Privacy Policy

EazWorld is a digital agency based in Accra, Ghana, offering web design, web hosting, domain registration, SEO and digital marketing, and phone repair services. This policy explains how we handle personal data under the Data Protection Act, 2012 (Act 843).

EazWorld is in the process of registering as a data controller with Ghana's Data Protection Commission, as required by Act 843. We will publish our registration number and date here as soon as registration is confirmed.

We collect information you provide directly to us when you use our services, including:

• Contact information: name, email address, phone number, and company name when you fill out forms on our website.
• Account information: username and password when you create an account.
• Payment information: billing details processed securely through Paystack. We do not store card numbers.
• Delivery information: if you order from our online shop, your delivery address, phone number, and any delivery notes you give us. Deliveries are made by our own riders, not a third-party courier, so this is not shared outside EazWorld.
• Product reviews: if you choose to leave a review on a product you bought, the review and your name are shown publicly on that product's page.
• Communications: messages you send us via contact forms or email.

We also collect information automatically through your use of our website:

• Log data: IP address, browser type, pages visited, and time spent.
• Cookies: small files stored on your device to improve your experience (see section 9).
• Analytics data: aggregated usage data via Google Analytics 4, collected only if you accept analytics cookies in our cookie banner.

We use the information we collect to:

• Provide, maintain, and improve our services.
• Process transactions and send related information including confirmations.
• Send administrative messages, updates, and security alerts.
• Respond to your comments, questions, and requests.
• Send marketing communications (only with your consent — you may opt out at any time).
• Monitor and analyse trends to improve the website experience.
• Comply with legal obligations.

Act 843 requires us to have a lawful ground for every way we use your personal data. Here is how our main purposes map to that:

• Delivering a service you bought (building your website, hosting your account, registering your domain, processing a payment): necessary to perform our contract with you.
• Account creation and login, fraud prevention, keeping our systems secure, and record-keeping needed to run the business: our legitimate interest, balanced against your right to privacy.
• Marketing emails and analytics cookies: your consent, given through the cookie banner or an opt-in, and withdrawable at any time.
• Keeping transaction records for 7 years and responding to a lawful request from an authority: a legal obligation we must meet under Ghanaian law.

If you have questions about which ground applies to a specific use of your data, contact our Data Protection Contact (section 14).

We do not sell, trade, or rent your personal information to third parties. We may share your data only in the following circumstances:

• Service providers: Trusted third parties who assist us in operating our website (e.g., Paystack for payments, Cloudinary for image hosting, MongoDB Atlas for data storage, Resend for transactional emails). These providers are contractually bound to protect your data.
• Legal requirements: When required by law, subpoena, or other legal processes.
• Business transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred.
• With your consent: For any other purpose with your explicit consent.

Hosting clients: if you use our web hosting service, we process data on your behalf as well as our own — see our Terms of Service for the data processing terms that apply to that relationship.

Some of the service providers we use store or process data outside Ghana. This currently includes:

• Cloudinary (image hosting).
• MongoDB Atlas (database hosting).
• Google Analytics 4 (website analytics).
• Namecheap (domain registration and hosting infrastructure).
• Resend (transactional email delivery).

Each of these providers publishes its own data protection terms and maintains recognised security practices for the infrastructure it operates. We are reviewing formal data processing agreements with each one as part of our Data Protection Commission registration. We choose providers that are well established and that commit contractually to protecting personal data.

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These include:

• HTTPS encryption for all data transmission.
• Bcrypt hashing for stored passwords.
• JWT-based authentication with httpOnly cookies.
• Regular security reviews and updates.

No method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

If a personal data breach occurs that is likely to put your rights at risk, we will:

• Notify Ghana's Data Protection Commission without undue delay.
• Notify you directly, without undue delay, if the breach is likely to result in a high risk to your rights or freedoms.
• Tell you what happened, what data was affected, and what we are doing about it.
• Take reasonable steps to contain the breach and reduce any harm.

We use cookies and similar technologies. On your first visit a cookie banner lets you accept or reject non-essential cookies by category. You can change your choice at any time using the "Cookie settings" link in the site footer. Your choice is itself stored in a cookie for 6 months.

Categories we use:

• Strictly necessary: Required for the site to function — keeping you logged in, remembering your cart, your theme, and your cookie choice. These are always on and cannot be switched off.
• Analytics: Google Analytics 4, loaded only after you opt in. It measures page views and traffic sources so we can improve the site; IP addresses are anonymised. No analytics cookies are set until you consent, and revoking consent stops further analytics collection.
• Marketing: Meta Pixel (Facebook), loaded only after you opt in. It lets us measure the effectiveness of our advertising campaigns and show more relevant EazWorld promotions on Facebook and Instagram; it may set cookies (such as _fbp) and share page-view information with Meta. Off by default — nothing is loaded until you consent, and revoking consent stops further events being sent.

You can also control cookies through your browser settings. Disabling cookies may affect the functionality of certain features on our website.

Our website integrates with the following third-party services, each with their own privacy policies:

• Paystack (payment processing) — paystack.com/privacy
• Google Analytics 4 (website analytics, loaded only with your consent) — policies.google.com/privacy
• Meta Pixel (advertising measurement, loaded only with your marketing consent) — facebook.com/privacy/policy
• Cloudinary (image hosting) — cloudinary.com/privacy
• MongoDB Atlas (database hosting) — mongodb.com/legal/privacy
• Namecheap (domain registration, web hosting) — namecheap.com/legal/privacy-policy
• Resend (transactional email delivery) — resend.com/legal/privacy-policy

We are not responsible for the privacy practices of these third-party services.

Under the Data Protection Act, 2012 (Act 843), you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data (subject to legal obligations).
• Opt-out: Unsubscribe from marketing emails at any time using the link in any email.
• Data portability: Receive your data in a commonly used format.
• Complain: Lodge a complaint with Ghana's Data Protection Commission if you believe we have not handled your personal data lawfully — see dpc.gov.gh for how to do this.

To exercise any of these rights with us directly, contact our Data Protection Contact (section 14).

We retain your personal information for as long as necessary to provide our services and comply with our legal obligations. Specifically:

• Account data is retained while your account is active.
• Contact form submissions are retained for 2 years.
• Transaction records are retained for 7 years as required by Ghanaian financial regulations.

You may request deletion of your data at any time (see section 11).

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us.

For questions about this Privacy Policy, to exercise your rights, or to report a data protection concern, contact our Data Protection Contact:

We aim to respond to all data protection enquiries within 30 days.

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the new policy on this page with an updated date.
• Sending an email notification (for registered users).

Your continued use of our services after any changes constitutes acceptance of the updated policy.

For general questions about this Privacy Policy:

We aim to respond to all privacy inquiries within 30 days.