MTN Ghana Data Protection and Privacy Statement

MTN Ghana takes the protection of your privacy and security of your Personal Data very seriously.  

This Privacy Notice describes how we process your Personal Data, your rights in relation to the Personal Data we

Process, and our commitment to process your Personal Data in a fair, lawful, transparent, ethical and secure manner. 

Who are we?

We are MTN Ghana. 

In this privacy notice, “we”, “our” and “us” refers to MTN Ghana. 

Who does this notice apply to?

This notice applies to:

—	any person(s) who contracts with us for the provision of products and services, or who purchases a product or service from us, including potential customers;
—	any person(s) who use(s) our website, mobile applications or any products or services (“users”);
—	all suppliers, contractors and service providers of MTN Ghana including potential suppliers;
—	resellers such as MTN Ghana distributors and agents as well as partners including potential resellers.
—	MTN Ghana Foundation applicants, recipients, and partners and:
—	any other persons (save for employees and job applicants) who share Personal Data with MTN Ghana including beneficiaries, trustees or donors to MTN Ghana trusts or charitable causes; MTN Ghana guests (“other Data Subjects”).

Important terms you need to understand when reading this notice

Data Subject	Means an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. It shall also include any additional persons afforded data privacy rights and protection of Personal Data in terms of the Data Protection Act, 2012 (Act 843) and any other Applicable Data Privacy Law.
Local Regulatory Requirements	Legal, statutory, regulatory, license conditions, rules, guidelines, Ministerial/National Security orders or directives, and Directives relating to Public safety (where applicable) and Data Sovereignty*-related requirements with which MTN Ghana is required to comply. *Data Sovereignty relates to the laws, restrictions, governance structures a country may impose on Personal Data that is processed within its jurisdictions.
Personal Data	“personal data” means data about an individual who can be identified, from the data, or from the data or other information in the possession of, or likely to come into the possession of the data • controller;
Processing	Any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, including collection, receipt, recording, organisation, structuring, collation, storage; adaptation or alteration, updating, retrieval, consultation, use, dissemination, disclosure by means of transmission; or otherwise making available, alignment or combination, merging, restriction, erasure, destruction, and/or degradation.
Special Personal Data	“special personal data” means personal data which consists of information that relates to the race, colour, ethnic or tribal origin of the data subject; the political opinion of the data subject; the religious beliefs or other beliefs of a similar nature, of the data subject; the physical, medical, mental health or mental condition or DNA of the data subject; the sexual orientation of the data subject; (f) the commission or alleged commission of an offence by the individual; or (g) proceedings for an offence committed or alleged to have been committed by the individual, the disposal of such proceedings or the sentence of any court in the proceedings;

What Personal Data does MTN Ghana collect and use?

To provide our products and services to you we may collect, use, store and otherwise process your Personal Data. Such Personal Data may vary depending on the products and services that you use and subscribe to, how you have used the products and services, and how you have interacted with MTN Ghana even if you are not a customer, or what we have obtained from a third party with permission to share it with us.

We only collect the Personal Data that is adequate, relevant and limited to what is needed in relation to the specific purposes for which we are collecting it, as described in this privacy notice. 

The Personal Data collected and processed by us may include where applicable:

—	account and contact information: which may include your name, contact information (email address, postal address, residential address, telephone number), date of birth, identifying numbers (identity document number, passport numbers and/or other national ID numbers as required); billing information; financial information; any other information required to enable us provide a service and comply with regulatory requirements;
—	location information: information regarding your physical location / geolocation when you use your device or connect with a mobile network, Wi-Fi routers, Bluetooth, beacons, GPS satellites and/or other MTN Ghana technologies or infrastructure;
—	network performance: information which informs our network performance such as your use of our products, services or equipment;
—	financial information: such as your bank account or credit card details; financial history (including information to determine your creditworthiness);
—	usage of your devices, our services and products: data usage (including browsing history); Call Data Records (CDRs); video streaming (including your selected packages and usage); purchase activities; and other similar information;
—	web browsing and application usage: your IP address, browser type; operating system; mobile carrier; your ISP; URLs of sites from which you arrive or leave the website and mobile applications and sites that have our platform technology embedded; time you spend on our website or mobile applications; links or advertisements you see; purchases made through our website; first party cookies and other web tracking technologies. We may also collect information identifying or related to equipment accessing our networks including the software, configuration, equipment type and other unique identifiers Third party cookies will also be collected from our selected marketing technology partner(s), third party websites and applications.
—	supplier, reseller, contract and service provider information: name, contact information, billing information, background checks, financial history, employment history, tax information, information related to your performance; any other information which may be required in terms of regulatory requirements applicable to MTN Ghana and/or our policies;
—	multimedia data: such as unaltered photographs and related information;
—	social media information:your interaction with our social media accounts, content and marketing campaigns (including your details when you enter into a competition or interact with an advertisements; your comments, your reactions (i.e. ‘likes’)), Personal Data available from your public profile and information you have allowed social media platforms to share with us in terms of your privacy preferences on that platform; and your social media handles;
—	biometric information: such as your images, fingerprints and other biometric information required to identify you;
—	demographic information: we may collect information related to your sex, race or ethnic origin, age, education, financial status;

