Privacy Policy

1. Who we are

WorkPhelo is operated by:

• Datrix Tech Solutions Limited
• Product: WorkPhelo
• Website: https://workphelo.com
• Email: info@workphelo.com
• Telephone: 0509753133
• Address: No. 8 ARS Avenue Ogbojo-East legon

For questions relating to privacy and personal data, you may contact our Data Protection Supervisor or designated privacy contact using the details provided below.

2. Scope of this policy

This Privacy Policy applies to personal data processed through:

• The WorkPhelo website;
• WorkPhelo web applications;
• WorkPhelo mobile applications, where applicable;
• WorkPhelo customer accounts;
• WorkPhelo HR and employee-management services;
• WorkPhelo payroll services;
• WorkPhelo CRM and customer-management services;
• WorkPhelo accounting and financial services;
• WorkPhelo marketing and operations modules;
• Customer support services;
• Communications between you and Datrix; and
• Other WorkPhelo services that reference this Privacy Policy.

This Policy does not necessarily apply to third-party websites or services that may be accessible through WorkPhelo.

3. Important definitions

• “Personal Data” means information relating to an identified or identifiable individual.
• “Data Subject” means the individual to whom personal data relates.
• “Customer” means the organisation or individual that subscribes to WorkPhelo.
• “User” means an individual authorised by a Customer to use WorkPhelo.
• “Customer Data” means information submitted, uploaded, generated, or otherwise processed through WorkPhelo on behalf of a Customer.
• “Processing” includes collecting, recording, storing, organising, using, modifying, retrieving, disclosing, transferring, or deleting personal data.

4. Our role in processing personal data

The role Datrix performs may depend on how WorkPhelo is used.

Where Datrix collects personal data directly from an individual for purposes such as account registration, customer support, billing, marketing, or administration, Datrix may act as the Data Controller.

Where a Customer uses WorkPhelo to upload and manage personal data belonging to its employees, customers, suppliers, contractors, or other individuals, the Customer may determine the purposes for which that information is processed, while Datrix may process the information on the Customer’s behalf as a Data Processor/service provider.

In such circumstances, the Customer remains responsible for ensuring that it has a lawful basis and appropriate authority to process and provide the relevant personal data to WorkPhelo.

5. Personal data we may collect

Depending on how WorkPhelo is used, we may collect or process the following categories of information.

Account information

This may include:

• Full name;
• Email address;
• Telephone number;
• Organisation name;
• Job title;
• Username;
• Login credentials;
• Account preferences; and
• Other information required to establish and manage an account.

Employee and HR information

Where the WorkPhelo HR module is used, Customers may provide information including:

• Employee names;
• Employee identification information;
• Contact details;
• Date of birth;
• Gender, where required by the Customer;
• Residential information;
• Employment history;
• Job title and department;
• Employment type;
• Start and end dates;
• Salary and compensation information;
• Bank/payment information;
• Tax information;
• SSNIT-related information;
• Leave records;
• Attendance information;
• Performance information;
• Training information;
• Emergency contact information; and
• Other employment-related information.

Customers should only collect and upload information that is necessary and lawful for their HR and employment purposes.

Payroll information

Where payroll functionality is used, WorkPhelo may process:

• Basic salary;
• Allowances;
• Bonuses;
• Deductions;
• Statutory contributions;
• Tax information;
• SSNIT information;
• Bank/payment information;
• Payslip information; and
• Other payroll-related records.

Financial and accounting information

Depending on the modules used, WorkPhelo may process:

• Customer records;
• Supplier records;
• Invoices;
• Payment records;
• Transaction information;
• Expense records;
• Bank-related information;
• Accounting records; and
• Other financial information submitted by the Customer.

Customer and CRM information

This may include:

• Customer names;
• Contact information;
• Organisation information;
• Communication records;
• Sales information;
• Customer preferences;
• Leads and prospects;
• Transaction history; and
• Other CRM information.

Technical information

When you use WorkPhelo, we may automatically collect certain technical information, including:

• IP address;
• Browser type;
• Device type;
• Operating system;
• Login times;
• Session information;
• Usage information;
• Error logs;
• Security logs; and
• Other technical information necessary to operate and secure the Service.

