1. Introduction
LINK EXCHANGE MICRO-CREDIT LIMITED (“we”, “us”, “our” or the “Company”) is committed to protecting the privacy and security of personal information entrusted to us by our customers. This Privacy Policy explains how we collect, use, disclose, store, protect and otherwise process personal information when you use the LEL Payroll mobile application, website, digital platforms and related lending services (collectively, the “Services”). The Services are designed primarily to provide digital credit facilities to eligible employees whose remuneration is administered through the Controller and Accountant-General’s Department (CAGD).
This Privacy Policy applies to customers who access or use our Services through the Apple App Store, Google Play Store, our website or other authorised digital channels. We process personal information in accordance with applicable laws and regulatory requirements of the Republic of Ghana, including the Data Protection Act, 2012 (Act 843), applicable Bank of Ghana requirements, applicable anti-money laundering and counter-terrorist financing requirements, and relevant cybersecurity and electronic transactions legislation. The Company will also comply with applicable requirements imposed by Apple and Google relating to the collection, use, disclosure, security and deletion of personal and sensitive user information.
2. Who We Are
The data controller responsible for your personal information is:
LINK EXCHANGE MICRO-CREDIT LIMITED
Registered Address: 414/4 Newtown Road, Kokomlemle, Accra, Ghana.
Digital Address: GA-070-7547
Telephone: +233 (0) 202 228080 / +233 (0) 501 282043
Email: info@linkexchange.com.gh
Website: https://linkexchange.com.gh/
Data Protection Commission Registration Number: C0002925478. The Company is registered with
Ghana’s Data Protection Commission as a data controller in accordance with the Data Protection
Act, 2012 (Act 843).Where third-party service providers process personal information on our behalf, we require them
to process such information in accordance with applicable data protection requirements and our
contractual instructions.
3. Information We Collect
Depending on the Services you use, we may collect the following categories of information.
3.1 Identification and Personal Information
We may collect:
- Full name;
- Date of birth;
- Gender;
- Ghana Card or other approved identification details;
- National identification number;
- Photograph or identity verification information;
- Residential and postal address;
- Digital address;
- Telephone number;
- Email address;
- Guarantor contact information;
- Signature or electronic signature; and
- Other information reasonably required to establish and verify your identity.
3.2 Employment and Payroll Information
Because the Services are intended for eligible government employees, we may collect and process employment-related information, including:
- Employer or government institution;
- Ministry, Department or Agency;
- Staff or employee identification number;
- Employment status;
- Position or grade;
- Date of employment;
- Salary information;
- Net and gross salary;
- Allowances;
- Social security number, where applicable;
- Payroll information;• Statutory deductions;
- Existing deductions or obligations;
- Salary payment information;
- Information necessary to verify eligibility for a loan; and
- Information required to facilitate repayment through an approved salary deduction or other authorised repayment mechanism.
Where payroll information is obtained from CAGD, an employer, an authorised payroll platform or another authorised source, we will only access and process information that is necessary for legitimate lending, verification, repayment, compliance and related purposes.
3.3 Financial and Credit Information
We may collect:
- Bank account details;
- Mobile money account details;
- Payment information;
- Loan application information;
- Existing loans and financial obligations;
- Repayment history;
- Credit history and credit score;
- Credit bureau information;
- Income and expenditure information;
- Information relating to previous applications;
- Loan balances and repayment status; and
- Information concerning suspected fraudulent transactions.
Where permitted by law, we may obtain information from licensed credit reference bureaux and other authorised sources for credit assessment and responsible lending purposes. The Bank of
Ghana maintains a list of licensed credit bureaux in Ghana.
3.4 Information Collected Through the Application
Depending on the functionality of the App, we may collect:
- Device information;
- IP address;
- Device type and operating system;
- Application version;
- Mobile network information;
- Unique application identifiers;• Login information;
- Authentication information;
- Transaction information;
- Application usage information;
- Error logs;
- Security and fraud indicators; and
- Information relating to interactions with the App.