— views, opinions and interests: we collect information regarding your views, opinions and preferences (for example when you participate in a survey or when you provide feedback regarding our products or services or online based behaviour) as well as your interests. In the case of suppliers and resellers, we will obtain the views and opinions of others regarding your performance (e.g., references).

Where does MTN Ghana collect my Personal Data from?

In most circumstances we collect Personal Data directly from you when you:

• Buy or use any of our products and services
• Use our network 
• Register for a specific product or service
• Subscribe to newsletters, alerts or other services from us
• Contact us through various channels, or ask for information about a product or service
• Take part in a competition, draw, event or survey
• Visit or browse our website 
• Have given permission to other companies to share information about you
• Where your information is publicly available
• Are the customer of a subsidiary or a business that we acquire

We may also collect information from certain organisations, where appropriate and to the extent we have legal grounds to do so. These include :

— Credit check or vetting agencies;

— Fraud-prevention agencies

— Social media platforms;

— Marketing agencies;

— Other entities within the MTN Group (e.g. based on the usage of their applications, websites and sharing of Personal Data);

— Resellers in respect of the Personal Data of customers, users and suppliers;  — Third parties providing supplier and reseller references.  

For what purposes does MTN Ghana use your Personal Data?

MTN Ghana may use your Personal Data for of the following:

— Verification: verify your identity when you are purchasing our products and services, when you make contact with us, or when we contact you; 

— Credit checks: using the services of a credit bureau, where you are applying for a contract for products and/or services with us, and to assess your application;

— Contracting and processing orders: to process your request to provide products and services and to keep you updated with your order progress and to provide our products and services to you;

—	Billing and collection: perform billing of your account for your use of our products and services. We also Process your Personal Data to collect outstanding monies due to us through our collection processes;
—	Monitor and improve services: research and statistical analysis on our customers’ and/or users’ behaviour for purposes of monitoring the performance of our network, products and services and maintaining or improving our products and services to you;
—	Improve value proposition: analyse our customers and/or users preferences and interests based on their use of MTN Ghana websites, mobile applications, products, services and/or social media interactions to improve on our services, products, to perform marketing, online behavioural advertising and to develop new services or products which may be suitable to you;
—	Network performance: protect our network and manage the volume of calls, texts and other use of our network. For example, we identify peak periods of use, so we can ensure the network can handle the volume during those times.
—	Marketing:  promote and/or market our products and services to you by means of text and voice messaging, email, post, telephone calls, or through social media campaigns, but only when this is in compliance with the Data Protection Act , 2012 (Act 843) and the MTN Ghana Data Privacy and Protection Policy  and you have given us your consent where required for  direct marketing communications (e.g., where you have opted-out of certain categories of direct marketing but not all categories of direct marketing).
—	Fraud and crime prevention: detect and prevent fraud or criminal activity through the use of our products or services;
—	Security: prevent Personal Data Breaches, and to safeguard our IT systems, networks, assets, buildings and places of work;
—	Compliance and Reporting: comply with any legal obligations imposed on MTN Ghana by applicable law or in response to directives from law enforcement or court orders (for example “know your client” requirements) and to discharge any prescribe reporting obligations.
—	Customer service: provide you with customer services including to respond to any question, query, requests, concerns or complaints you may have about MTN Ghana, including our network, products, services, employees or our Processing activities.

MTN Ghana will not further process Personal Data for any purpose that is incompatible with the original purpose that the Personal Data was collected for and delivery of services to you unless:

— such further Processing is authorised under the Data Protection Act, 2012 (Act 843);

— we have obtained your consent for the further processing;

— the further Processing is necessary to comply with an obligation imposed by Local Regulatory Requirements or for conducting proceedings in a court or tribunal; or

— it is for scientific or historical research purposes or statistical purposes.

Is MTN Ghana allowed to Process my Personal Data?

MTN Ghana processes your data based on the following legal bases, as appropriate:

— Performance of a contract: this is when the Processing of your Personal Data is necessary to conclude a contract or perform our obligations under a contract entered with you.

— Legal obligation: this is when we are required to process your Personal Data to comply with a legal obligation.

— Legitimate interests of MTN Ghana or a third party: where it is in our or a third party’s legitimate interest provided these interests are not overridden by your interests and fundamental rights and freedom to data privacy.

—	Vital interests of the data subject or another natural person: the Processing is necessary to protect your vital interests or that of another natural person.
—	Public Interest: the Processing is necessary for the performance of a task carried out in the public interest.
—	Your consent: where you have granted specific permission to process your Personal Data. This consent may be withdrawn at any time.

In instances when we process your Special Personal Data, we will rely on one of the following legal bases as appropriate having regard to the purpose of Processing:

— You have given explicit consent to the processing of your Sensitive Personal Data for one or more specified purposes. You may withdraw such consent at any time;

— Processing is necessary to protect your vital interests or that of another natural person and you are physically or legally incapable of giving consent;

— Processing relates to Sensitive Personal Data which was intentionally made public by you;

— Processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

— Processing is necessary for scientific or historical research purposes or statistical purposes provided such Processing is proportionate to the aim pursued, MTN Ghana respects the essence of the right to data protection and MTN Ghana provides for suitable and specific measures to safeguard your fundamental rights and the interests.

— Processing of Personal Data related to criminal behaviour is obtained and used in accordance with the Data Protection Act,2012 (Act 843) and other Local Regulatory Requirements. 

Is it mandatory to provide MTN Ghana the Personal Data asked for?

It is not mandatory for you to provide any Personal Data to us. The Personal Data requested by us enables us to: 

— deliver the products and services that you use and subscribe to 

— support you with and manage our products and services; 

— provide you full functionality to all our webpages; 

— on-board you as supplier, reseller, contractor or service provider; — allow you access to our premises or buildings.

Does MTN Ghana Process my Personal Data automatically?

MTN Ghana will not subject you to automated decision-making processing unless

• appropriate measures have been taken to protect your legitimate interest; or 
• the decision is based on your explicit consent;

How long does MTN Ghana keep my Personal Data?

We will not retain your Personal Data for any longer than is necessary for achieving the purpose(s) for which the Personal Data is Processed, unless:

—	retention of the Personal Data is required or authorised by the Data Protection Act, 2012 (Act 843) and any other applicable local law;
—	you have consented to the retention of the Personal Data; or
—	the Personal Data is required for historical, statistical or research purposes and provided that we have established appropriate safeguards against the Personal Data being used for any other purposes.

We ensure that Personal Data which is no longer required, or we are no longer authorised to retain, is as soon as reasonably practicable, de-identified or destroyed through secure means, alternatively through permanent erasure by appropriate and effective mechanisms.

Does MTN Ghana transfer my Personal Data to Third Parties?

Yes, we may share Personal Data with affiliated third parties, as necessary for our legitimate business needs, to carry out your requests, and/or as required or permitted by law. These include:

— Our service providers: such as our (IT) systems providers, our hosting providers, consultants (such as legal advisers) and other goods and services providers. These providers Process your Personal Data on behalf of MTN Ghana in terms of a binding agreement with appropriate security safeguards. MTN Ghana will only transfer Personal Data to such a service provider when they meet our strict standards on the Processing of data and security. We only share Personal Data that allows our service providers to provide their services and they are not allowed to Process your Personal Data for any other purpose.

— If we are reorganized or sold to another organization: MTN Ghana may disclose Personal Data in connection with the sale, assignment, or other transfer of the business to which the data relates.

— Courts, tribunals, law enforcement, or regulatory bodies: MTN Ghana may disclose Personal Data to respond to requests of courts, tribunals, government, or law enforcement agencies or where it is necessary or prudent to comply with applicable laws, court or tribunal orders or rules, or government regulations.

— Audits: disclosures of Personal Data may also be needed by our auditors including to perform financial audits, data privacy or security audits and/or to investigate or respond to a complaint or security threat.

— Insurers: our business requirements mean that we carry significant insurance cover in respect of business activities. There are several different participants in the insurance market (e.g., brokers, insurers, and reinsurers, as well as their professional advisors and other third parties involved should there be a claim). Some of these insurance market participants will require that we disclose Personal Data about you to them. The information will be used by the insurance market participants in the underwriting and ongoing administration of the insurance products, where there is a claim that you are relevant to and to allow the insurance market participants to comply with their legal and regulatory obligations. Some of these insurance market participants will handle this information on our behalf (like our service providers described above), but others will want to Process information about you independent of us. 

— Other third parties: we may share information with other third parties who use MTN Ghana platforms / systems to advertise their product. However, the Personal Data collected is anonymised and/or aggregated prior to sharing with such third parties. 

Does MTN Ghana transfer my Personal Data outside Ghana?

Yes, MTN Ghana transfers Personal Data outside of Ghana but only if such transfers are permitted by the Data Protection Act, 2012 (Act 843) and any other Local Regulatory Requirements.  

MTN Ghana may transfer your Personal Data to other entities within the MTN Group. All MTN entities are bound by binding corporate rules which ensures that the MTN entity receiving your Personal Data protects your Personal Data in accordance with those binding corporate rules. 

MTN Ghana also transfers certain Personal Data outside of Ghana to third parties working with us or on our behalf for the purposes described in this Privacy Notice. When transferring Personal Data internationally to third parties we ensure your Personal Data will continue to be protected by putting in place adequate safeguards which requires the relevant third party to adhere to the data handling and data protection requirements, acceptable to MTN Ghana.

How does MTN Ghana secure my Personal Data?

MTN Ghana secures the integrity and confidentiality of the Personal Data in its possession or under its control by implementing appropriate, reasonable technical, physical, and organisational measures to prevent:

— accidental loss of, damage to, or unauthorised destruction of your Personal Data;

— unlawful or unauthorised access to your Personal Data; and — unlawful or unauthorised Processing of your Personal Data.

As part of its processes, MTN Ghana takes reasonable measures to regularly identify and assess all reasonably foreseeable internal and external risks to Personal Data in its possession or under its control and implements reasonable and appropriate technical, physical and organisational security measures to protect against the identified risks. 

How does MTN Ghana handle Personal Data Breaches?

If MTN Ghana becomes aware of or reasonably suspects a Personal Data Breach has occurred or that the integrity or confidentiality of Personal Data has been compromised, MTN Ghana will activate its incident management Policies, Procedures and supporting actions governing the handling and reporting of Personal Data Breaches. 

What are my rights?

The following are how you can exercise your rights, if MTN Ghana is processing your Personal Data:

—	Access and correction: you have the right to access the Personal Data retained by MTN Ghana. This is sometimes called a ‘Data Subject Access Request’. To make this request as an individual or an authorised third party, visit our Customer Experience Centres or alternatively, you can contact our Customer Services  team should you require further details on how to do this.
—	Right to correct personal data: You have the right to correct information held about you if it is not accurate. If the information we hold about you is inaccurate or needs to be updated, you can visit our Customer Experience Centres or contact our Customer Services team should you require further details on how to do this.
—	Object to Processing: you have the right to object to us Processing your Personal Data, on grounds relating to your situation, under certain circumstances (including to receiving direct marketing from us). For example, if we are Processing your Personal Data on the basis that is necessary for purposes of our or a third party’s legitimate interest or in the public interest. You may also object if you believe there is no legal basis for us to Process your Personal Data anymore. Please contact our Customer Services team for more information or to exercise this right.
—	Withhold consent: you have the right to withhold your consent without any fear of negative repercussions in

circumstances that we seek your consent to Process your Personal Data.  

—	Withdraw consent: you also have the right to withdraw your consent at any time and we cease processing your Personal Data unless there is an alternative legal basis to continue Processing your Personal Data. We will advise you if we intend to continue processing your Personal Data in these circumstances.
—	Disposal / Restrictions: in addition, you may have rights to have your information deleted / destroyed if we are keeping it too long or have no legal basis to process it. We may still have other lawful grounds to process your personal data.
—	Right to restrict use of your data: You may also request that the Processing of your Personal Data is restricted in certain circumstances. We may still have other lawful grounds to process your personal data.

How to Contact Us

If you have any requests or questions about our privacy policy or practices, please submit your query to MTN Ghana at data.privacy.gh@mtn.com. We will take all reasonable steps to address your request, if it is consistent with the Data Protection Act, 2012 (Act 843) and other applicable laws and internal policies.

If you feel that your questions or concerns have not been adequately dealt with or feel uncomfortable raising them with the local Data Privacy Office, you may contact Groupdataprivacy@mtn.com   

Finally, you always have the right to contact the Ghana Data Protection Commission whose contact details are:  

— [Postal Address: East Legon, Pawpaw Street, GPS: GA-414-1469, P.O. Box CT7195, Accra] 

— [Email Address: info@dataprotection.org.gh ]

— [Telephone number: +233256301533]

— [Website: www.dataprotection.org.gh ]

Changes to Privacy Policy MTN Ghana may modify this Privacy Notice from time to time to reflect our current privacy practices. When we make changes to this notice, we will revise the “effective” date at the top of this notice and any changes affecting you will be communicated to you through an appropriate channel, depending on how we normally communicate with you