KUTE GHANA (“KUTE”, “we”, “us”, “our”) is an e-commerce marketplace designed to facilitate transactions between buyers and sellers of goods and services.

This Privacy Policy explains how KUTE collects, receives, uses, stores, discloses, protects and otherwise processes personal information obtained through the KUTE website, mobile application, marketplace, social-media channels, customer-support services and other related services (collectively, the “Platform”).

KUTE is committed to protecting the privacy and security of personal data in accordance with the laws of the Republic of Ghana, including the Data Protection Act, 2012 (Act 843), the Electronic Transactions Act, 2008 (Act 772), the Cybersecurity Act, 2020 (Act 1038) and other applicable laws and regulations.

The Data Protection Act regulates the collection, use, disclosure and care of personal data in Ghana.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. Where consent is legally required, KUTE will obtain such consent before processing the relevant personal data.

For purposes of this Privacy Policy:

KUTE may collect information necessary to operate, secure and improve the Platform, including:

3.1 Account Information

This may include:

• Full name;
• Username;
• Telephone number;
• Email address;
• Password or authentication information;
• Date of birth where necessary;
• Profile photograph;
• Business name and business information;
• Seller verification information.

3.2 Transaction Information

Where applicable, KUTE may collect:

• Products purchased or listed;
• Order information;
• Delivery information;
• Transaction history;
• Payment status;
• Refund information;
• Seller commission information;
• Customer-service records.

KUTE may use third-party payment providers. KUTE will not intentionally retain sensitive payment credentials, such as full card security codes, where such information is processed directly by an authorised payment provider.

3.3 Identity and Verification Information

For certain transactions, seller verification, fraud prevention, regulatory compliance or other legitimate purposes, KUTE may request information such as:

• Ghana Card or other identification information;
• Business registration information;
• Tax or business information;
• Proof of address;
• Verification documents;
• Information reasonably necessary to establish the identity or legitimacy of a Seller.

KUTE will only collect such information where reasonably necessary for a legitimate and lawful purpose.

3.4 Technical Information

When you access the Platform, KUTE may automatically collect information such as:

• IP address;
• Device type;
• Browser type;
• Operating system;
• Device identifiers;
• Login information;
• Approximate location information;
• Pages or products viewed;
• Date and time of access;
• Error and diagnostic information;
• Security and fraud-prevention information.

3.5 Communications

KUTE may retain communications between Users and KUTE, including customer-service enquiries, complaints, reports, disputes and other correspondence.

KUTE may process personal data for the following purposes:

1. Creating and managing User accounts;
2. Facilitating purchases and sales;
3. Processing and confirming orders;
4. Facilitating payments, refunds and commissions;
5. Arranging delivery and logistics;
6. Communicating with Users;
7. Providing customer support;
8. Verifying Sellers and preventing fraudulent accounts;
9. Detecting and preventing fraud, scams, abuse and unlawful activity;
10. Protecting the security and integrity of the Platform;
11. Resolving disputes;
12. Enforcing KUTE’s Terms and Conditions;
13. Improving products, services and Platform functionality;
14. Conducting analytics and market research;
15. Sending marketing communications where permitted by law;
16. Complying with legal, regulatory, tax, accounting and law-enforcement requirements; and
17. Protecting KUTE’s legal rights, property and legitimate business interests.

The Electronic Transactions Act requires electronic suppliers to provide consumers with information concerning security procedures and privacy practices relating to payment and personal information.

KUTE shall process personal data only where permitted by applicable Ghanaian law.

Depending on the circumstances, processing may be based on:

• The consent of the Data Subject;
• The necessity to perform or administer a contract;
• Compliance with a legal obligation;
• Protection of the legitimate interests of KUTE or another party, where permitted by law;
• Protection of the rights, property or security of KUTE, Users or third parties; or
• Another lawful basis recognised under Ghanaian law.

Where KUTE relies on consent, the Data Subject may withdraw that consent subject to applicable legal limitations and the consequences of withdrawal.

KUTE shall endeavour to process personal data in accordance with the applicable principles of the Data Protection Act, including requirements relating to:

• Lawfulness and fairness;
• Purpose specification;
• Data minimisation;
• Accuracy;
• Openness and transparency;
• Security safeguards;
• Data-subject participation; and
• Appropriate retention and disposal.

The Data Protection Commission identifies purpose limitation, openness, security safeguards and data-subject participation among the core compliance principles.

KUTE shall not sell a User’s personal data merely for commercial exploitation.

However, KUTE may disclose personal data where reasonably necessary to operate the Platform or where legally permitted or required.

7.1 Sellers and Buyers

Where necessary to complete a transaction, KUTE may disclose relevant information between the parties.

For example, delivery information may be provided to a Seller or logistics provider where necessary to fulfil an order.

7.2 Payment Service Providers

Information may be shared with banks, mobile-money operators, payment processors and other authorised payment providers.

