Privacy policy

Ekatostore (“we”, “us”) is the data controller for the personal data described here. We process it in line with Ghana’s Data Protection Act, 2012 (Act 843).

You can contact us about privacy at any time: WhatsApp 024 606 4863 or email support@ekatostore.co, or Help and support in your account.

• Account details: your name, mobile number, email address (optional), password (stored only as a secure hash) and your language and message preferences.
• Google sign-in: if you continue with Google, we receive your name, email address and Google account ID. We don’t get your Google password or access to your Google account.
• Orders and delivery: the group buys you join, quantities, prices, delivery addresses, recipient names and contact numbers, and the progress of each order.
• Payments: the payment method type, the last digits of a card or mobile money number, and payment references from Paystack. Card numbers are handled only by Paystack. Numbers you give us for refunds are encrypted when stored.
• Support: your messages to us and any photos or documents you attach. We remove hidden location data (such as GPS in photo metadata) from images we display.
• Product requests: what you asked for, any link or photo, and the price and quantity you suggested.
• Device and security data: your IP address, the approximate city and country it suggests, your browser and device type, and sign-in history. We use this to keep your account safe and to spot fraud.
• Usage: which group buys you view and join, so we can improve what we offer.

• To create and secure your account, including sending sign-in codes (performing our contract with you).
• To take payments, process refunds and deliver your orders (performing our contract).
• To send you updates about your orders and refunds (performing our contract), and, if you choose, news about new group buys (your consent - you can turn this off any time).
• To answer your questions and resolve problems (performing our contract).
• To prevent fraud, abuse and security incidents, and to improve the service (our legitimate interests, balanced against your rights).
• To keep records and meet our legal, tax and customs obligations (legal obligation).

We share personal data only where needed, and only with organisations that must protect it:

• Paystack, to process payments and refunds.
• SMS, WhatsApp and email providers, to send codes, order updates and messages you’ve agreed to.
• Cloudinary, which stores photos and files you upload.
• Google, if you choose to sign in with Google.
• Umami, for anonymous visitor statistics: which pages are visited, where visits come from and which buttons are tapped. It uses no cookies, and we never send it your name, phone number, email or address.
• Sentry, to find and fix errors in our website and app. Error reports include technical details such as the page and browser; we’ve turned off collection of form contents, cookies and account details.
• Cloud hosting and infrastructure providers that run our servers and databases.
• Delivery partners, who receive the recipient name, phone number and address needed to deliver your order.
• Authorities such as the Ghana Revenue Authority, customs or the police, when the law requires it or to protect people from harm.

Suppliers and manufacturers receive bulk order details only - never your name, number or address. We don’t sell your personal data, and we don’t share it for other companies’ advertising.

Some of our providers store data on servers outside Ghana, for example in the European Union. Where that happens, we use providers with strong security and contractual protections for your data, as Act 843 requires.

• A sign-in cookie that keeps you signed in (for up to 30 days unless you sign out).
• A preference that remembers light or dark mode.
• A cookie that remembers a referral link you followed, if any.

We don’t use advertising cookies. Blocking our sign-in cookie will stop you staying signed in.

We count visits with Umami, which doesn’t use cookies or identify you. If your browser sends a “Do Not Track” signal, we don’t count your visits at all.

• Account details: while your account is open, and for a short period after it’s closed to handle any outstanding orders or refunds.
• Orders, payments and refunds: as long as tax and accounting law requires, currently up to six years.
• Product requests: 90 days, unless they’re linked to a group buy.
• Support conversations: while your account is open, and up to two years after the last message.
• Security logs: up to twelve months.

When we no longer need data, we delete it or make it anonymous.

We use encryption in transit (HTTPS) everywhere, store passwords only as secure hashes, encrypt sensitive details such as refund numbers, limit staff access to what each role needs, and keep an audit trail of staff actions. No system is perfectly secure; if a breach affects you, we’ll tell you and the Data Protection Commission as the law requires.

Under Act 843 you can:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that’s wrong or incomplete (you can edit most of it yourself in your account);
• ask us to delete your data, where we don’t need to keep it for an order, a refund or the law;
• object to how we use your data, including for marketing;
• withdraw consent you’ve given, such as for WhatsApp news, at any time in your notification settings.

To use these rights, contact us: WhatsApp 024 606 4863 or email support@ekatostore.co, or Help and support in your account. We’ll reply within one month. If you’re not satisfied with our answer, you can complain to the Data Protection Commission of Ghana.

Ekatostore is for people aged 18 and over. We don’t knowingly collect data from children; if you think a child has created an account, please contact us and we’ll delete it.

We’ll update this policy when our practices change. The date at the top shows the latest version; for significant changes we’ll also tell you by message or on the site.