Privacy Policy

1.Who we are

MData Consult is a Ghana-registered technology and data consultancy specialising in Artificial Intelligence (AI), Advanced Analytics and Business Intelligence (BI) solutions. We help organisations harness the power of data, AI and emerging technologies to transform decision-making, optimise operations, enhance customer experience and drive sustainable business performance.

Our capabilities span AI and Machine Learning solutions, predictive and prescriptive analytics, Business Intelligence and interactive dashboards, data strategy and governance, process automation, decision-support systems, and digital transformation advisory. We also provide specialised consultancy and executive and professional training designed to strengthen organisational capabilities in AI, analytics and data-driven decision-making.

Combining technology, analytics and business expertise, MData Consult develops practical, scalable and context-driven solutions that transform complex data into actionable intelligence and measurable business value.

MData Consult is registered in Ghana, with its registered address at Flat 8, Adenta Frafraha, Ashiyie, Accra, Ghana. We are registered as a data controller with the Data Protection Commission of Ghana.

2.Personal data we collect

2.1 Data you give us directly

Contact and consultation forms. When you complete a contact or consultation form, we collect your first name, last name, email address, subject line and the contents of your message.

Business enquiries. When you contact us by phone, email or otherwise, we collect the information you choose to share, which may include your name, job title, organisation, telephone number, email address and the details of your enquiry.

Training registration. When you register for a training or certification programme, we collect your name, contact details, organisation and role, and we keep records of attendance, assessment and certification.

Events and webinars. When you register for an event or webinar, we collect your name, email address, organisation, role and any other details requested on the registration form, together with records of your attendance. If we record an event or webinar, we will tell you before recording starts.

Newsletter. When you subscribe to our newsletter, we collect your email address and, where provided, your name.

2.2 Data collected automatically

When you visit this website, our hosting infrastructure and website software automatically record technical information, including:

• IP address
• Browser type and version
• Device type and operating system
• Pages requested and referring website
• Date and time of access

We use this information for security, troubleshooting and keeping the website available. We do not use it to identify individual visitors, except where necessary to investigate a security incident. We do not use analytics or advertising tracking tools on this website.

2.3 Client data we process on behalf of others

In the course of delivering AI, business intelligence, analytics and consultancy engagements, we may access, host or process datasets belonging to our clients. Those datasets sometimes contain personal data relating to our clients’ own customers, employees or stakeholders.

In those engagements MData Consult acts as a data processor, not a data controller. We process such data only on the documented instructions of the client, under a written contract or data processing agreement that sets out the scope, purpose, security measures and retention period. The client remains the data controller and is responsible for the lawful basis of that processing and for responding to data subject requests. If you believe your personal data is held in a dataset we process for a client, please contact that organisation directly, or contact us and we will refer you to them.

3.Why we process personal data and our lawful basis

We do not sell personal data. We do not use personal data collected through this website, or through our training, events or newsletter, for automated decision-making or profiling that produces legal or similarly significant effects.

4.Use of AI tools

As an AI and analytics consultancy, we use third-party AI tools, including large language model services, to support our work. Typical uses include drafting and summarising documents, writing and reviewing code, and supporting analysis.

When we use these tools:

• We limit any personal data we enter to what the task requires.
• We do not enter personal data from client datasets unless the client has authorised this under the terms of our engagement.
• Our team reviews AI-generated output before it is relied on or shared with clients.
• We do not use AI tools to make decisions about individuals that produce legal or similarly significant effects.

AI tool providers act as our service providers and may process data outside Ghana. See section 7 for how we handle international transfers.

5.Cookies and third-party content

This website is built on WordPress and uses only strictly necessary cookies. These are required for the website to function, including session management and form security, and cannot be switched off through our site. We do not use analytics, advertising or tracking cookies.

You can control or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the website from working correctly.

Some pages on this website load content from third parties, including Microsoft Power BI reports, Google Maps and Google Fonts. When you view a page containing this content, the third party may set its own cookies or receive your IP address. Their processing is governed by their own privacy policies, not by this one.

6.Who we share personal data with

We disclose personal data only where necessary, and only to the following categories of recipient:

• Service providers. Website hosting, email, cloud storage, newsletter and email platforms, event and webinar platforms, AI tools and business intelligence platforms that process data on our instructions under contract.
• Subcontractors. Associate consultants and trainers who help us deliver engagements, bound by confidentiality obligations.
• Professional advisers. Accountants, auditors, insurers and lawyers, where required.
• Regulators and law enforcement. Where we are required to disclose by law, court order or a lawful regulatory request.
• A successor entity. In connection with a merger, acquisition or transfer of all or part of our business, subject to the protections in this policy.

We require every service provider and subcontractor to apply appropriate security measures and to process personal data only for the purpose for which it was disclosed.

7.International transfers

We are based in Ghana. Some of the service providers we use, including cloud hosting, email and AI tool providers, operate servers in other countries, including in the European Union and the United States.

Where we engage a service provider based outside Ghana, we require it by contract to process personal data in line with the Data Protection Act, 2012 (Act 843) and to protect it with appropriate security measures.

Where personal data of individuals in the European Union or the United Kingdom is transferred to us in Ghana, or onward to another country, we rely on the Standard Contractual Clauses approved by the European Commission and, for the United Kingdom, the International Data Transfer Agreement or the UK Addendum to those clauses, or another transfer mechanism recognised under the applicable law. You can request a copy of the relevant safeguards by contacting us.

8.How long we keep personal data

We retain personal data only for as long as necessary for the purpose it was collected, or for as long as the law requires.

• Website enquiries that do not lead to an engagement: 24 months from the date of last contact
• Newsletter subscriptions: until you unsubscribe. We keep your email address on a suppression list afterwards so that we do not contact you again
• Event and webinar registrations: 24 months from the date of the event
• Training and certification records: 5 years, so certification can be verified
• Client records and engagement documentation: the duration of the engagement plus 6 years
• Financial and tax records: for the period required under Ghanaian tax law
• Client datasets processed under contract: the period agreed in the relevant data processing agreement, after which the data is returned or securely destroyed
• Website server logs: 12 months

When a retention period ends, we securely delete or irreversibly anonymise the data.

9.How we protect personal data

We apply technical and organisational measures appropriate to the sensitivity of the data we handle, including:

• Encryption of data in transit using TLS
• Access controls, so personal data is available only to staff and subcontractors whose work requires it
• Confidentiality obligations binding all personnel and subcontractors

No system is entirely secure. If a data breach occurs that is likely to affect your rights, we will notify the Data Protection Commission of Ghana and affected individuals as required by the Data Protection Act, 2012 (Act 843). Where the GDPR or UK GDPR applies, we will also notify the relevant supervisory authority and affected individuals within the timeframes those laws require.

10.Your rights

Depending on the law that applies to you, you have the right to:

• Be told whether we hold personal data about you, and receive a description of that data
• Access the personal data we hold about you
• Request correction of data that is inaccurate, out of date, incomplete or misleading
• Request deletion of personal data we no longer have a lawful reason to hold
• Object to the use of your data for direct marketing
• Object to processing that causes, or is likely to cause, unwarranted damage or distress
• Not be subject to a decision based solely on automated processing that significantly affects you
• Withdraw consent at any time, where consent is the basis on which we process your data
• Seek compensation for damage caused by a breach of data protection law
• Complain to a data protection regulator (see section 16)

If you are in the European Union or the United Kingdom, you also have the right to data portability, the right to restrict processing, and the right to object to processing based on our legitimate interests.

To exercise any of these rights, email info@mdataconsultgh.com. We will respond within one month of receiving your request. Where a request is complex, we may extend this period where the law allows, and we will tell you if we do. We may ask you to verify your identity before acting on a request. There is no charge for a reasonable request.

11.Newsletter and marketing

We send our newsletter only to people who have subscribed to it. We send service updates and information about similar services to existing clients, who can opt out at any time.

Every newsletter and marketing email contains an unsubscribe link. You can also opt out at any time by emailing info@mdataconsultgh.com. Opting out does not stop operational messages relating to an active engagement, a training programme or an event you have registered for.

12.Children

This website and our services are directed at businesses, organisations and professionals, not at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

13.Links to other websites

This website contains links to third-party websites and embedded third-party content. We are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policy of any website you visit through a link from ours.

14.Changes to this policy

We may update this Privacy Policy to reflect changes in our services, technology or legal obligations. The current version is always published on this page with the effective date shown at the top. Where a change materially affects how we use your personal data, we will notify you directly where we have the means to do so.

15.How to contact us

For any question about this policy, or to exercise your rights, contact:

16.Complaints to a regulator

We encourage you to contact us first so we can try to resolve your concern. If you are not satisfied with how we have handled your personal data or your request, you may lodge a complaint with a data protection regulator.