We will not access contacts, photographs, SMS messages, call logs, microphone, camera, location or other sensitive device information unless such access is necessary, lawfully permitted, clearly disclosed and supported by the relevant App functionality and user permission. We do not sell customers’ contact lists or use a customer’s contacts to conduct debt collection. For the avoidance of doubt, we do not access, read or extract the contact list, photo gallery, SMS messages or call logs stored on your device. Where guarantor contact information is collected (see Section 3.1), this is provided directly by you through the App’s application form and is not obtained through access to your device’s contact list. Biometric Information: If the App offers fingerprint or facial-recognition login, authentication is performed using your device’s built-in biometric system. We do not collect, view or store your underlying biometric data (such as your fingerprint image or facial map); this remains on your device and is not transmitted to us. Where any biometric-derived data is processed by us, it will be treated as sensitive personal data under the Data Protection Act, 2012 (Act 843) and processed only with your explicit consent.
4. How We Collect Information
We may collect personal information:
- Directly from you when you register or apply for a loan;
- When you complete forms or provide information through the App;
- From your employer or authorised payroll source, where permitted;
- From CAGD or an authorised CAGD-related platform, where applicable and lawfully authorised;
- From banks, payment service providers and mobile money operators;
- From licensed credit reference bureaux;
- From identity verification and fraud prevention service providers;
- From government or regulatory authorities where legally permitted or required;
- Automatically from your use of the App; and
- From other lawful sources necessary for the provision and administration of the Services.
5. Purposes for Which We Use Your Information
We may process your personal information for the following purposes:
5.1 Loan Application and Credit Assessment
- We use your information to:
- Verify your identity;
- Confirm your employment status;
- Confirm eligibility for our products;
- Assess your ability to repay;
- Conduct credit assessments;
- Determine appropriate loan limits and repayment periods;
- Verify salary and payroll information;
- Detect potentially fraudulent applications; and
- Make responsible lending decisions.
5.2 Loan Administration
We use information to:
- Disburse approved loans;
- Calculate interest, fees and other applicable charges;
- Process repayments;
- Monitor loan accounts;
- Send repayment reminders;
- Provide account statements;
- Manage arrears;
- Process restructuring or other approved arrangements; and
- Provide customer support.
5.3 Payroll or Salary-Based Repayment
Where the customer has expressly authorised a salary deduction, payroll deduction or other approved repayment mechanism, we may process information necessary to establish, administer, reconcile and monitor such repayments.
Any interaction with CAGD, an employer, payroll administrator, bank or other third party will be limited to information and purposes authorised by law, contract and applicable regulatory requirements.5.4
5.4 Regulatory and Legal Compliance
We may process information to:
- Comply with Bank of Ghana requirements;
- Meet AML/CFT obligations;
- Conduct customer due diligence;
- Perform sanctions and watchlist screening;
- Prevent and investigate fraud;
- Respond to lawful requests from regulators, law enforcement agencies and courts;
- Meet accounting, audit and reporting obligations; and
- Establish, exercise or defend legal claims.
5.5 Security and Fraud Prevention
We may use personal and technical information to identify suspicious activity, prevent unauthorised access, detect fraud, protect customer accounts and maintain the security of our
systems.
5.6 Service Improvement
We may use aggregated or appropriately de-identified information to:
- Improve the App;
- Monitor system performance;
- Analyse usage trends;
- Identify technical problems; and
- Develop and improve our products and services.
We will not use personal information for unrelated purposes without a lawful basis and, where required, appropriate customer consent.
6. Legal Basis for Processing
We process personal information on one or more lawful grounds permitted under applicable
Ghanaian data protection law, including where:
- You have provided consent;
- Processing is necessary to perform a contract with you;
- Processing is necessary to take steps at your request before entering into a contract;
- Processing is necessary to comply with a legal or regulatory obligation;
- Processing is necessary for legitimate business purposes, provided that such interests do not override your legally protected rights; or
- Processing is otherwise authorised or required by applicable law.
Where we rely on consent, you may withdraw that consent subject to applicable legal and contractual limitations.
Withdrawal of consent will not affect processing already undertaken lawfully before the withdrawal.
7. Credit Reference and Credit Information
As part of our responsible lending and credit risk management processes, we may obtain, verify, submit and exchange credit information with licensed credit reference bureaux and other authorised credit information providers, where permitted by law.
This may include information about:
- Loan applications;
- Existing credit facilities;
- Repayment history;
- Outstanding balances;
- Defaults;
- Credit enquiries; and
- Other information relevant to credit assessment.
