Data processing agreement

Between Megyefo (the processor) and each business that runs a shop on Megyefo (the controller), as part of its agreement with Megyefo. It applies to the personal data of the business's customers and staff that Megyefo holds to run the shop.

1. What is processed, and why

Customers' names, emails, phone numbers, addresses, orders, payments, quotes, trade accounts and order messages, and staff members' names and emails, for the length of the business's agreement, only to run the business's shop and back office: storing, showing, sending order messages and emails, taking payments through the business's own payment account, and backups.

2. Megyefo's duties

  • Process the data only on the business's instructions, which are its use of the shop and back office, and as the law requires.
  • Keep it confidential: only people who need to, to run or support the shop, can reach it, and they are bound to confidentiality.
  • Keep it secure: each shop's data marked with the shop's own id and every read and write limited to it; encrypted connections; passwords stored only as one-way scrambles; payment keys encrypted; two-step sign-in available to staff; nightly backups that are tested.
  • Help the business answer its customers' requests to see, correct or delete their data, including by the data export in the back office.
  • Tell the business without undue delay, and within 72 hours of finding out, of a breach affecting its data, with what is known and what is being done.

3. Other processors

Megyefo uses: its hosting provider (servers and databases), Cloudflare (photo storage), its mail provider (email), Hubtel (SMS) and Meta (WhatsApp) for order messages. Payment providers (Paystack, Hubtel) act for the business, through its own account. Megyefo tells businesses before adding or changing one, and holds each to terms that protect the data as this agreement does.

4. Where the data is

On servers Megyefo chooses, which may be outside Ghana. Megyefo will tell the business where, and keeps the protections of the Data Protection Act, 2012 (Act 843) wherever it is.

5. At the end

The business can export its data at any time. Within 30 days of its agreement ending, Megyefo deletes the shop's database and its backups age out, unless the law requires it to keep anything, and confirms this when asked.

6. Checks

Megyefo gives the business what it reasonably needs to show it meets this agreement, and answers its questions about how the data is handled.