Skip to content
HomeLegal & Compliance

Privacy Policy

How Nopexo collects, safeguards, processes, and protects personal data under Ghana's Data Protection Act, 2012 (Act 843).

Effective Date: November 8, 2026Jurisdiction: Republic of Ghana (NCA & DPC)Operated by: NexHub 360 Ltd.
Terms of ServicePrivacy PolicyAcceptable Use Policy (AUP)

1. Legal Framework & Regulatory Commitment

NexHub 360 Ltd. ("Nopexo", "we", "us") is committed to protecting the privacy, confidentiality, and security of personal data entrusted to us.

This Privacy Policy describes our practices in compliance with the Data Protection Act, 2012 (Act 843) of the Republic of Ghana, National Communications Authority (NCA) guidelines, and applicable international privacy standards.

Roles in Data Processing:

Data Controller: For information collected about our customers, account users, and organization administrators (such as billing and login records), NexHub 360 acts as a Data Controller.
Data Processor: For phone numbers, audience contact lists, and message text transmitted by our customers to mobile subscribers, our customer is the Data Controller, and Nopexo acts strictly as a Data Processor.

Data Protection Act, 2012 (Act 843)

Nopexo adheres to the core data protection principles established by the Ghana Data Protection Commission (DPC): accountability, lawfulness, purpose specification, data quality, security safeguards, and data subject participation.

2. Information We Collect

We collect only the minimum personal data necessary to provide resilient communications and financial ledger services:

A. Account & Profile Information: Full name, business email address, authorized Ghana telephone number, organization legal name, country, and hashed authentication credentials.

B. Financial & Transactional Data: Top-up amounts, payment gateway references (e.g. Paystack or Mobile Money references), ledger audit logs, and transaction timestamps. We never store raw debit/credit card numbers or Mobile Money PINs on our servers.

C. