Privacy Policy

1. Data Controller Identity

The data controller responsible for your personal data is:

For any data protection enquiries, please contact us using the details above and mark your correspondence "Data Protection — Private & Confidential."

2. Personal Data We Collect

We collect only the personal data necessary to deliver our services. This may include:

3. Legal Basis for Processing

Under the Ghana Data Protection Act, we process your personal data on the following lawful bases:

• Contractual Necessity: Processing required to fulfil your booking and deliver accommodation services.
• Legal Obligation: Processing required to comply with Ghanaian law, including tax regulations, anti-money laundering requirements, and tourism regulations.
• Legitimate Interests: Processing necessary for our legitimate business interests, including security monitoring, fraud prevention, debt recovery, and service improvement — provided these interests do not override your fundamental rights.
• Consent: Where we rely on consent (e.g., marketing communications), you may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

4. How We Use Your Personal Data

Your data is used for the following purposes:

• Processing, confirming, and managing your accommodation reservations
• Sending booking confirmations, reminders, and operational notifications
• Processing payments, issuing invoices and receipts
• Verifying your identity at check-in as required by law
• Communicating with you about your stay or enquiries
• Maintaining records for financial, tax, and regulatory compliance
• Preventing fraud, unauthorized access, and property damage
• Security monitoring and incident response
• Improving our services and platform performance
• Enforcing our Terms & Conditions and recovering outstanding debts
• Sending marketing communications (only where you have consented)

We will not use your data for any purpose that is incompatible with the purposes for which it was originally collected without your explicit consent.

5. Sharing & Disclosure of Personal Data

We do not sell your personal data. We may share it only in the following circumstances:

• Service Providers: Trusted third-party service providers who process data on our behalf (e.g., SMS/communication platforms, payment processors, cloud hosting). These providers are contractually bound to handle data securely and only for authorised purposes.
• Legal Requirements: Where we are compelled by law, court order, regulatory authority, or law enforcement in Ghana to disclose data. We will notify you where legally permitted to do so.
• Fraud Prevention & Security: Where disclosure is necessary to protect the rights, property, or safety of Hebron Apartments, our guests, staff, or the public.
• Business Transfers: In the event of a sale, merger, or acquisition of Hebron Apartments, your data may be transferred as part of the business assets, subject to the same privacy protections.
• Your Consent: Any other sharing requires your express prior consent.

6. International Data Transfers

Some of our technology providers (including cloud infrastructure and communication services) may be located outside Ghana. Where data is transferred internationally, we ensure adequate safeguards are in place in compliance with Act 843, including contractual data processing agreements and security standards appropriate to the sensitivity of the data transferred.

7. Data Security

Security measures include:

• Encrypted data transmission (HTTPS/TLS)
• Role-based access controls limiting staff access to data on a need-to-know basis
• Multi-factor authentication for administrative system access
• Regular security audits and monitoring for unauthorised access
• Incident response procedures for data breach scenarios

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the Data Protection Commission of Ghana within 72 hours of becoming aware of the breach, in accordance with Act 843.

8. Data Retention

We retain personal data only for as long as necessary for the stated purposes or as required by law:

After the applicable retention period, data is securely deleted or anonymised so it can no longer be linked to you.

9. Your Data Subject Rights

Under the Ghana Data Protection Act, 2012, you have the following rights:

To exercise any of these rights, contact us in writing at Hebronmallapertment@gmail.com. We will respond within 30 days. We may require you to verify your identity before processing your request.

To lodge a complaint with the Data Protection Commission of Ghana, visit: dataprotection.org.gh

10. Cookies & Tracking Technologies

Our online platform may use cookies and similar technologies to:

• Maintain your login session and preferences
• Analyse how the platform is used (analytics)
• Prevent fraud and improve security

Essential cookies necessary for the platform to function are placed automatically. You may disable non-essential cookies through your browser settings. Disabling essential cookies may impair platform functionality.

11. Third-Party Links & Services

Our platforms may contain links to external websites or services (e.g., payment providers, social media). Hebron Apartments is not responsible for the privacy practices or content of those third parties. We recommend reviewing the privacy policies of any third-party services you access.

12. Automated Decision-Making

We do not use fully automated decision-making (including profiling) that produces legal or similarly significant effects on individuals. Where any automated processing is used (e.g., fraud flagging), human review is available upon request.

13. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. Updates will be posted on this page with a revised effective date. We will notify existing users of material changes via SMS or email where practicable. Your continued use of our services after the effective date constitutes acceptance of the updated policy.

14. Contact & How to Raise a Privacy Concern

If you have any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us: