Privacy notice

Who is responsible

The Environmental Protection Authority decides why and how your information is used on this portal, and is responsible for it. ACE Technologies builds and runs the portal for EPA and handles your information only on EPA's instructions.

What we collect

• Your account. The name of the person or organisation, its registration number or Ghana Card number, tax identification number, email address, phone number, postal and digital address, and the names and contact details of the people who sign in for it.
• Your applications. Everything you enter on an application form and every document you upload, including the location of the site, and the letters, reports and corrections you send afterwards.
• Your identity check. When you open an account, your Ghana Card number and a live photograph of your face are sent to the National Identification Authority (NIA) to confirm you hold that card. EPA keeps NIA's answer and the name NIA holds for the card. EPA does not keep your photograph.
• Your payments. The invoices raised to you, the amounts, dates and references of your payments, and the mobile money number a payment was made from. Card numbers and mobile money PINs are entered with the payment provider and never reach EPA.
• What EPA records about your application. The officers' assessments, site visits and screening findings, including photographs taken at your site, the decisions made, and the permits and licences issued to you.
• Your messages. Help tickets you send, EPA's replies, and the notices the portal sends you by email and SMS.
• How the portal is used. A record of actions taken on your account and applications, by you and by EPA staff, with the time and who acted. To stop abuse, the portal counts attempts at identity verification and questions to the assistant against a scrambled form of your connection's address; the address itself is not stored with them.

Why we use it

EPA uses this information to carry out its functions under Ghana's environmental protection law: to register you, to receive, assess and decide your applications, to charge and collect fees, to issue permits and licences and keep the public register of them, to check compliance after a permit is issued, and to contact you about any of these. It is also used to keep the portal secure, to investigate misuse, and to produce statistics in which no person or organisation is named.

EPA does not sell your information and does not use it for advertising.

Who receives it

• National Identification Authority: your Ghana Card number and photograph, to verify your identity.
• Payment providers (Payswitch, and Ghana.gov where it is offered): the invoice number, the amount, and the mobile money number or other details you give them to pay.
• The SMS and email carriers that deliver the portal's notices to you: your phone number or email address, and the text of the notice.
• The GhanaPostGPS look-up service: the digital address you give, to find its position. Nothing else about you is sent with it.
• The Ask EPA assistant: the question you type is sent to an artificial intelligence service to be answered. Your account and applications are not sent with it. Do not put personal details in a question.
• Other public bodies, where the law requires or permits EPA to share information with them.
• Anyone who holds a permit's verification code can confirm on this portal that the permit is genuine: they are shown the holder's name, the permit number, what kind of permit it is, the dates it was issued and runs to, and whether it is in force. Nothing else about you is shown.

Where it is kept

The portal and its database run on Amazon Web Services servers in Stockholm, Sweden, in the European Union. Your information is therefore stored outside Ghana. It is encrypted in transit, access is limited to the EPA staff and ACE Technologies engineers who need it, and backups are encrypted. NIA's answers about your identity are additionally encrypted within the database.

How long we keep it

• Your account, applications, payments and the permits issued to you are regulatory records. EPA keeps them for as long as the law requires it to keep such records, which is longer than the life of a permit.
• A registration you start and do not finish is kept so that EPA can help you complete it, and can be deleted at your request.
• A screen capture attached to a fault report is deleted after 30 days.
• Password reset links are deleted a week after they expire, and the counts used to prevent abuse of the assistant after a day.
• The sign-in cookie (EPAPORTALSESS) lasts until you close your browser or sign out. See Cookies.

Your rights

Under the Data Protection Act, 2012 (Act 843) you may ask EPA:

• whether it holds information about you, and for a copy of it;
• to correct information that is wrong or out of date;
• to stop using your information in a way the law does not require, or to delete what it no longer needs. EPA cannot delete records the law requires it to keep.

To make a request, sign in and send a help ticket, or write to or visit any EPA office. EPA may ask you to prove who you are before it answers.

If you are not satisfied with EPA's answer, you may complain to the Data Protection Commission of Ghana.

Changes to this notice

When the portal changes what it collects or whom it tells, this notice is changed at the same time and the date at the top is updated.