What we keep. What we don't.

1 · Scope and operator

This policy explains how EcoVent Africa Limited (registration CS274771225, registered office at 40 Nii Nortei Nyanchi Street, Dzorwulu, Accra, Ghana) handles personal data collected through ecoventafrica.com and the VPAY Genesis platform.

EcoVent Africa Limited is the data controller for the purposes of the Ghana Data Protection Act 2012 (Act 843) and acts as controller for any personal data processed under the EU General Data Protection Regulation when European users interact with our services.

Last updated · 23 May 2026 · supersedes all prior versions

2 · What we collect

We collect only what we need to operate the protocol and respond to you. The categories are short by design.

• Information you submit through forms. When you request the diligence deck, sign up for the $SOV waitlist, or contact media: your name, email address, employer, role, country, and any free text you write. Submitted via Netlify Forms.
• Email correspondence. Anything you send to ano@ecoventafrica.com or any other published address is retained as a business record.
• Aggregated, anonymous traffic metrics. Page views, referrers, country, device class. Collected via Plausible Analytics (privacy-first; no cookies, no cross-site identifiers). See §5.
• Public blockchain data. Wallet addresses interacting with our smart contracts on Polygon Mainnet are public by virtue of being on a public ledger. We do not link wallets to identities except where users self-disclose.

We do not collect: cookies for tracking, third-party advertising identifiers, biometric data, payment card data (we do not take card payments), location more granular than country.

3 · How we use it

Purpose limitation is non-negotiable. Each lawful basis below maps to a specific operational need.

• Responding to you (legitimate interests, Article 6(1)(f) GDPR / s.20(1)(d) Act 843). When you fill in a form, we use your details to send the requested materials or answer your question.
• Maintaining the diligence chain (legitimate interests). NDA-gated diligence material disclosures are logged so we can demonstrate who received what, when. This is itself an audit requirement.
• Improving the site (legitimate interests). Aggregate traffic metrics tell us which pages institutions read longest. The metric is page-level, not person-level.
• Legal obligations (Article 6(1)(c) GDPR / s.20(1)(b) Act 843). Anti-money-laundering record-keeping, regulatory inquiries, court orders.

We do not use your data for: automated decision-making with legal effect, advertising profile-building, sale to third parties, or any purpose outside the scope of operating the protocol and corresponding with you.

4 · Your rights

Whether the Ghana Data Protection Act 2012, the EU GDPR, the UK GDPR, the California Consumer Privacy Act, or another regime applies to you, the following rights are available without charge and within reasonable response windows.

• Right of access. You can ask for a copy of your personal data we hold and the purposes of processing.
• Right to rectification. You can correct anything we have wrong.
• Right to erasure ("right to be forgotten"). You can ask us to delete your data, subject to legal-retention exceptions (see §6).
• Right to restrict processing. You can ask us to stop a specific use while keeping the data.
• Right to data portability. Where processing is by automated means and based on consent or contract, you can ask for your data in a structured, machine-readable format.
• Right to object. You can object to processing based on legitimate interests, including direct marketing.
• Right to lodge a complaint. If you believe we are not handling your data lawfully, you may complain to the Data Protection Commission of Ghana (dataprotection.org.gh) or your local supervisory authority.

To exercise any of these rights, see §8 (Contact). We will respond within 30 days unless the request is complex, in which case we will tell you and complete the response within 90 days.

5 · Cookies and analytics

This site does not set tracking cookies.

We use Plausible Analytics — a privacy-first analytics tool that is cookieless, does not collect personal data, does not use cross-site identifiers, and is hosted on EU servers. Plausible counts page views and referrers in aggregate so we can understand which sections of the site institutions and citizens read longest. No identity is linked to any view.

Strictly necessary technical state (e.g., your choice of a navigation drawer being open or closed) is held in your browser's localStorage, which is not a cookie and is not transmitted to our servers.

6 · How long we keep it

Retention is purpose-driven, not indefinite.

• Diligence-room requests. Retained for the duration of the relationship plus seven (7) years, to satisfy AML record-keeping obligations under Act 1044 (Anti-Money Laundering Act 2020, Ghana) and equivalents.
• Waitlist signups. Retained until the $SOV public window closes plus six (6) months, or until you ask to be removed.
• Email correspondence. Retained as a business record for seven (7) years from the last interaction.
• Aggregate analytics. Retained indefinitely in aggregated form; no personal data attached.
• Public on-chain data. Cannot be deleted by us; it is on a public blockchain. By design.

7 · International transfers

Form submissions are processed by Netlify, Inc. (United States) under that vendor's data processing addendum and Standard Contractual Clauses. Email is processed by Google Workspace under the same framework. Plausible Analytics hosts the EU analytics endpoint within the European Union.

For users in the EU/EEA and UK, transfers of personal data outside the European Economic Area are governed by either an adequacy decision or Standard Contractual Clauses approved by the European Commission. For Ghana residents, transfers are processed in accordance with sections 18–19 of the Ghana Data Protection Act 2012.

8 · Contact us

For any privacy question or to exercise a right under §4:

If your concern is unresolved, you may escalate to the Data Protection Commission of Ghana at dataprotection.org.gh, or to your local supervisory authority within the EU/EEA, UK, or equivalent regime.

9 · Changes to this policy

Material changes to this policy will be announced at the top of this page and via an entry on the protocol transparency dashboard with the new effective date. The version history of this policy is part of the audit trail and is preserved.

Version 1.0 · Effective 23 May 2026