7.3 Logistics Providers

Relevant delivery information may be disclosed to courier, shipping and logistics providers.

7.4 Technology and Service Providers

KUTE may engage third-party providers for:

• Cloud hosting;
• Data storage;
• Cybersecurity;
• Analytics;
• Customer support;
• Communication services;
• Fraud detection;
• Identity verification; and
• Platform maintenance.

Such parties may only process information in accordance with applicable law and their contractual obligations.

7.5 Government and Law-Enforcement Authorities

KUTE may disclose information where required by law, court order, lawful governmental request, regulatory requirement or where reasonably necessary to investigate fraud, crime, cybersecurity incidents or threats to persons or property.

KUTE operates as an online marketplace connecting Buyers and Sellers.

A Seller may independently collect and process information from Buyers in connection with a transaction. Sellers are responsible for complying with applicable data-protection, consumer-protection, tax, business and other legal obligations applicable to their activities.

Sellers shall:

• Collect only information reasonably necessary for their transactions;
• Keep Buyer information confidential;
• Use Buyer information only for lawful purposes;
• Not sell or unlawfully disclose Buyer information;
• Implement reasonable security safeguards;
• Not use Buyer information for unsolicited marketing without an appropriate lawful basis; and
• Delete or securely dispose of personal information when it is no longer lawfully required.

KUTE may suspend, restrict or terminate Sellers who misuse personal information or violate applicable law or KUTE’s policies.

KUTE may use cookies, pixels, device identifiers and similar technologies to:

• Keep Users logged in;
• Remember preferences;
• Improve Platform functionality;
• Analyse traffic and usage;
• Personalise content;
• Detect fraud and security threats; and
• Measure advertising and marketing performance.

Users may be able to control cookies through their device or browser settings. Disabling certain cookies may affect Platform functionality.

KUTE may send Users transactional communications necessary to operate their accounts and complete transactions.

Where required by law, KUTE will obtain appropriate consent before sending promotional communications.

Users may unsubscribe from marketing communications through the available unsubscribe mechanism or by contacting KUTE.

Withdrawal from marketing communications does not necessarily stop essential service communications relating to an account, transaction, security matter or legal obligation.

KUTE shall implement reasonable technical, physical and organisational safeguards designed to protect personal data against:

• Unauthorised access;
• Unauthorised disclosure;
• Loss;
• Theft;
• Destruction;
• Alteration;
• Misuse; and
• Unlawful processing.

Such measures may include access controls, authentication mechanisms, encryption where appropriate, monitoring, secure storage and internal security procedures.

The Cybersecurity Act, 2020 (Act 1038) establishes Ghana’s cybersecurity regulatory framework and the Cyber Security Authority.

However, no electronic transmission, storage system or internet service can be guaranteed to be completely secure.

Accordingly, KUTE does not warrant that personal data transmitted through the internet will be immune from every possible security threat, unauthorised access, cyberattack, malware, interception or other event beyond KUTE’s reasonable control.

Where KUTE becomes aware of a security incident involving personal data, KUTE shall take reasonable steps to:

1. Investigate the incident;
2. Contain and mitigate its effects;
3. Secure affected systems;
4. Assess the nature and extent of the incident;
5. Take appropriate remedial measures; and
6. Notify relevant authorities and affected Data Subjects where required by applicable law.

Users shall immediately notify KUTE of suspected unauthorised access, account compromise, fraud or other security incidents.

KUTE shall retain personal data only for as long as reasonably necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.

Information may be retained for purposes including:

• Legal and regulatory compliance;
• Accounting and tax requirements;
• Fraud prevention;
• Dispute resolution;
• Enforcement of agreements;
• Record-keeping;
• Security investigations; and
• Protection of KUTE’s legal rights.

When personal data is no longer required, KUTE may delete, anonymise or securely dispose of it in accordance with applicable law and its internal retention procedures.

KUTE may use service providers or technology infrastructure located outside Ghana.

Where personal data is transferred outside Ghana, KUTE shall take reasonable steps to ensure that such transfers are conducted in accordance with applicable Ghanaian data-protection requirements and appropriate safeguards.

Where required, KUTE may obtain consent, implement contractual safeguards or adopt another legally recognised mechanism before transferring personal data internationally.

Subject to applicable law, a Data Subject may have rights including:

• The right to be informed about the processing of personal data;
• The right to access personal data;
• The right to request correction of inaccurate information;
• The right to object to certain processing;
• The right to request deletion where legally applicable;
• The right to withdraw consent where processing is based on consent; and
• Other rights provided under Ghanaian law.

The Data Protection Commission confirms that Data Subject rights under Act 843 include rights relating to access and objection.

Requests may be subject to identity verification and applicable legal limitations.

KUTE may decline a request where permitted or required by law, including where fulfilling the request would prejudice legal proceedings, fraud investigations, regulatory obligations or the rights of another person.

