Privacy Policy

1. Introduction

This Policy is written to comply with the Data Protection Act, 2012 (Act 843) of the Republic of Ghana, enforced by the Data Protection Commission, and to reflect internationally recognised data protection principles (including those underlying the EU General Data Protection Regulation) so that the Platform can be used responsibly by organisations and individuals both in Ghana and elsewhere.

By creating an account or otherwise using the Platform, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Platform.

2. Who We Are

PowerMaps (referred to as "we," "us," or "our") is the data controller responsible for the personal data described in this Policy.

The bracketed details above should be completed with the operating entity's registered name and address before this Policy is published live.

3. Information We Collect

3.1 Information you provide directly

• Account information: full name, organisation, email address, and password (stored as a irreversible hash, never in plain text).
• Field data you collect: facility/point names, categories, statuses, custom field values you define for a project, and any notes you enter.
• Photographs: images you capture or upload of facilities/points through the web app or the Android app.
• Location data: GPS coordinates (latitude, longitude, accuracy, and altitude where available) recorded at the moment you collect a point.
• Communications: messages you post to project teams, and any correspondence you send us (e.g. support requests).

3.2 Information collected automatically

• Usage and activity data: login times, actions taken in the Platform (e.g. project created, point synced), and general activity logs used for security and auditing.
• Device and technical data: IP address, browser type, operating system, app version, and device identifiers, collected for security, diagnostics, and compatibility.

We do not knowingly collect more location or photographic data than you choose to submit through the Collect feature — the Platform does not track your location in the background.

4. How We Use Information

We use the information described above to:

• Provide, maintain, and operate the Platform, including account creation, authentication, and project/data management;
• Enable field data collection, syncing, mapping, export, and analytics features you use;
• Communicate with you — verification emails, password resets, invitations, notifications, and service-related announcements;
• Maintain the security and integrity of the Platform, including detecting and preventing fraud, abuse, and unauthorised access;
• Understand how the Platform is used so that we can maintain, support, and improve it — including developing new features and fixing issues;
• Comply with our legal obligations and enforce our Terms of Use; and
• Where information has been aggregated or de-identified so it no longer identifies you, for research, analytics, product development, and other legitimate business purposes described in Section 6 and Section 14 below.

5. Legal Basis for Processing

Under Act 843 and internationally recognised principles, we process personal data on the following bases:

• Consent — given when you accept our Terms of Use and this Policy at sign-up, and when you choose to submit location data or photographs through the Collect feature.
• Performance of a contract — processing necessary to provide the Platform you have signed up to use.
• Legitimate interest — for security, fraud prevention, service improvement, and analytics, balanced against your rights and interests.
• Legal obligation — where we must retain or disclose information to comply with applicable law.

6. How We Share Information

We do not sell information that identifies you to third parties for their own marketing purposes. We may share information in the following circumstances:

• Within your organisation/project: data you collect on a project is visible to other members of that project (e.g. the Project Manager and fellow collaborators), consistent with the Platform's purpose.
• Service providers: we use trusted third parties to help us operate the Platform, such as hosting providers and email delivery services, who process information only on our instructions and under confidentiality obligations.
• Aggregated or de-identified data: we may combine, aggregate, or de-identify information so that it no longer identifies you personally, and use or share that data — for example, summary statistics on facility types, coverage, or collection activity — with research partners, business partners, or other third parties for research, analytics, product development, and other legitimate business or commercial purposes.
• Legal and safety reasons: where required to comply with a law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of PowerMaps, our users, or the public.
• Business transfers: if we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy or a policy at least as protective.

7. Data Retention

We retain personal data for as long as your account is active, and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Collected field data (points, photos, custom field values) generally remains associated with the project it was collected under, even after an individual collaborator's account is deactivated, since it forms part of the project's record. You may request deletion of your personal account information at any time, subject to Section 9.

8. Data Security

We apply administrative, technical, and physical safeguards designed to protect your information, including:

• Passwords stored as salted, irreversible hashes — never in plain text;
• Authentication tokens stored as hashes, with expiry and revocation on logout;
• Encrypted connections (HTTPS/TLS) between the app and our servers;
• Role-based access controls limiting who can view or manage which data;
• Login-attempt throttling and activity logging to detect suspicious access.

No system is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify affected users and the Data Protection Commission as required by Act 843.

9. Your Rights

Under Act 843 and consistent with internationally recognised data protection standards, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data (via your Profile settings, or by contacting us);
• Request deletion of your personal data, subject to our legal and legitimate business retention needs;
• Object to or restrict certain processing of your data;
• Withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal;
• Data portability — request a copy of your data in a structured, commonly used format (see also the Export feature available to eligible roles); and
• Lodge a complaint with Ghana's Data Protection Commission, or another applicable supervisory authority, if you believe your rights have been violated.

To exercise any of these rights, contact us using the details in Section 16. We will respond within the timeframes required by applicable law.

10. International Data Transfers

Our servers and service providers may be located inside or outside Ghana. Where we transfer personal data across borders, we take steps required by Act 843 to ensure the receiving jurisdiction offers an adequate level of protection, or that appropriate contractual or other safeguards are in place.

11. Cookies & Similar Technology

The web app uses essential session cookies and browser local storage to keep you signed in and remember your preferences. The Android app stores your session token securely on your device. We do not use third-party advertising trackers, and we do not sell or share personal information for advertising.

Anything that is not strictly necessary is set only with your consent, which you can give, change or withdraw at any time. Our Cookie Policy lists every cookie and storage item individually, with what sets it, why, and how long it lasts.

Open cookie settings

12. Third-Party Services

The Platform relies on a small number of third-party services to function:

• Google reCAPTCHA — used at sign-up to prevent automated abuse; governed by Google's own Privacy Policy.
• OpenStreetMap — used to render maps; map tile requests are subject to OpenStreetMap's usage terms.
• Email delivery provider — used to send verification, password-reset, and notification emails.

These providers only receive the information necessary for them to perform their function.

13. Children's Privacy

The Platform is intended for organisational and professional use and is not directed at children. We do not knowingly collect personal data from individuals under 18 years of age. If you believe a child has provided us with personal data, please contact us so we can remove it.

14. Free Service & Platform Evolution

PowerMaps is currently provided free of charge. In using the Platform, you agree that the data you and your organisation collect helps us understand how the Platform is used, so that we can maintain and improve it for everyone.

As the Platform evolves, we may introduce new features, services, research collaborations, or business initiatives — which could include working with partners on aggregated or de-identified data as described in Section 6. Any such use will remain consistent with the principles in this Policy: we will not disclose data that identifies you without your consent or a valid legal basis, and we will update this Policy to reflect any material change before it takes effect.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice within the Platform before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

16. Contact Us

If you have questions about this Privacy Policy or how we handle your data, or wish to exercise any of the rights described in Section 9, contact us at: