Privacy Policy

2.1 Who This Policy Applies To

This Policy applies to:

• • Organisers who create and manage fundraising campaigns
• • Beneficiaries who receive funds from campaigns
• • Donors who contribute to campaigns
• • Visitors who browse the platform without creating an account

2.2 What This Policy Does Not Cover

This Policy does not apply to:

• • Third-party websites or services linked from our Platform
• • Payment processors (Paystack, Flutterwave) operating under their own privacy terms
• • SMS/email service providers with independent privacy policies
• • Campaign Organisers' external activities outside BloomFund

3.1 Information You Provide Directly

When you register, create campaigns, donate, or withdraw funds, you provide:

• • Account Information: Full name, email address, phone number, password, country
• • Campaign Details: Title, description, category, target amount, images, videos, updates
• • Donation Information: Amount, payment method, donor message, anonymity preference
• • Financial Details: Bank or mobile money account details for withdrawals
• • Verification Documents: National ID, passport, business registration, proof of address
• • Communications: Messages, support inquiries, feedback

3.2 Information Automatically Collected

When you use BloomFund, we automatically collect:

• • Device type, browser, operating system
• • IP address and approximate location (for security and fraud prevention)
• • Pages visited, time spent, and interaction patterns
• • Login timestamps and authentication events
• • Session data for platform performance monitoring

We do not collect biometric data, precise GPS tracking, or sensitive health information unless you explicitly provide it in campaign content.

3.3 Information from Third Parties

We may receive data from:

• • Payment Partners: Transaction confirmations, payment status, refunds
• • Verification Providers: KYC/AML verification results
• • Firebase/Google Analytics: Aggregated usage statistics (anonymized)
• • Public Databases: For verifying organizational legitimacy

4.1 Service Delivery

• • Creating and managing user accounts
• • Processing donations and facilitating campaigns
• • Processing fund withdrawals to verified accounts
• • Displaying campaigns to potential donors
• • Sending transactional emails and SMS notifications

4.2 Verification and Compliance

• • Conducting Know-Your-Customer (KYC) and Anti-Money Laundering (AML) checks
• • Verifying identity of organisers and beneficiaries
• • Preventing fraud, identity theft, and platform misuse
• • Meeting legal obligations under Ghanaian financial regulations

4.3 Communication and Support

• • Sending payment confirmations and receipts
• • Notifying you of campaign updates and milestones
• • Responding to customer support inquiries
• • Sending important account and security notifications

4.4 Platform Improvement

• • Analyzing user behavior to improve user experience
• • Identifying and fixing technical issues
• • Developing new features and services
• • Conducting internal research and statistical analysis

4.5 Legal and Safety

• • Complying with legal requests from authorities
• • Enforcing our Terms and Conditions
• • Protecting against fraud and abuse
• • Maintaining financial records for tax and audit purposes

6.1 Payment Processing

We share necessary information with regulated payment processors (Paystack, Flutterwave, mobile money operators) to facilitate donations and withdrawals securely.

6.2 Verification and Compliance

We may share verification documents with authorized KYC/AML service providers and regulatory bodies such as the Bank of Ghana or Financial Intelligence Centre when required by law.

6.3 Campaign Organisers

Donor names, amounts, and messages are visible to campaign organisers unless you choose to donate anonymously. Organisers may use this information only for campaign-related communication.

6.4 Service Providers

We use trusted third-party providers for hosting (Firebase), analytics (Google Analytics), email (Resend), SMS (Twilio), and authentication—all bound by strict confidentiality agreements.

6.5 Legal Requirements

We may disclose information if required by court order, subpoena, or to protect against fraud, harm, or unlawful activities, or to comply with legal obligations.

6.6 Business Transfers

In the event of a merger, acquisition, or sale of assets, user data may be transferred under equivalent privacy protections and obligations.

Specific Retention Periods:

• • Account Information: Retained while account is active + 7 years after closure
• • Transaction Records: Minimum 7 years for tax and financial reporting requirements
• • Verification Documents: Retained while account is active + 5 years for compliance
• • Support Communications: 3 years for quality assurance and legal protection
• • Campaign Data: Retained indefinitely for public transparency unless deletion requested

11.1 Technical Safeguards

• • HTTPS/TLS encryption for all data transmission
• • Data encryption at rest using Firebase security standards
• • Secure password hashing with bcrypt
• • Multi-factor authentication options
• • Regular security updates and patches
• • Firewall and intrusion detection systems

11.2 Organizational Safeguards

• • Role-based access controls limiting data access to authorized personnel only
• • Confidentiality agreements for all staff and contractors
• • Regular security training for team members
• • Security audits and vulnerability assessments
• • Incident response and breach notification procedures

12.1 Right to Access

Request details of personal data we hold about you, including how we use it and with whom we share it.

12.2 Right to Rectification

Correct inaccurate or incomplete personal information. You can update most information through your account settings.

12.3 Right to Erasure

Request deletion of your personal data, subject to legal retention requirements for financial records, fraud prevention, and regulatory compliance.

12.4 Right to Restriction

Request limitation of processing in certain circumstances, such as while disputing data accuracy.

12.5 Right to Data Portability

Receive your personal data in a structured, commonly used format and transmit it to another controller.

12.6 Right to Withdraw Consent

Revoke permissions for marketing communications or other consent-based processing at any time.

12.7 Right to Object

Object to processing based on legitimate interests or for direct marketing purposes.

12.8 Right to Complain

File a complaint with the Ghana Data Protection Commission or your local supervisory authority.

14.1 Transactional Communications

We send essential service communications related to your account, donations, withdrawals, and security (e.g., payment confirmations, verification requests). These cannot be opted out of as they are necessary for service delivery.

14.2 Marketing Communications

With your consent, we may send:

• • Campaign updates and success stories
• • Platform feature announcements
• • Fundraising tips and best practices
• • Relevant campaigns that may interest you

14.3 Opt-Out Options

You can unsubscribe from marketing communications at any time by:

• • Clicking the "unsubscribe" link in any marketing email
• • Adjusting your notification preferences in account settings
• • Contacting us at privacy@bloomgh.com

16.1 Organiser Obligations

Campaign organisers agree to:

• • Use donor data only for campaign-related communication and gratitude
• • Not share donor information with third parties without consent
• • Not use donor data for unrelated marketing or solicitation
• • Comply with applicable data protection laws
• • Respect donor anonymity preferences

16.2 Anonymous Donations

When you choose to donate anonymously, your name is hidden from the public campaign page but organisers may still see limited transaction information for verification purposes. BloomFund always retains full transaction records for compliance.

18.1 Ghana

Your rights are protected under the Data Protection Act, 2012 (Act 843) and enforced by the Ghana Data Protection Commission (DPC). You may contact the DPC at www.dataprotection.org.gh

18.2 European Union and United Kingdom

If you reside in the EU/UK, you have additional rights under GDPR/UK GDPR, including data portability and the right to lodge complaints with your supervisory authority. BloomFund ensures lawful transfer mechanisms through Standard Contractual Clauses.

18.3 Other Jurisdictions

For users in other countries, BloomFund applies equivalent protections in line with applicable national privacy frameworks and international best practices.