Information provided to credit reference bureaux may form part of your credit profile and may be accessed by authorised financial institutions and other entities for legitimate purposes permitted by law.
8. Sharing of Personal Information
We do not sell or rent customers’ personal information.
We may disclose personal information to the following categories of recipients where necessary, lawful and proportionate:
8.1 CAGD and Government Institutions
Where applicable and properly authorised, we may share information with CAGD, relevant government institutions, payroll administrators or an employee’s authorised employer for purposes including:
- Verification of employment;
- Verification of remuneration;
- Loan eligibility;
- Administration of authorised salary deductions;
- Reconciliation of repayments; and
- Regulatory or legal compliance.8.2 Financial and Payment Service Providers
8.2 We may share relevant information with:
- Banks;
- Payment service providers;
- Mobile money operators;
- Payment processors; and
- Other authorised financial institutions,
where necessary to disburse loans, process repayments or provide related services.
8.3 Credit Reference Bureaux
We may share and obtain credit information from licensed credit reference bureaux as permitted by law.
8.4 Technology and Service Providers
We may engage carefully selected third parties to provide services such as:
- Cloud hosting;
- Identity verification;
- Credit scoring;
- Fraud detection;
- Cybersecurity;
- Customer communication;
- SMS and email delivery;
- Payment processing;
- Application maintenance;
- Analytics; and
- Customer support.
Such providers will be required to implement appropriate confidentiality and security safeguards.
8.5 Regulators and Government Authorities
We may disclose information where required or permitted by law to the Bank of Ghana, Data Protection Commission, Financial Intelligence Centre, Cyber Security Authority, courts, law enforcement agencies, tax authorities or other competent authorities.
The Bank of Ghana’s current digital credit framework specifically identifies areas such as data protection, ICT risk management, AML/CFT, consumer protection and business continuity as important elements of digital credit operations.
9. International Transfers
Where personal information is transferred outside Ghana, we will take reasonable and legally required steps to ensure that the information receives an appropriate level of protection.
This may include contractual safeguards, security measures, due diligence on service providers and any required regulatory or legal approvals.
10. Data Security
We implement reasonable technical, organisational and administrative safeguards to protect personal information against:
- Unauthorised access;
- Loss;
- Theft;
- Accidental destruction;
- Alteration;
- Unauthorised disclosure;
- Cyberattacks; and
- Other unlawful processing.
Security measures may include:
- Encryption;
- Secure authentication;
- Access controls;
- Role-based permissions;
- Multi-factor authentication where appropriate;
- Audit logs;
- Network security controls;
- Vulnerability assessments;
- Penetration testing;
- Security monitoring;
- Secure software development practices;
- Employee confidentiality obligations; and
- Incident response and business continuity procedures.
The Company will periodically review and improve its security controls in response to technological developments and emerging threats.
11. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including:
- Providing and administering the Services;
- Managing outstanding loans;
- Meeting contractual obligations;
- Resolving disputes;
- Preventing and investigating fraud;
- Complying with regulatory and legal obligations;
- Meeting accounting and audit requirements; and
- Establishing, exercising or defending legal claims.
Where information is no longer required, we will securely delete, anonymise or otherwise dispose of it in accordance with applicable law and our records-retention requirements.
As a general guide, and unless a longer period is required by law or regulation, we retain customer due diligence and loan account records for a minimum of six (6) years following the closure or full repayment of the relevant loan account, consistent with applicable anti-money laundering and Bank of Ghana record-keeping requirements.
12. Account Deletion
You may also initiate deletion of your account directly within the App, via the Settings/Profile menu, without needing to contact customer support. Self-service in-app deletion requests are processed subject to the same conditions set out below.
Customers may request deletion of their account and personal information by contacting us through:
Email: info@linkexchange.com.gh
Telephone: +233 (0) 202 228080 / +233 (0) 501 282043
Requests for deletion will be assessed in accordance with applicable law.
Please note that we may be required to retain certain information for a specified period because of legal, regulatory, accounting, fraud prevention, dispute resolution or loan-recovery obligations.
Where information must be retained, we will restrict its use to the purpose for which retention is required.