Users are responsible for ensuring that information provided to KUTE is accurate, complete and current.

KUTE may rely on information supplied by Users and shall not be responsible for losses resulting solely from inaccurate, incomplete or misleading information provided by a User.

Users should promptly update their account information when circumstances change.

KUTE is not intended to facilitate unlawful transactions involving children or persons who lack legal capacity to enter into applicable agreements.

Where KUTE becomes aware that personal data has been collected unlawfully from a child or other protected person, KUTE may take reasonable steps to delete or restrict such information, subject to applicable law.

Parents or lawful guardians may contact KUTE regarding concerns relating to a child’s personal information.

The Platform may contain links to third-party websites, payment platforms, social-media services, advertisements or other external services.

KUTE does not control the privacy practices, security, content or policies of third parties.

A User’s interaction with a third-party service is governed by that third party’s applicable terms and privacy policy.

KUTE shall not be responsible for the privacy practices or security failures of independent third parties except to the extent liability cannot lawfully be excluded.

KUTE reserves the right to monitor Platform activity and process information reasonably necessary to detect, investigate and prevent:

• Fraud;
• Money laundering;
• Identity theft;
• Account abuse;
• Fake accounts;
• Scams;
• Cyberattacks;
• Unauthorised transactions;
• Intellectual-property violations;
• Illegal activities; and
• Breaches of KUTE’s Terms and Conditions.

KUTE may suspend, restrict or terminate an account where reasonably necessary to protect Users, KUTE or the integrity of the Platform.

Where appropriate, KUTE may provide relevant information to law-enforcement or regulatory authorities.

KUTE is an e-commerce marketplace and, unless expressly stated otherwise, does not own, manufacture, inspect, possess, control or independently verify every product offered by independent Sellers.

Accordingly, information, descriptions, photographs, prices, warranties, representations and claims relating to products may originate from Sellers.

KUTE shall take reasonable measures to maintain marketplace integrity but does not guarantee the authenticity, quality, safety, legality, availability or suitability of every product or Seller.

Nothing in this Privacy Policy excludes or limits any liability that cannot lawfully be excluded or limited under Ghanaian law.

The Electronic Transactions Act imposes specific disclosure requirements on suppliers, including information concerning the supplier, product characteristics, pricing, payment, delivery, returns, dispute resolution and privacy/security.

To the maximum extent permitted by applicable law, KUTE shall not be liable for loss, damage, unauthorised disclosure or misuse of personal information arising solely from:

• Information voluntarily disclosed by a User to another User;
• A User’s failure to maintain account credentials securely;
• Fraudulent or negligent conduct of a User;
• Third-party systems or service providers outside KUTE’s reasonable control;
• Telecommunications or internet failures;
• Malware, cyberattacks or security incidents that could not reasonably have been prevented despite appropriate safeguards;
• Information supplied inaccurately by a User;
• A Seller’s independent processing or misuse of Buyer information; or
• Unlawful acts committed by independent third parties.

This clause shall not exclude, restrict or limit liability to the extent such exclusion, restriction or limitation is prohibited by Ghanaian law.

Users are responsible for maintaining the confidentiality of their passwords, PINs, authentication credentials and other account-security information.

Users must not:

• Share account credentials with unauthorised persons;
• Permit unauthorised access to their account;
• Attempt to access another person’s account;
• Circumvent KUTE security controls; or
• Use the Platform for fraudulent or unlawful purposes.

KUTE shall not be responsible for unauthorised transactions or access resulting from a User’s failure to reasonably protect their credentials, except where liability arises from KUTE’s own legally actionable failure.

KUTE may disclose personal information without additional consent where disclosure is required or permitted by applicable law.

This may include disclosures pursuant to:

• Court orders;
• Regulatory requirements;
• Law-enforcement requests;
• Tax obligations;
• Fraud investigations;
• Cybersecurity investigations;
• Anti-money-laundering requirements;
• Dispute resolution proceedings; or
• Protection of the rights, safety or property of KUTE or another person.

KUTE may amend this Privacy Policy from time to time to reflect:

• Changes in applicable law;
• Changes to the Platform;
• New products or services;
• Changes in data-processing practices;
• Security developments; or
• Regulatory requirements.

The updated version shall be published through the Platform with a revised “Last Updated” date.

Where required by law, KUTE shall provide additional notice or obtain consent before implementing material changes.

If any provision of this Privacy Policy is determined by a competent authority or court to be invalid, unlawful or unenforceable, that provision shall be interpreted or modified to the minimum extent necessary to make it lawful and enforceable.

The invalidity or unenforceability of one provision shall not affect the validity of the remaining provisions.

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of Ghana.

Any dispute arising from or relating to this Privacy Policy shall be subject to the jurisdiction of the competent courts of Ghana, unless otherwise required by applicable law or agreed through a valid alternative dispute-resolution mechanism.