Communications

We may retain information contained in communications you send to us, including:

• Support requests;
• Emails;
• Feedback;
• Complaints;
• Survey responses; and
• Other communications.

6. How we collect personal data

We may collect personal data:

• Directly from you;
• When you create a WorkPhelo account;
• When your organisation creates an account for you;
• When you use WorkPhelo;
• When you contact customer support;
• When you submit forms;
• When you subscribe to our services;
• From your organisation or authorised administrator;
• Through integrations you or your organisation activate;
• Through cookies and similar technologies; and
• From other lawful sources.

7. Why we process personal data

We may process personal data for purposes including:

Providing WorkPhelo

• Creating and managing accounts;
• Providing requested services;
• Processing transactions;
• Managing subscriptions;
• Providing HR and payroll functionality;
• Providing accounting and business-management functionality;
• Providing customer support;
• Processing integrations; and
• Maintaining the functionality of WorkPhelo.

Security and fraud prevention

We may process information to:

• Detect suspicious activity;
• Prevent fraud;
• Protect accounts;
• Investigate security incidents;
• Monitor system activity;
• Protect WorkPhelo infrastructure; and
• Prevent unauthorised access.

Business operations

We may process information to:

• Manage customer relationships;
• Process payments;
• Maintain business records;
• Communicate with customers;
• Improve customer support;
• Analyse system performance; and
• Manage our business.

Product improvement

We may use aggregated, statistical, or appropriately anonymised information to:

• Improve WorkPhelo;
• Develop new features;
• Understand system usage;
• Improve performance;
• Identify errors; and
• Conduct business analytics.

Where information is anonymised so that individuals can no longer reasonably be identified, it may no longer constitute personal data.

8. Lawful basis for processing

Depending on the circumstances, Datrix may process personal data based on:

• The individual’s consent;
• The performance of a contract;
• Compliance with a legal or regulatory obligation;
• Protection of a person’s vital interests where applicable;
• A legitimate business purpose where permitted by applicable law; or
• Another lawful basis recognised under applicable data protection legislation.

Where we rely on consent, you may withdraw that consent, subject to applicable legal requirements and any consequences explained to you at the time.

9. Marketing communications

We may use contact information to send information about WorkPhelo, Datrix products, updates, events, offers, or other business communications where permitted by law.

Where consent is required, we will obtain appropriate consent.

You may unsubscribe from marketing communications at any time by using the unsubscribe option provided in the communication or contacting us directly.

You may continue to receive essential service communications, such as security alerts, billing notifications, account notices, and important operational messages.

10. Cookies and similar technologies

WorkPhelo and its website may use cookies and similar technologies to:

• Keep users signed in;
• Maintain sessions;
• Remember preferences;
• Improve website performance;
• Understand usage patterns;
• Monitor security; and
• Improve the user experience.

You may control cookies through your browser settings. Disabling certain cookies may affect the functionality of WorkPhelo.

11. How we share personal data

We do not sell personal data to third parties.

We may disclose or provide access to personal data where reasonably necessary to provide WorkPhelo or comply with our legal obligations.

This may include sharing information with:

Service providers

Third-party providers that assist us with:

• Cloud hosting;
• Infrastructure;
• Payment processing;
• Email delivery;
• Customer support;
• Analytics;
• Security;
• Authentication;
• Backup and disaster recovery; and
• Other essential services.

These providers may only process personal data in accordance with applicable contractual and legal requirements.

Customer administrators

Where you use WorkPhelo through an organisation, authorised administrators within that organisation may have access to information associated with your account according to the permissions configured by the organisation.

Legal and regulatory authorities

We may disclose information where required or permitted by law, regulation, court order, lawful government request, or to protect the rights, safety, and security of Datrix, WorkPhelo, our customers, or other individuals.

Business transfers

Personal data may be transferred as part of a merger, acquisition, restructuring, financing, sale of assets, or similar corporate transaction, subject to applicable law.

12. Customer responsibility for employee data

Customers using WorkPhelo to process employee or other third-party personal data are responsible for:

• Informing affected individuals about the processing of their information;
• Obtaining consent where required;
• Establishing an appropriate lawful basis;
• Providing appropriate privacy notices;
• Collecting only necessary information;
• Keeping information accurate;
• Managing User permissions;
• Responding to data-subject requests where appropriate; and
• Complying with applicable employment, tax, privacy, and data protection laws.

The Customer should not upload personal data to WorkPhelo unless it has the necessary authority to do so.

13. Data security

We take reasonable technical and organisational measures to protect personal data against:

• Unauthorised access;
• Unauthorised disclosure;
• Accidental loss;
• Destruction;
• Alteration;
• Misuse; and
• Other unlawful processing.

Security measures may include:

• Access controls;
• Authentication;
• Encryption where appropriate;
• Secure infrastructure;
• Monitoring and logging;
• Backup procedures;
• Vulnerability management;
• Security testing;
• Incident response procedures; and
• Staff confidentiality obligations.

However, no technology or internet-based system can guarantee complete security.

14. Data breaches and security incidents

Where Datrix becomes aware of a personal data breach affecting information processed through WorkPhelo, we will take reasonable steps to:

• Investigate the incident;
• Contain and mitigate the incident;
• Assess potential risks;
• Restore affected systems where appropriate;
• Notify affected Customers where required;
• Notify relevant authorities where required by law; and
• Take reasonable measures to prevent recurrence.

Where the Customer is the Data Controller, Datrix will provide reasonable assistance to the Customer in meeting applicable breach notification obligations, subject to the circumstances and applicable law.

15. Data retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Retention periods may depend on:

• The nature of the information;
• The purpose of processing;
• The Customer’s subscription;
• Legal and regulatory obligations;
• Accounting requirements;
• Dispute resolution;
• Security requirements; and
• Other legitimate business purposes.

When personal data is no longer required, it may be securely deleted, anonymised, or otherwise disposed of in accordance with applicable requirements.

16. Data stored after account termination

When a WorkPhelo account is terminated, Customer Data may remain in backups or systems for a limited period before being securely deleted in accordance with our retention procedures.

Customers should export important information before terminating their accounts.

Specific data retention and deletion arrangements may also be agreed in a separate contract or Data Processing Agreement.

17. International data transfers

WorkPhelo may use cloud infrastructure and service providers that operate in countries outside Ghana.

Where personal data is transferred outside Ghana, Datrix will take reasonable steps to ensure that the transfer and processing are conducted in accordance with applicable data protection requirements.

Where required, appropriate contractual, technical, or organisational safeguards will be implemented.

18. Data subject rights

Depending on applicable law, individuals may have rights relating to their personal data, including rights to:

• Be informed about the processing of their personal data;
• Request access to personal data;
• Request correction of inaccurate or incomplete information;
• Object to certain processing;
• Withdraw consent where processing is based on consent;
• Request deletion where legally applicable;
• Request restriction of certain processing;
• Request information about how their data is used; and
• Exercise other rights available under applicable law.

The Ghana Data Protection Commission identifies data-subject rights under sections 39–44 of Act 843, including rights relating to access, objection, direct marketing, and compensation in specified circumstances.

19. How to exercise your rights

To exercise a privacy right or submit a privacy request, contact:

• Privacy/Data Protection Contact
• Datrix Tech Solutions Limited
• Email: info@workphelo.com
• Telephone: 0509753133

Requests should include enough information to allow us to identify the requester and understand the request.

Where permitted by law, we may request additional information to verify identity before processing a request.

If you use WorkPhelo through an organisation, you may also need to contact your employer or organisation’s administrator because that organisation may control the relevant personal data.

20. Response to data requests

We will endeavour to respond to valid privacy requests within the timeframe required by applicable law.

The Ghana Data Protection Commission states in its own privacy notice that it aims to respond to data-subject rights requests within twenty-one (21) days. The applicable response period for a particular WorkPhelo request will depend on the relevant law and circumstances.

Where we are unable to fulfil a request, we will, where legally required, explain the reason.

21. Children’s data

WorkPhelo is primarily designed for businesses and organisations and is not intended to be used directly by children for personal accounts.

Customers must ensure that they have an appropriate lawful basis and any required parental or guardian authorisation before submitting children’s personal data to WorkPhelo.

22. Data accuracy

We aim to maintain accurate personal data under our control.

However, where information is entered or maintained by a Customer, the Customer is responsible for ensuring that the information is accurate, complete, and up to date.

Users should notify their organisation or WorkPhelo support where information requires correction.

23. Automated decision-making

Certain WorkPhelo features may use automated calculations, rules, workflows, analytics, or other automated processes.

Where WorkPhelo provides automated outputs, Customers remain responsible for reviewing and validating outputs before using them to make significant employment, financial, legal, or regulatory decisions.

Where applicable law provides rights relating to solely automated decision-making, Datrix will take appropriate measures to comply with those requirements.

24. HR and employee data

WorkPhelo may process information relating to employees for purposes including:

• Recruitment and onboarding;
• Employee administration;
• Attendance;
• Leave;
• Payroll;
• Performance management;
• Training;
• Offboarding;
• Reporting; and
• Other employment-related activities.

Customers are responsible for ensuring that their use of WorkPhelo complies with applicable employment and data protection laws.

Datrix does not determine employment decisions made by Customers based on information processed through WorkPhelo.

25. Payment information

Where payments are made for WorkPhelo, payment information may be processed by third-party payment providers.

Where appropriate, Datrix may not directly store complete payment card information.

Payment providers may process information according to their own privacy policies and applicable security requirements.

26. Third-party links and integrations

WorkPhelo may provide integrations or links to third-party services.

This Privacy Policy does not govern the privacy practices of independent third parties.

Customers and Users should review the privacy policies of third-party services before providing them with personal information.

27. Confidentiality

In addition to this Privacy Policy, Datrix may be subject to contractual confidentiality obligations relating to Customer Data.

Customer business information will not be publicly disclosed except:

• With appropriate authorisation;
• As necessary to provide WorkPhelo;
• Where required by law;
• Where necessary to protect legal rights; or
• In appropriately aggregated or anonymised form where permitted.

28. Data protection compliance

Datrix is committed to implementing appropriate policies, procedures, technical safeguards, and organisational controls to support compliance with applicable data protection laws.

The Ghana Data Protection Commission states that organisations processing personal data are required to register with the Commission and that data controllers/processors should appoint and train a Data Protection Supervisor and publish an organisational privacy policy.

Datrix will maintain the appropriate registration, governance, and compliance arrangements applicable to its role and activities.

29. Data processing agreements

For Customers requiring additional contractual data protection commitments, Datrix may enter into a separate Data Processing Agreement (DPA).

A DPA may specify:

• Categories of personal data;
• Categories of data subjects;
• Processing purposes;
• Security measures;
• Sub-processors;
• International transfers;
• Data retention;
• Data deletion;
• Data-subject requests;
• Security incidents; and
• Other data protection obligations.

Where applicable, the DPA will supplement this Privacy Policy and the WorkPhelo Terms of Service.

30. Privacy by design

Datrix aims to incorporate privacy and security considerations into the design and development of WorkPhelo.

This may include:

• Role-based access controls;
• Data minimisation;
• Permission management;
• Secure authentication;
• Audit logging;
• Secure development practices;
• Data retention controls; and
• Security testing.

31. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to WorkPhelo;
• Changes in applicable law;
• Changes to our processing activities;
• Security improvements;
• Regulatory requirements; or
• Changes to our business practices.

Where appropriate, we will notify Customers of material changes through WorkPhelo, email, our website, or another appropriate communication method.

The updated Privacy Policy will become effective on the date stated at the beginning of the revised Policy.

32. Complaints

If you believe that your personal data has been processed unlawfully or that your privacy rights have been violated, you should first contact Datrix so that we can investigate and attempt to resolve the matter.

You may also have the right to lodge a complaint with the Data Protection Commission of Ghana, which is responsible for regulating and enforcing Ghana’s data protection framework.

33. Contact us

For privacy questions, requests, complaints, or concerns, contact:

• Datrix Tech Solutions Limited
• Product: WorkPhelo
• Website: https://workphelo.com
• Privacy Email: info@workphelo.com
• Support Email: support@workphelo.com
• Telephone: 0509753133
• Address: No. 8 ARS Avenue Ogbojo-East legon
• Data Protection Supervisor: Daniel Sarkodie Duah
• DPS Email: dsp@datrixtechsolutions.com

Privacy acknowledgement

By using WorkPhelo, you acknowledge that you have read and understood this Privacy Policy.

Where consent is required by applicable law, your consent will be obtained through an appropriate mechanism before the relevant processing takes place.