Ventrix Platform Privacy Policy

Effective Date: July 21, 2026
Document Version: 1.0.0
Scope: Platform Data Protection & Compliance with Ghana Data Protection Act (Act 843)

---

1. Statutory Compliance & Controller Identity

1.1. Data Controller: Ventrix acts as the Data Controller for merchant registration records and as a Data Processor for customer transactions processed through Merchant Storefronts under the Data Protection Act, 2012 (Act 843) of Ghana.

---

2. Information We Collect

2.1. Merchant & Account Information: Business name, registration numbers, tax IDs, owner full name, email address, phone number, settlement bank details, and staff user profiles.

2.2. Transaction & POS Data: Order histories, item descriptions, sale totals, payment method categories, delivery addresses, and customer phone numbers.

2.3. Technical Audit Logs: IP addresses, browser types, operating systems, device hardware UUIDs (for POS devices), IndexedDB sync timestamps, and API access logs.

---

3. Purpose & Legal Basis of Processing

3.1. Service Provision: To operate the POS system, process transactions, host storefronts, and manage merchant subscription accounts.

3.2. Financial Auditing: To comply with statutory tax reporting and financial record-keeping mandates.

3.3. Fraud Prevention: To detect fraudulent transactions, unauthorized account access, and illegal marketplace activities.

---

4. Mandatory Data Retention Schedule

4.1. Financial & Order Records: All financial, transaction, payout, and invoice records are retained for 7 years in compliance with Ghana Revenue Authority (GRA) guidelines and international accounting standards.

4.2. Account Profiles: Retained for the duration of the active subscription plus 12 months post-cancellation, after which non-financial data is anonymized.

---

5. Data Sharing & Third-Party Infrastructure

5.1. Payment Processors: Payment card and Mobile Money data are processed directly via PCI-DSS compliant infrastructure (Paystack, Hubtel). Ventrix never stores raw payment card numbers or MoMo PINs.

5.2. Cloud Infrastructure: Data is securely hosted on enterprise cloud databases (Supabase, AWS S3) with AES-256 encryption at rest and TLS 1.3 encryption in transit.

---

6. Security Safeguards

6.1. Cryptographic Protection: Sensitive account tokens and delivery verification secrets are stored using salted SHA-256 password hashing protocols.

---

7. Data Subject Rights

7.1. Rights under Act 843: Users possess the right to:

• Access a copy of their personal data processed by Ventrix.
• Request rectification of inaccurate or outdated personal records.
• Object to direct marketing communications.
• Submit inquiries or privacy complaints to privacy@ventryman.com.