Privacy Notice
How Trustline Builds Limited, trading as Trustline Builds, processes personal data.
Ghana market provisions. This page is rendered for the GH market. Identity document: Ghana Card; data-protection framework: Ghana Data Protection Act, 2012 (Act 843); regulator: Ghana Data Protection Commission.
Interim publication note. Processor contracts, transfer mechanisms and category-specific retention periods must be confirmed before final legal approval. This notice describes the current code without claiming controls the product does not yet enforce.
1. Controller and contact
Trustline Builds Limited operates Trustline Builds. Contact the privacy team and Data Protection Supervisor at [email protected], or +233 55 057 5987. Report a suspected breach through the same address with “security incident” in the subject.
2. Data, purpose and recipients
| Category | What it includes | Purpose / justification | Recipients / processors |
|---|---|---|---|
| Account and authentication | Name, email, phone, role, sign-in and account identifiers. | Create, secure and administer accounts. | Clerk, hosting/database providers and authorised staff. |
| Property and project | Site address, brief, budget, schedule, contacts and instructions. | Deliver, coordinate and document the requested service. | Assigned providers, administrators and service infrastructure. |
| GPS, EXIF and site media | Coordinates, accuracy, times, device metadata, hashes, photos, video and audio. | Assess evidence provenance, prepare reports and investigate complaints. | Assigned providers, administrators, storage/CDN and named client. |
| Messages and attachments | Project messages, support communications and documents. | Coordinate work, support users and preserve transaction records. | Message recipients, administrators and communications providers. |
| Credentials and identity checks | Qualifications, licences, references and identity-check attestations or supplied documents. | Assess eligibility and continuing ability to provide services. | Vetting staff, issuing bodies and references. |
| Payment and procurement | Amounts, currency, references, proof, processor metadata, supplier and payout details; not full card numbers. | Initialize, reconcile, refund and account for payments. | Payment channels, banks, payees, administrators and accountants. |
| Device, security and audit | IP address, user agent, locale, login and attributed action records. | Security, acceptance evidence, fraud prevention and disputes. | Authentication, hosting, logging and incident-response providers. |
| Analytics | Product events and, when configured, user ID, email, name and role sent to PostHog; replay may be enabled by configuration. | Understand and improve product use and reliability. | PostHog and authorised analytics users. |
| Public profiles and reviews | Approved provider fields, portfolio, rating and consented testimonial fields. | Operate the public directory and publish consented reviews. | The public and search engines. |
Assigned contractors and professionals receive only assignment-limited access needed for the requested service. They generally process information as Trustline's processors on documented instructions. A regulated lawyer, surveyor, engineer, architect or similar professional may control information independently only where applicable law or a binding professional duty genuinely requires it; that does not permit marketing, solicitation, portfolio use, unrelated retention or reuse. Official-authority disclosures, including land-record applications, use the applicable official process.
3. Grounds for processing
We process data to perform contracts and requested pre-contract steps, operate and secure the service, comply with legal/accounting obligations, and pursue proportionate legitimate operational interests. We seek consent where publication, marketing, optional analytics or another activity requires it. Final jurisdiction-specific wording requires counsel review.
4. Site media and incidental people
Site media may incidentally capture workers, neighbours, children, vehicle plates or nearby property. The person arranging access must give appropriate notice and avoid unnecessary capture. Uploaders should frame, redact or withhold unrelated material and report sensitive incidental capture. Metadata review does not prove that an image is truthful or that depicted work occurred at the metadata time.
5. Ghana Card and identity documents
For Ghana applicants, the intended process is an out-of-band identity check with only an attestation recorded. The current general upload capability does not technically prevent a person from uploading a Ghana Card or other identity document. Do not upload one unless expressly requested through an authorised, lawful process. If uploaded unintentionally, contact [email protected] for restricted handling and deletion review. The legal basis and response require Ghana counsel confirmation.
6. International processing
Data may be processed outside Ghana. The database is configured for EU-region hosting and media is delivered through a global network. The complete processor list, processing locations and transfer mechanisms are to be confirmed before publication; no safeguard is asserted without the relevant agreement.
7. Retention
Current code removes read notifications after 90 days and login events after 180 days when the retention job runs. Provider-controlled copies must be returned or securely deleted within seven days after the relevant assignment ends, subject to Trustline's written instruction or a documented legal retention requirement. Project, payment, report, acceptance, audit and evidence records are retained according to operational, dispute, tax and legal needs; exact periods are to be confirmed before publication. A legal hold may delay deletion.
8. Rights and complaints
Subject to applicable law, request access, correction, export, restriction, objection or deletion at [email protected]. We may verify identity and explain any lawful refusal or retention requirement. You may complain to Ghana's Data Protection Commission or another competent authority.
9. Security and breaches
We use role checks, authentication, attributed records and reputable infrastructure, but no service is perfectly secure. We do not describe uploaded media as private merely because it is stored with a cloud provider. We assess incidents and notify affected people or regulators where applicable law requires it.
10. Public profiles, reviews and changes
Approved profile fields and consented reviews may be public and indexed. Deactivation cannot immediately remove third-party caches. Contact us for correction, removal or de-indexing assistance. Material changes will be dated and notified; a new purpose may require fresh consent.