deletion

9.1 Retention Period

• Camera Data and Personal Information: Retained for up to 90 days after KYC verification is completed.

9.2 Deletion Process

• Automatic Deletion: Data is automatically deleted or anonymized after the retention period.
• User Request: You may request data deletion by contacting support@costechpride.co, providing your registered information for identity verification. Requests will be processed within 15 business days, unless retention is required by law.
• Account Closure: You may close your account via the "Delete Account" feature in the app or on our website, after which all local and server-stored data will be deleted (subject to legal retention requirements).

10. User Rights

In accordance with Ghana’s Data Protection Act, 2012 and Google Developer requirements, you have the following rights:

• Right to Information: To know how your personal data is collected, used, and shared.
• Right of Access: To request a copy of your stored personal data or information about its sources.
• Right to Rectification: To request correction of inaccurate or incomplete personal information.
• Right to Erasure: To request deletion of personal data that is no longer needed (subject to legal restrictions).
• Right to Restrict Processing: To request suspension of data processing (which may affect loan services).
• Right to Object: To object to certain data processing activities (e.g., potential future marketing uses).

10.1 Exercising Your Rights

• Contact Method: Submit requests regarding your rights and data via email to support@costechpride.co, providing your registered phone number and ID information for identity verification.
• Processing Time: We will respond within 15 business days.

10.2 Permission Management

You may enable or disable camera permissions at any time via your device settings. Disabling permissions will prevent KYC verification and affect loan services but will not impact non-core features (e.g., browsing loan information).

11. Children’s Privacy

AyaLend is restricted to users aged 18 and above. KYC verification requires government-issued ID to ensure minors cannot register. We do not knowingly collect or process children’s data. If we discover any data from minors, we will immediately delete it and terminate the associated account. Parents may report issues via support@costechpride.co.

12. Privacy Policy Changes

We may update this policy due to legal, technical, or business changes. You will be notified of changes via:

• In-App Notification: A pop-up notice will appear when you first open the app after a policy update.
• Email: Registered users will receive an update notification.

Continued use of AyaLend constitutes acceptance of the updated policy. If you do not agree, you may stop using the app or request data deletion. The electronic or otherwise appropriately stored copy of this policy is considered the true, complete, valid, and enforceable version, effective at the time you access the application.

13. Contact Us

For any questions, complaints, or to exercise your rights, please contact:

• Company: COSTECH PRIDE TECHNOLOGY LIMITED
• App Name: AyaLend
• Email: support@costechpride.co
• WhatsApp: +233 201729882
• Address: P. O. Box 494, Weija-Accra
• Office Hours: Monday to Friday, 9:00 AM to 6:00 PM