Privacy Policy
Last updated 9 October 2026
This policy explains what personal data HASTECH Commerce (“we”) collects, why, who we share it with, and the rights you have under Ghana’s Data Protection Act, 2012 (Act 843). It covers sellers who run a store on the platform, shoppers who buy from those stores, and anyone who contacts us.
Who is responsible for your data
We are the data controller for seller accounts, platform billing, messages sent through our contact form, and cookies set on this site.
When you buy from a store, the seller is the data controller for your order details and uses them to fulfil your order. We process that data on the seller’s behalf, keep it secure, and do not use it for our own marketing. Each store page shows the seller’s contact details.
What we collect
| Who | Data | Why |
|---|---|---|
| Sellers | Name, email, password (stored hashed), the date you accepted these terms | To create and secure your account (contract) |
| Sellers | Store name, business contact phone, email, WhatsApp number and address you choose to publish | To show buyers who they are dealing with, as the Electronic Transactions Act, 2008 (Act 772) requires |
| Sellers | Paystack API keys, kept in a table only our server can read | To start payments into your own Paystack account (contract) |
| Shoppers | Name, email, phone, and a delivery address only when you choose delivery; order notes | To process, deliver and support your order (contract) |
| Contact form | Name, email, message, and optionally phone and business name | To reply to you (consent) |
| Visitors who allow analytics | A random visitor ID, pages and products viewed, and the website that referred you (hostname only) | To show sellers anonymous view counts (consent, see the Cookie Policy) |
Sponsored store links are counted as plain totals (shown, clicked, on which store), with no cookie or visitor ID. We never see or store card numbers or MoMo PINs. Payments are entered on Paystack’s own pages. We do not store IP addresses alongside orders or analytics, and we do not collect data about children knowingly. Sellers must be at least 18.
Who we share it with
We share personal data only with the services needed to run the platform:
- Paystack processes payments for orders and platform fees.
- Supabase hosts our database, file storage and sign-in.
- Vercel hosts the website.
- Resend sends account emails such as verification codes.
- Google receives your request only if you choose “Continue with Google”.
Some of these providers store data on servers outside Ghana. We use providers that protect data to a standard at least equal to Act 843 and bind them by contract to use it only to provide their service to us. We do not sell personal data or share it with advertisers. We disclose data to authorities only when Ghanaian law requires it.
How long we keep it
- Seller accounts: until you delete your account from Account settings. Your store goes offline at once and your personal data is erased 30 days later; you can cancel by signing in before then. Order amounts and dates stay, without customer details, for the tax period below.
- Orders and payment records: six years, as Ghanaian tax law requires business records to be kept.
- Contact form messages: 12 months after we close the conversation.
- Analytics events: 24 months. The visitor cookie expires after 180 days.
How we protect it
Connections are encrypted with HTTPS. Database access rules keep each store’s data separate, so one seller cannot read another’s customers or orders. Payment amounts are checked on our server before an order is marked paid. Staff access is limited to what is needed to support the platform. If a breach puts your data at risk, we will tell you and the Data Protection Commission as the law requires.
Your rights
Under Act 843 you can:
- ask for a copy of the personal data we hold about you (sellers can download it themselves from Account settings);
- ask us to correct data that is wrong or out of date;
- ask us to delete data we no longer need or have no right to keep (sellers can delete their account themselves from Account settings);
- object to processing, and stop any direct marketing at any time;
- withdraw consent, which is as easy as giving it. For cookies, use the Cookie Policy page.
To make a request, use the contact form and choose “My personal data”. We reply within 21 days. For order data held by a store, you can also contact the seller directly.
If you are unhappy with how we handle your data, you can complain to the Data Protection Commission of Ghana at dataprotection.org.gh.
Changes to this policy
When we make a material change, we update the date at the top and email sellers before the change takes effect.