13. Customer Rights
Subject to applicable Ghanaian law, customers may have rights including the right to:
- Be informed about how personal information is processed;
- Request access to personal information held about them;
- Request correction of inaccurate or incomplete information;
- Request deletion of information where legally applicable;
- Object to certain forms of processing;
- Withdraw consent where processing is based on consent;
- Request restriction of processing where applicable;
- Raise concerns about unlawful or improper processing; and
- Lodge a complaint with the relevant data protection authority.
Requests should be submitted to:
Link Exchange Micro-Credit Limited
414/4 Newtown Road, Kokomlemle, Accra, Ghana.
Email: info@linkexchange.com.gh
Telephone: +233 (0) 202 228080 / +233 (0) 501 282043
We may need to verify your identity before processing a request.
14. Automated Decision-Making and Credit Scoring
Our lending process may use automated systems, rules, algorithms or credit-scoring tools to assist in assessing loan applications.
These systems may consider information such as:
- Income;
- Employment information;
- Existing obligations;
- Credit history;
- Repayment behaviour;
- Loan amount requested; and
- Other lawful credit-risk indicators.
Where required by applicable law, we will provide appropriate information regarding automated decision-making and applicable avenues for review or complaint.
The use of automated decision-making does not remove our responsibility to maintain appropriate credit, consumer protection, governance and oversight controls.
15. Marketing and Promotional Communications
We may send service-related communications that are necessary for the administration of your account, including:
- Loan approval notifications;
- Disbursement notifications;
- Repayment reminders;
- Account statements;
- Security alerts;
- Service announcements; and
- Important regulatory or contractual notices.
Where required, we will obtain consent before sending promotional or marketing communications.
You may opt out of marketing communications through the method provided in the communication or by contacting us.
Opting out of marketing communications will not prevent us from sending essential service, security, loan administration or legally required communications.
16. Cookies and Similar Technologies
Where our website or App uses cookies, SDKs, analytics tools or similar technologies, these technologies may collect information concerning device usage, performance and interaction with
our Services.
We will disclose material third-party SDKs and relevant data practices in accordance with applicable law and App Store requirements.
You can manage or disable cookies through your browser or device settings; disabling certain cookies or SDKs may affect the functionality of our website or App. A current list of the material third-party SDKs used in the App and their data practices is available on request and will be published on our website.
17. Third-Party Applications and Links
Our Services may contain links or integrations with third-party websites, payment platforms, banks, mobile money services or other applications.
We are not responsible for the privacy practices of third-party services that we do not control.
Customers should review the privacy policies of relevant third parties before providing information through those services.
18. Children’s Privacy
The Services are intended for adults who are legally eligible to enter into credit agreements, and in any event must be at least 18 years old.
We do not knowingly provide loans to children or knowingly collect personal information from children for the purpose of providing credit.
If we become aware that personal information relating to a child has been collected improperly, we will take appropriate steps to address the situation.
19. Complaints and Data Protection Concerns
We encourage customers to contact us first if they have concerns regarding the handling of their
personal information.
Complaints may be submitted using:
Email: info@linkexchange.com.gh
Telephone: +233 (0) 202 228080 / +233 (0) 501 282043
Postal Address: P.O. BOX CT2004, Cantonments, Accra, Ghana.
We will acknowledge and investigate complaints in accordance with our internal complaint-handling procedures and applicable regulatory requirements.
Where a customer is dissatisfied with our response, the customer may exercise any right available under applicable Ghanaian data protection and financial services legislation, including contactingthe relevant regulatory authority.
This includes the right to lodge a complaint with the Data Protection Commission of Ghana (Website: www.dataprotection.org.gh) or, in relation to financial services matters, the Bank of Ghana.
20. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect:
- Changes in our Services;
- Changes in applicable laws or regulations;
- Changes in technology;
- Changes in our data-processing practices; or
- Changes required by Apple, Google or other relevant platforms.
Where changes are material, we will provide appropriate notice through the App, website, email or other appropriate communication channel.
The latest version will be made available through the App and our website.
21. Contact Us
For questions concerning this Privacy Policy or the handling of your personal information, please contact:
Link Exchange Micro-Credit Limited
414/4 Newtown Road, Kokomlemle, Accra, Ghana.
Email: info@linkexchange.com.gh
Telephone: +233 (0) 202 228080 / +233 (0) 501 282043
Website: https://linkexchange.com.gh/