Privacy Policy & Data Retention

1. Introduction and Scope

Enthronement Finance ("we", "us", or "our") is dedicated to maintaining the highest standards of confidentiality, data integrity, and privacy for all our customers, loan applicants, depositors, and portal visitors. This Privacy Policy details how we collect, process, store, and safeguard your personal and financial data when you visit our website (enthronementfinance.com), use our Client Portal (clientportal.enthronementfinance.com), apply through our account-opening portal, or visit any of our physical branch locations in Ghana.

2. Categories of Information We Collect

To deliver microfinance, Susu savings, loan management, and banking services, we collect and process the following categories of data:

• Customer Identification (KYC Data): Full legal name, date of birth, gender, nationality, Ghana Card (National Identification Authority PIN), passport photograph, residential address, digital address (GhanaPost GPS), and employment or business details.
• Contact Information: Registered Ghanaian mobile telephone number, email address, postal address, and emergency or guarantor contact details.
• Financial and Account Records: Account numbers, Susu contribution schedules, account ledger entries, deposit and withdrawal records, loan balances, repayment history, and transaction references.
• Authentication & Security Data: Cryptographically hashed 4-digit portal security PINs, session tokens, audit logs of logins, failed PIN attempts, and password reset requests. Plaintext PINs are never stored or accessible to staff.
• Technical & Session Data: Internet Protocol (IP) addresses, browser type, device identifiers, time-stamped access logs, and necessary security cookies used to prevent session hijacking and cross-site request forgery.

3. Lawful Bases for Processing

Under Section 18 of the Data Protection Act, 2012 (Act 843), we process your personal data only where a valid legal basis exists:

• Performance of a Contract: Necessary to open and administer your savings, Susu, or loan accounts, calculate interest, and execute your transactions.
• Compliance with Legal and Regulatory Obligations: Necessary to meet statutory duties under the Bank of Ghana guidelines, the Anti-Money Laundering Act, 2020 (Act 1044), Credit Reporting Act, 2007 (Act 726), and revenue collection statutes.
• Legitimate Institutional Interests: To detect, prevent, and mitigate fraud, unauthorized portal intrusions, identity theft, and loan default risks.
• Explicit Consent: Obtained for specific optional communications, promotional SMS alerts, or electronic marketing campaigns, which may be withdrawn at any time.

4. Third-Party Processors and SMS Communications

We do not sell, rent, or trade your personal data. We disclose information only to vetted third-party service providers bound by strict confidentiality and security agreements:

• SMS Delivery Gateways: We partner with licensed Ghanaian telecommunications aggregators to deliver transaction alerts, security verification notices, and balance notifications. Only your recipient mobile number and the specific message body are transmitted.
• Credit Reference Bureaus: As required by Ghanaian banking regulation, loan performance and delinquency records may be reported to licensed credit reference agencies.
• Cloud Infrastructure and IT Hosts: Secure server environments operating with firewalls, intrusion detection, and access control policies.
• Judicial and Regulatory Bodies: Disclosures made strictly pursuant to a valid court subpoena, Bank of Ghana directive, or written request by the Financial Intelligence Centre (FIC).

5. Statutory Data Retention and Deletion Limitations

In the financial services sector, customer deletion requests are governed by mandatory regulatory retention obligations. Personal and financial records cannot always be deleted immediately upon request:

• Banking & Ledger Records: Transaction histories, deposit ledgers, account opening forms, and KYC records are maintained for a mandatory minimum statutory period (ordinarily five (5) to seven (7) years following account closure) to satisfy Bank of Ghana, anti-money laundering, and audit requirements.
• Unconsummated Applications: Account opening inquiries or loan applications that do not proceed to an active customer relationship are retained for up to twelve (12) months before automated expungement.
• Marketing & Non-Essential Records: Contact records utilized exclusively for non-statutory notifications are expunged or unsubscribed upon receipt of a verified customer opt-out request.

6. Information Security Measures

Enthronement Finance employs defense-in-depth technical and operational security controls:

• Cryptographic Protection: All portal and website traffic is encrypted using Transport Layer Security (TLS 1.2/1.3 / HTTPS). Customer access PINs are stored exclusively as one-way bcrypt salted cryptographic hashes.
• Account Isolation: Server-side authorization routines strictly enforce customer-level ownership checks on every request, preventing any customer from accessing another user's financial ledger.
• Audit Logging: Administrative access, customer search queries, and SMS campaign dispatches are logged with operator timestamps and IP addresses for comprehensive forensic auditability.
• Limitations: While we employ industry-standard safeguards, no electronic transmission or digital storage method is entirely impenetrable. Customers share responsibility for securing their mobile devices and guarding their 4-digit PINs.

7. Your Data Subject Rights (Act 843)

Subject to statutory banking and anti-money laundering exemptions, Ghanaian law grants you the right to:

• Access: Request confirmation of whether we hold your personal data and obtain a verifiable copy of your records.
• Rectification: Request the correction of inaccurate, incomplete, or outdated personal information.
• Objection to Direct Marketing: Opt out of promotional or broadcast SMS communications at any time without affecting your transactional account services.
• Lodge a Complaint: File an inquiry or grievance with our Compliance Desk, or directly with the Data Protection Commission (DPC) of Ghana.

8. Cookies and Session Notice

Our website and Client Portal utilize strictly necessary security cookies to preserve your authenticated session, verify CSRF tokens, and maintain interface preferences (such as the balance privacy eye-toggle). We do not deploy third-party cross-site advertising trackers or sell browsing profiles.

9. Customer Privacy & Contact Information

To exercise your rights, submit a privacy inquiry, or report a suspected security concern, please contact our Compliance Team: