Background

The Central Securities Depository (GH) LTD (hereinafter referred to as CSD located at the 4th Floor, Cedi House, Accra, Ghana) is a financial market infrastructure, operating in the securities market of Ghana and licensed by the Securities and Exchange Commission to provide depository, clearing, settlement and registrar services.

In accordance with the relevant data protection laws including the Data Protection Act, 2012 (Act 843), the CSD is committed to safeguarding the privacy and security of personal information it is likely to collect from all data subjects, who access the services the CSD renders to the market. This document informs you of our privacy policy regarding the collection, use and disclosure of Personal Information we receive from data subjects who access the services of the CSD.

Data subjects or visitors/users should read and study the terms of this Privacy Policy to understand CSD’s views and practices regarding processing of personal information and how the CSD processes the information.

Data subjects or visitors who disagree with CSD’s processing activities as described in this Privacy Policy, are urged not to access the services of the CSD including the website. The CSD will process personal information in line with the Data Protection Act, 2012 (Act 843) and any applicable data protection laws and regulations.

What Is Personal Information?

Personal information is any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be directly or indirectly identified by reference to an identifier or a combination of identifiers such as a name, an identification number, location, gender, date of birth, race, religion, an online identifier, or any piece of information which can be used to identify a specific individual or person. Personal information may also be referred to as personally identifiable information (PII).

The Personal Information We May Collect

While accessing our services, we may ask you to provide us with certain personal information. We only collect personal information that is necessary, relevant, and not excessive for the purpose of which we are collecting.

We collect personal information which may include, but not limited to your name, date of birth, postal and residential address, email address, internet protocol address, bank account details, valid national ID, survey responses and or any other information as required or approved by our regulators and published in the CSD rules and procedures as well as law enforcement agencies.

We may in certain circumstances process other information such as your transactions, services used, records of conversations and agreements and financial details that are required in transactions.

How Do We Collect Personal Information?

The CSD directly collects information from you when you engage with us through various mediums which include:

• When you visit our website
• When you open a securities account with us through a Bank, Broker etc.
• When you transfer, buy, or sell securities for settlement on our system
• When we use third party services or automated technologies such as Google Analytics that collect, monitor, and analyze data for us
• When a Depository Participant nominates you to be set up as a User of the CSD systems
• When you register, book, or attend training organised by the CSD
• When you register for or attend an event/conference such as a user group meeting with us
• When you contact us to make an enquiry or request for information
• When you physically visit our office premises
• When you make a complaint or give feedback
• When you apply for a job with us
• When you register to be added to our recruitment and membership services
• And through any other interaction you may have with us

In the event that we collect your information indirectly from you, CSD will inform you in due course where we obtained the information from.

How We Use Your Information

We may use your Personal Information for the following:

• To contact you with notices, respond to your requests and other information that may be relevant to you.
• To ensure that the content in our website is continually improved and presented in an efficient and relevant manner.
• To communicate with you and contact you regarding depository services that you request from us or, where you have consented to be contacted in a mailing list, for newsletters, products and services that may be of interest to you from time to time.
• To keep you updated as a client in relation to changes to our services, rules, regulations, and notices.
• To help us tailor investor and public education in a manner that effectively impacts you.
• To analyze metrics such as total number of visitors, traffic, demographic patterns, etc.
• To safeguard the security of our websites and other operational or system infrastructures.
• To comply with relevant and applicable regulations.
• And for any other purposes enshrined in applicable laws.

We use your Personal Information only for providing and improving the site or services we render to you. By using the site or subscribing to our services, you agree to the collection, processing and use of your personal information in accordance with this policy.

Lawfulness/Legal Basis We Rely On for Processing Your Information

CSD will only process your personal data for the specific purpose that we stated at the point of personal data collection and when the law allows or requires us to do so. Most commonly, we will use your personal data in the following circumstances:

• For us to perform a contract that we are about to enter or have entered with you.
• Where it is necessary for our legitimate interests and if your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or statutory obligation.
• Where you give us your consent.

Sharing of Personal Information/Transfer

Personal information may be stored internally by CSD via CSD’s own secure servers or other internally hosted technologies. We may share your personal information to regulators, third-party vendors, and service providers in the course of dealing with you. Any third party that we may share your data with are bound by relevant information sharing agreements as well as documented instructions and relevant data protection agreement and clauses and are obliged to keep your details securely, and to use them only to fulfil the service they provide on our behalf.

