Privacy policy

Effective 26 October 2026

In short: Asanduff HQ holds the records the Asanduff Group of Companies needs to run its businesses. We use them only for that, we never sell them or use them for advertising, and we protect them carefully. This page explains what we hold, why, who can see it, how long we keep it and what you can ask us to do.

1. Who we are

Asanduff HQ (asanduffhq.app, including its desktop and Android apps) is the business management system of the Asanduff Group of Companies, Ghana. The Group decides what information is recorded and why, so it is the data controller under Ghana's Data Protection Act, 2012 (Act 843).

The software is built, hosted and maintained by DXCOVR on the Group's behalf. DXCOVR is a data processor: it handles the information only to run, secure, back up and support the system, and only as the Group instructs.

In this policy, "we" means the Group and DXCOVR together, and "you" means anyone whose information is in Asanduff HQ.

2. Whose information this covers

People who use Asanduff HQ: the Group's owners, managers, staff and accountants who sign in.
Customers of the Group's businesses, when a sale, invoice or payment is recorded for them.
Staff whose employment records are kept in the system.
Suppliers and their contact people.

3. What we hold

About people who sign in

Name, e-mail address, phone number, role and the businesses and branches you work in.
Your password, stored only as a one-way scrambled form (a hash). Nobody, including us, can read it.
If you turn on two-step sign-in: the secret your authenticator app uses, stored encrypted, and your recovery codes, stored as one-way hashes.
A record of signing in and important actions (the audit log): what was done, when, from which internet (IP) address and with which browser.

Business records

Customers: name, phone, e-mail, address and notes, with their purchases, invoices, payments, balances, returns and credit.
Sales, invoices, credit and debit notes, payments, refunds, expenses, stock and the accounting books.
Staff records: name, contact details, job, branch and, where entered, pay.
Suppliers: business name and contact details.
Files you upload, such as business logos and expense receipts.

We do not ask for or store payment card numbers, Ghana Card numbers or bank passwords.

4. Why we use it

To run the businesses: recording sales and invoices, collecting what is owed, keeping stock, paying for expenses and keeping the books.
To meet legal duties: keeping business and tax records as Ghanaian law requires, including VAT records for the Ghana Revenue Authority.
To keep the system and your account secure: checking who you are at sign-in, limiting repeated wrong guesses, and keeping a record of who did what.
To support you: fixing problems and answering questions.

We use information only for these purposes. We do not sell it, rent it, use it for advertising or build marketing profiles from it.

5. Who can see it

Inside the Group: only people whose role needs it. Access is set per business and per branch; a cashier at one branch, for example, sees that branch's sales, not another business's accounts.
DXCOVR, to host, maintain, back up and support the system, under a duty of confidentiality.
Service providers who hold data on our behalf:
- Hostinger, which provides the server, in a data centre in France (European Union);
- a cloud storage provider for off-site backups, which are encrypted before they leave the server so the provider cannot read them;
- an e-mail provider, only if e-mailed sign-in codes are switched on, to deliver them.
Authorities, such as the Ghana Revenue Authority or a court, when the law requires it.

Your information is stored outside Ghana, in the European Union, where data protection law is at least as strict as Ghana's.

6. Cookies

Asanduff HQ uses one essential cookie to keep you signed in (and a separate one for the platform administration area). It holds a random code, not your personal details, and the matching record on our side is stored only in scrambled form. There are no advertising, analytics or tracking cookies, and the pages load nothing from other websites: fonts and everything else come from our own server.

7. How long we keep it

Business and accounting records: while the business uses Asanduff HQ, and at least six years, as Ghana's tax laws require.
The audit log: for as long as the records it describes.
Sign-in sessions: end after 12 hours of inactivity, or 7 days at most.
Backups: nightly copies kept for 14 days on the server, and encrypted off-site copies for up to 90 days.
When someone leaves: their sign-in is switched off. Records they made stay, because they are business records.
If the Group stops using Asanduff HQ: it receives a full copy of its data, and the data is then deleted from the live system within 90 days and from backups as they expire.

8. How we protect it

Every connection is encrypted (HTTPS), and the database cannot be reached from the internet.
Passwords are stored as slow, one-way hashes; repeated wrong guesses are slowed down and lock the account for a while.
Two-step sign-in with an authenticator app is available to everyone and compulsory for platform administrators.
Each business's records are kept apart by the database itself, not only by the software.
Important actions are recorded in an audit log, and the accounting books cannot be edited or deleted, only corrected with a new entry.
Nightly backups, with encrypted copies kept away from the server.

No system is perfectly secure. If a breach puts your information at risk, we will tell the people affected and the Data Protection Commission as the law requires.

9. Your rights

Under the Data Protection Act, you can ask us to:

tell you what information we hold about you and give you a copy;
correct information that is wrong or incomplete;
delete or stop using information we no longer need, unless the law requires us to keep it (tax records, for example);
stop using your information for a particular purpose.

E-mail asante@asanduff.com. We will answer within 21 days. If you bought from one of the Group's businesses, you can also ask that business directly. If you are not satisfied, you can complain to the Data Protection Commission.

10. Children

Asanduff HQ is a business tool for adults and is not meant for anyone under 18.

11. Changes to this policy

If we change this policy, we will update the date at the top. If a change affects your rights, we will tell people who use Asanduff HQ before it takes effect.

12. Contact

Privacy questions and requests: asante@asanduff.com (Asanduff Group of Companies).
Technical and security matters: DXCOVR, www.dxcovr.com.