1. Introduction

Xcedi.com (“we”, “us”, “our”) operates an online e‑commerce marketplace that allows users to purchase goods and services. We respect your privacy and are committed to protecting personal data we collect from you. This privacy policy explains what data we collect, how we use it, our legal bases, the choices you have, and how we comply with Ghana’s Data Protection Act, 2012 (Act 843) and other applicable international data‑protection laws.

Under Ghanaian law, any processing of personal data must be done without infringing the privacy rights of the data subject and must be lawful and reasonable nita.gov.gh. Data controllers and processors must adopt appropriate technical and organisational measures to protect data against loss, destruction or unlawful access and regularly verify and update those safeguards nita.gov.gh. Global standards such as the GDPR require processing to be lawful, fair and transparent, for specified legitimate purposes, limited to what is necessary, accurate, stored only as long as needed, secured and accountable dataprotection.ie.

By using Xcedi.com, you accept the terms in this policy.

2. Data Controller

The data controller responsible for your personal data is:

  • Company name: Xcedi.com (Parley Ltd)
  • Address: P.O.Box : CT1128, Accra.
  • Email: info@xcedi.com

3. Data We Collect

We collect different types of information depending on how you interact with our site:

  1. Account information – When you create an account or place an order, you provide contact details (name, mailing address, email and phone), login credentials and order history.
  2. Payment information – We collect payment and billing details (e.g., credit‑card number, mobile‑money details) to process your purchase. Payments are processed by authorised payment processors; we do not store full payment card numbers after the transaction.
  3. Transaction and usage data – Records of your purchases, returns, wish‑lists and other e‑commerce activities. Under Ghana’s law, we collect data only for a specific, explicitly defined purpose nita.gov.gh, and further processing must be compatible with that original purpose nita.gov.gh.
  4. Cookies and analytics – We use cookies and similar technologies to remember your preferences, maintain your session, measure site usage and improve our services. Cookies also enable targeted advertising. You can control cookies through your browser settings.
  5. Device and log data – We automatically collect IP addresses, browser information, device type, operating system, referring URLs and standard log information when you access our site.
  6. Customer support and communications – If you contact us via email, phone or live chat, we collect the communications and any attachments.
  7. Third‑party data – We may receive additional information from partners (e.g., shipping companies, payment processors) to complete transactions. Under Ghana law, data must be collected directly from the data subject unless exceptions apply nita.gov.gh.

4. How We Use Your Data

We only process personal data when it is necessary and relevant nita.gov.gh and with a clear legal basis. We may use your data to:

  • Process orders and deliver goods/services – to fulfil our contract with you (Art. 6(1)(b) GDPR or Section 20(1)(a) of Act 843) nita.gov.gh.
  • Communicate with you – to send transaction confirmations, shipping updates and respond to enquiries.
  • Provide customer support – to assist with returns, refunds, complaints or technical issues.
  • Improve our services – to analyse customer behaviour and preferences to improve our offerings; we anonymise or de‑identify data where possible.
  • Marketing (with consent) – to send newsletters, promotions or product recommendations. Under Ghana’s Act, data subjects may object to processing and we must stop processing upon objection nita.gov.gh. You can opt out at any time.
  • Legal compliance – to comply with tax, customs, accounting and other legal obligations, and to protect our rights or respond to lawful requests (e.g., from regulators or law enforcement).
  • Fraud prevention and security – to detect and prevent fraud, abuse, malware and other harmful activities.

We do not sell personal data. We process special categories of personal data only where permitted by law (e.g., to comply with anti‑fraud or anti‑money‑laundering obligations).

5. Legal Bases for Processing

Our legal bases for processing personal data include:

  • Consent – We process your data with your explicit consent where required (e.g., marketing emails). You may withdraw consent at any time.
  • Contract – To perform a contract with you, such as processing your purchase and providing customer service nita.gov.gh.
  • Legal obligations – To comply with Ghanaian law or other legal requirements, such as tax and customs obligations and regulatory reporting.
  • Legitimate interests – To operate and improve our business, secure our services, and prevent fraud. We balance these interests against your fundamental rights.

6. Data Retention

We retain personal data only as long as necessary for the purpose for which it was collected nita.gov.gh. Specifically:

  • Order records, receipts and invoices are retained for the period required by tax laws and accounting standards.
  • User accounts remain active until you request deletion or we close inactive accounts.
  • Data used for marketing is retained until you withdraw consent or opt‑out.
  • After the retention period, records are destroyed or de‑identified so that they cannot be reconstructed nita.gov.gh.

7. Data Sharing and Third Parties

We may share personal data with trusted service providers, strictly for the purposes described in this policy, under written agreements that require confidentiality nita.gov.gh. These include:

  • Payment processors – to process payments securely.
  • Logistics and shipping companies – to deliver your orders.
  • IT and hosting providers – to operate the website, store data and perform analytics.
  • Marketing and analytics providers – to send newsletters or improve our services, subject to your consent.
  • Professional advisers – accountants, auditors and lawyers who support our business, subject to confidentiality.
  • Regulators and law‑enforcement authorities – when required by law, such as in response to subpoenas or to comply with Act 843 or GDPR.

We ensure that any data processor established outside Ghana or the EU provides adequate protection, as required by Ghana’s Act nita.gov.gh and GDPR Chapter V provisions on international transfers. We may use standard contractual clauses or rely on adequacy decisions to safeguard cross‑border transfers.

8. Security Measures

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access nita.gov.gh. Measures include encryption, secure storage, access controls, pseudonymisation, regular security assessments, staff training and incident response procedures.

Our contracts with data processors require them to establish and maintain confidentiality and security measures nita.gov.gh. We regularly verify and update our safeguards to address new risks nita.gov.gh.

In the event of a security breach, we will notify the Data Protection Commission and affected individuals in accordance with Act 843 nita.gov.gh and, where applicable, GDPR Articles 33–34.

9. International Transfers

Xcedi.com is based in Ghana but may process and store personal data on servers located in other countries. We comply with Act 843’s requirement to process foreign data subjects’ data in accordance with the laws of their jurisdiction nita.gov.gh and follow GDPR rules for transfers to third countries. Where data is transferred outside Ghana or the EU, we will ensure adequate safeguards (e.g., standard contractual clauses) to protect your data.

10. Your Rights

Under Ghana’s Data Protection Act and global data‑protection laws, you have the following rights:

  • Right of access – to obtain confirmation of whether we hold personal data about you and to access that information nita.gov.gh.
  • Right to correction – to request the correction or deletion of inaccurate, irrelevant, excessive, outdated or unlawfully obtained personal data nita.gov.gh.
  • Right to deletion / erasure – to request that we delete personal data that we no longer have authorisation to retain nita.gov.gh. Under the GDPR this is sometimes called the “right to be forgotten”.
  • Right to object – to object to the processing of your personal data, especially for direct marketing nita.gov.gh.
  • Right to withdraw consent – to withdraw consent at any time when processing is based on consent.
  • Right to data portability (where applicable) – to request a copy of your personal data in a structured, commonly used format.
  • Right to restriction of processing – to request limited processing when you contest the accuracy or legality of the data.
  • Right not to be subject to automated decision‑making – to request human intervention in automated decisions if they significantly affect you.

To exercise your rights, please contact us using the details in Section 13. We may require proof of identity and may charge a small fee where permitted by law nita.gov.gh.

If you believe our processing is unlawful, you have the right to lodge a complaint with Ghana’s Data Protection Commission (info@dataprotection.org.gh) or the supervisory authority in your jurisdiction.

11. Cookies and Tracking Technologies

We use cookies, pixel tags and similar technologies to recognize your browser or device, maintain your session, provide features (such as the shopping basket), analyse traffic and personalise advertisements. Cookies may be placed by us or by third parties (e.g., analytics providers). You can control cookies through your browser settings and, where required by law, we will obtain your consent before placing non‑essential cookies.

12. Links to Third Party Sites

Our site may contain links to other websites (e.g., external vendors or payment gateways). We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

13. Children’s Privacy

We do not knowingly collect personal data from children under 13 years of age (or the age specified by applicable law). If we become aware that we have collected data from a child, we will take steps to delete it promptly. Parents or guardians may contact us to request deletion of their child’s information.

14. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal obligations. When we do, we will post the updated policy on our website with a new effective date and, if the changes are material, we will provide prominent notice. Your continued use of Xcedi.com after the effective date constitutes your acceptance of the revised policy.

15. Contact Us

If you have any questions about this policy or wish to exercise your rights, please contact:

  • Email: info@xcedi.com
  • Postal address: CT1128, Accra.

You may also contact Ghana’s Data Protection Commission at info@dataprotection.org.gh or your local supervisory authority if you have concerns about our data processing.

Key statutory references

  • Ghana’s Data Protection Act, 2012 (Act 843) requires personal data to be processed lawfully and without infringing privacy rights nita.gov.gh. Personal data may only be processed if it is necessary and not excessive nita.gov.gh, and consent is normally required unless processing is justified under specific conditions nita.gov.gh.
  • Data must be collected directly from the data subject unless specific exceptions apply nita.gov.gh, and must be for a specific, explicitly defined purpose nita.gov.gh. Further processing must be compatible with the original purpose nita.gov.gh.
  • Data may not be retained longer than necessary, except in limited circumstances nita.gov.gh. Records must be destroyed or de‑identified once they are no longer needed nita.gov.gh.
  • Data controllers must adopt technical and organisational measures to protect personal data against loss, damage or unauthorised access nita.gov.gh and must ensure that data processors maintain confidentiality and security nita.gov.gh.
  • Individuals have rights of access, correction and deletion nita.gov.gh, and may object to processing nita.gov.gh.

The GDPR’s core principles—lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability—provide additional global standards dataprotection.ie.

This policy aims to comply with both Ghanaian and global data‑protection requirements, ensuring transparency and respecting your privacy rights.