We shall not disclose or pass your sensitive personal information to a third party without your explicit consent unless we are legally required to do otherwise. We may disclose your personal data when instructed to do so by a court of competent jurisdiction, government agency and law enforcement agencies with appropriate legal backing.

We may disclose your personal data with our auditors, legal representatives, and advisors in the course of our legitimate business purposes.

Retention of Personal Information

Your personal information would be kept in accordance with our retention policy or as may be allowed or required by applicable laws. CSD will ensure that appropriate security safeguards and measures are in place to ensure that all archived personal information will continue to be handled and processed in line with this Privacy Policy and any applicable laws.

The CSD will ensure that, once the objective for which the personal information was originally collected and processed is no longer applicable or becomes obsolete, the personal information will be permanently deleted, destroyed or de-identified adequately to make it impossible for a person to re-identify such personal information. In situations where your personal information is used for research or statistical purposes, the CSD would take the appropriate measures to ensure that the personal information cannot be identified.

Cookies

Cookies are files with small amount of data, which may include an anonymous unique identifier. Cookies are sent to your browser from our web site and stored on your computer’s hard drive. For more information refer to our Cookies Policy.

Security Safeguards

The security of your Personal Information is important to us; however, we would like to acknowledge that no method of transmission is totally (100%) secure. We strive to safeguard the security of your information by the adoption of appropriate, reasonable technical and organisational measures, standards and best practices to prevent loss or theft, unauthorised access, disclosure, copying, use or modification of your personal information.

We also undertake to use all ethical and acceptable means to protect your Personal Information; but we cannot guarantee absolute security. By proceeding you agree to our processing of your personal information in accordance with this privacy policy.

Changes to This Privacy Notice

This Privacy Policy is effective as of 22nd September 2022 and will remain in effect except with respect to any changes in its provisions in the future, which will be in effect immediately after being posted on this page.

We reserve the right to update or change our Privacy Policy at any time. Kindly check this Privacy Policy periodically. Your continued use of the website and/or our services after we post any modifications to the Privacy Policy on this page will constitute your acknowledgment of the modifications and your agreement to abide and be bound by the modified Privacy Policy.

If we make any material changes to this Privacy Policy, we will notify you by placing a prominent notice on our website or via an email to the email address you have provided, or both.

Rights of the Data Subject

The Data Protection Act, 2012 (Act 843) provides relevant rights to you as a data subject. You can exercise any of the rights at any time by using the contact details provided below. The rights are:

• Right to be informed
• Right of access to personal data
• Right to give and withdraw consent
• Right to amend (rectification), blocking, erasure, and destruction
• Right to prevent processing
• Right to object
• Right to freedoms from automated decision making
• Right to prevent processing for direct marketing
• Right to compensation
• Right to complain

Can I Find Out the Personal Data That the CSD Holds About Me?

At your request, we can confirm what information we hold about you and how it is processed. You may further request the following information:

• The purpose for collection of personal data, its processing as well as the legal basis for processing.
• If the processing is based on the legitimate interests of CSD or a third party and information about the interests.
• The kind of or particular personal information/data collected, stored, and processed.
• Recipient(s) or categories of recipients that the data is/will be disclosed to.
• If we intend to transfer the personal data to a third country or international organisation, information about how we ensure this is done securely.
• How long the data will be stored.
• Details of your rights to correct, erase, restrict or object to such processing.
• Information about your right to withdraw consent at any time.
• How to exercise your right to withdraw consent.
• How to register a complaint with the regulatory authority.
• The source of personal information data if it was not collected directly from you.

Governing Law

This policy is subject to the laws of the Republic of Ghana and any legal action instituted in relation to this policy must be instituted in the Republic of Ghana.

Contact Information

If you have any comment, question, concern, or complaint about this Privacy Policy or on Personal Information, please contact us via any of the following means:

Data Protection Officer/Officer in Charge of Data Protection
Tel: +233302689313 / +233302689314
Email: dataprivacy@csd.com.gh
Physical Address: Central Securities Depository (GH) LTD, 4th Floor Cedi House, Liberia Road, Accra, Ghana
Digital Address: GA-077-9786

Contact Information of the Regulator, Data Protection Commission

If you are not satisfied with how we address your complaint or concerns about processing of Personal Information, you may contact the office of the Regulator, Data Protection Commission of Ghana using any of the following details.

Email: info@dataprotection.org.gh
Telephone: +233 (0) 302222929
Website: www.dataprotection.org.gh