This policy applies to the Build_it platform and to the marketing website at buildit.africa. The data controller is Build_it Labs Ltd., a company registered in Ghana. Our privacy contact is privacy@builditlabs.io.
We designed this policy to meet the Ghana Data Protection Act, 2012 (Act 843), and, for learners based in the European Economic Area or the United Kingdom, the GDPR and UK GDPR.
What we collect
We collect only the data we need to run your programme and improve the platform.
- Account data. Your name, email and password. If you sign in with Google, we receive your Google display name and email from Google, and nothing else.
- Onboarding answers. Your current role, your goal, your skill level, how many hours a week you can commit, and how you heard about us. You can skip any question.
- Learning activity. Which lessons you have opened, which you have completed, how long you spent on them, and the work you submit. We use this to run the unlock schedule, the progress dashboard, the streak counter and the peer activity feed.
- Payment data. Your payment provider (Paystack or Stripe) handles your card or Mobile Money transaction. We do not see or store your card number, your CVV, or your Mobile Money PIN. We keep a transaction reference, the amount and the currency so we can match the payment to your enrolment and issue a receipt.
- Messages. When you email or message us, we keep that correspondence and any files you attach.
- Technical logs. Our servers record your IP address, browser type, device identifier, the pages you visit and the times you visit them. This is standard log data used for debugging, abuse prevention and improving the platform.
Why we may hold your data
Under Ghanaian law, and where it applies the GDPR and UK GDPR, we rely on the following lawful bases:
- Performance of a contract. We process your data to run the programme you have paid for.
- Legitimate interests. We keep the platform secure, prevent fraud, and measure how it is used so we can make it better.
- Consent. Marketing emails and optional analytics only run if you opt in. You can withdraw consent at any time from your profile settings.
- Legal obligation. Some records, such as payment history, we keep because tax law requires it.
How we use your data
We use your data to:
- deliver the lessons in your programme on schedule;
- track progress, generate certificates, and let facilitators give you feedback;
- send transactional messages about your cohort, such as lesson unlocks, live sessions, deadlines and certificate readiness;
- send re-engagement nudges when you have been away for a few days. You can turn these off from your notification settings;
- handle payments and send receipts;
- improve the platform through anonymised usage analysis;
- respond when you contact us.
We do not sell your personal data. We do not share it with advertisers.
International transfers
Your data is processed in countries outside Ghana, including the United States and the European Union. For every processor in a country outside Ghana, we rely on Standard Contractual Clauses and on the protections those countries offer under their own privacy laws.
How long we keep it
- Active account: for as long as your account is open.
- Closed account: thirty days after closure, after which we anonymise your record. Your name and enrolment history against a certificate are kept indefinitely so that employers can still verify certificates you have earned.
- Payment and tax records: six years, as required by Ghanaian tax law.
- Server logs: ninety days.
- Support correspondence: two years.
Your rights
Wherever you live, you can ask us to:
- Show you the data we hold about you. We will send it within thirty days.
- Correct anything that is wrong.
- Delete your account and the data linked to it, subject to the retention points in clause 06.
- Export your progress and submissions in a machine-readable format.
- Stop sending you marketing. You can also do this from your profile settings page.
- Object to processing that relies on our legitimate interests. We will stop unless we have a compelling reason to continue.
To exercise any of these rights, email privacy@builditlabs.io from the address on your account.
If you are based in the EEA or UK and believe we have mishandled your data, you can complain to your national supervisory authority. In Ghana, complaints go to the Data Protection Commission at dataprotection.org.gh.
Children
Build_it is not designed for children under 16. We do not knowingly collect data from a child. If you believe we hold information about someone under 16, write to privacy@builditlabs.io and we will remove it.
Security
We use HTTPS across the platform. Passwords are stored as bcrypt hashes, never in plain text. Access to the production database is restricted and logged. Payment data we keep is tokenised.
No online service is completely secure. If a security incident affects your account, we will tell you by email within seventy-two hours of confirming it, explain what happened, and say what we are doing about it.
Changes
If we make a material change to this policy, we will email every active account holder at least fourteen days before it takes effect. For smaller, clarifying edits we update the date at the top of the page and publish a short note in the footer news feed.
How to reach us
Data protection questions: privacy@builditlabs.io
General enquiries: info@builditlabs.io
Post: Build_it Labs Ltd., Accra, Ghana.