Privacy notice

1. Who we are

M&S Digital Solutions (“we”, “us”), a business registered in Ghana, develops DigiD Ghana and runs this website. We decide why and how personal data described in this notice is used, which makes us the data controller. You can reach us at info@digidghana.com.

2. Browsing this website

Just reading this website collects no personal data from you. It sets no cookies, uses no analytics or advertising tools, has no accounts, and loads nothing from other websites: its fonts, images and video are served from this site. Our own web server does not keep logs of your visit. The companies that host and deliver the site (see section 6) process the technical data every website visit involves, such as your IP address and the page you ask for, so that the page can reach you and the site can be kept secure.

3. When you use the contact form or write to us

If you use the contact form, we receive your name, your email address, the topic you choose, the organisation if you give one, and your message. If you email us, we receive your email address and whatever you choose to tell us. We use this only to answer you and to keep a record of the conversation, because you asked us to contact you, and for no other purpose. The contact form passes your message to our email service and keeps no copy of it on the website. Your connection address is held in the web server’s memory for up to one hour to limit abuse, and is not stored afterwards. We keep correspondence for 24 months after the last message and then delete it, unless the law requires us to keep it longer or it relates to a contract or a dispute. Please do not send passwords, PIN codes, verification codes or copies of identity documents.

4. DigiD Ghana, the app and the sign-in service

DigiD Ghana is coming soon. It is not open to the public, and it is used today with invented people only, so it holds no real personal data of members of the public. Before it opens to the public we will publish an updated notice that says what is collected, why, on what basis, for how long and who receives it, and we will not collect real personal data from the public until we have done so.

It is designed so that your face or fingerprint never leaves your phone, so that a website you log in to receives only what you approve, and so that different websites cannot link your logins together.

5. Organisations that apply to integrate

An organisation that applies to become an integration partner gives us its details and the names and e-mail addresses of its team. We use them to review the organisation, to run the sandbox and to stay in touch. We keep them while the organisation is active and delete the organisation’s registration details 12 months after it is rejected, revoked or expires, or after an unsubmitted application has been left untouched for 12 months. We keep a record of our decisions and an audit trail of who did what, which holds identifiers rather than the details submitted.

6. Who receives data on our behalf

We use these providers to run DigiD Ghana and this website: Fly.io (hosting, Frankfurt, Germany), Cloudflare (domain name service and email forwarding), Supabase (database and sign-in accounts for the partner process, Frankfurt, Germany), Resend (email delivery for the contact form and the partner process, Ireland) and Google (the mailbox our team reads). They act on our instructions. We do not sell personal data and we do not share it for advertising.

7. Your rights

Under Ghana’s Data Protection Act, 2012 (Act 843) you may ask us whether we hold personal data about you, ask for a copy, ask us to correct it, and ask us to delete it or stop using it where the law allows. Write to info@digidghana.com with the word “Privacy” in the subject line. We will confirm who you are before we act, and we will answer as soon as we can and within the time the law allows.

8. Complaints

If you are not satisfied with how we have handled your personal data you can complain to us at the address above, and you can complain to the Data Protection Commission of Ghana (dataprotection.org.gh).

9. Security

We protect personal data with access controls, second-factor sign-in for our staff, encrypted connections and an audit trail. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

10. Children

This website is not directed at children. Please do not send us a message if you are under 16 without a parent or guardian.

11. Changes

If we change this notice we will change the date at the top and describe what changed. The date it was last updated is 3 November 2026.