INTRODUCTION
Lastmal Technologies (“Lastmal”, “we”, “us”, or “our”) operates a Merchant Credit Intelligence platform that helps SMEs build a verified record of their business activity, and helps financial institutions assess that activity for credit and financing decisions. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your information. It applies to our website, our application, and our Merchant Credit Intelligence services (together, the “Services”). This Privacy Policy is issued in accordance with Ghana’s Data Protection Act, 2012 (Act 843), and should be read alongside our Terms of Use and, for merchants participating in our Merchant Credit Intelligence programme, our Data Use and Sharing agreement.INFORMATION WE COLLECT
1.1 Information You Provide Directly• Identity and contact information: name, business name, address, phone number, and email address
• Account and registration information
• Information provided when you contact us, complete a survey, or give us feedback
1.2 Business and Transaction Information
As part of providing our Services, and where you operate as a merchant on the Lastmal platform, we collect:
• Transaction data, including order volumes, values, and frequency
• Payment method information for each transaction (mobile money, bank transfer, card, or cash on delivery), verified through our payment gateway partners
• Fulfilment and delivery data, including delivery completion and reliability records
• Business activity data, including operating history, geographic reach, and sales channel information
• Verification and questionnaire responses you provide to support your business evidence profile
HOW WE USE INFORMATION
We use the information we collect to:• Provide and operate our commerce, logistics, and Merchant Credit Intelligence Services
• Build and maintain a verified business evidence profile for merchants participating in the Merchant
Credit Intelligence programme
• Send service-related communications, such as order confirmations, account notices, and security alerts
• Verify transaction and payment information through our payment gateway partners
• Improve our Services through research, testing, and product development
• Detect and prevent fraud and protect the security of our Services
• Meet our legal and regulatory obligations
We do not use merchant business or transaction data for advertising or marketing purposes. Where we send promotional communications, this is limited to general service updates and is subject to your marketing preferences, which you may opt out of at any time.
HOW WE SHARE INFORMATION
We share information only in the circumstances described below. We do not sell personal or business data to third parties.3.1 Financial Institutions (Merchant Credit Intelligence)
Where you are a merchant participating in our Merchant Credit Intelligence programme, we share a structured business evidence profile with financial institutions for the purpose of credit assessment. This profile is derived from your transaction, business activity, and operational data — it does not include your raw transaction records.
• Sharing with a financial institution requires your consent, as set out in our Data Use and Sharing Agreement
• Financial institutions make their own independent credit decisions; Lastmal does not make or influence those decisions
• Lastmal does not act as a financial agent, broker, or intermediary in any credit transaction
3.2 Research Collaborators
We work with research institutions to validate and improve the methodology behind our Merchant Credit Intelligence framework, including a research collaboration with The Chinese University of Hong Kong, Shenzhen (CUHK-Shenzhen). Where this involves data that originates from Ghana:
• Data is aggregated or anonymised wherever possible before being used for research purposes
• Where anonymisation is not possible, data is pseudonymised, and Lastmal retains sole control of any identifying key
• Any transfer of data outside Ghana for this purpose is governed by a Data Processing Agreement that establishes contractual safeguards consistent with Ghana’s Data Protection Act, 2012
3.3 Service Providers
We share information with service providers who support our operations, including payment processors, delivery partners, software and infrastructure providers, and professional advisors. These providers are bound by confidentiality obligations and may only use your information to perform services on our behalf.
3.4 Legal and Safety Purposes
We may disclose information where required to comply with a legal obligation, to protect the rights, property, or safety of Lastmal, our merchants, or others, or in connection with the detection and prevention of fraud or other unlawful activity.
3.5 Business Transfers
If Lastmal is involved in a merger, acquisition, financing, or sale of business assets, information may be disclosed or transferred as part of that transaction. Any such transfer remains subject to the protections described in this Privacy Policy.
DATA RETENTION
We retain personal and business information for as long as necessary to provide our Services and fulfil the purposes described in this Privacy Policy. As a general matter:• Merchant account and transaction data is retained for the duration of your active relationship with Lastmal, and for 24 months thereafter
• Information shared with financial institutions is subject to that institution’s own retention policies
• Anonymised or aggregated data used for research and methodology purposes may be retained indefinitely, as it cannot be used to identify a specific merchant or individual
Where you withdraw consent or request deletion of your data, we will delete or anonymise it within a reasonable period, except where we are required to retain it to meet a legal obligation.
HOW WE PROTECT YOUR INFORMATION
We use appropriate technical and organisational measures to protect the information we hold, including encryption of data in transit and at rest, restricted access controls, and regular review of our security practices. Payment information is verified and processed through regulated payment gateway partners rather than stored directly by Lastmal where possible.No system can be guaranteed completely secure. We will notify affected individuals and relevant regulatory authorities in the event of a data breach affecting personal information, in accordance with our legal obligations.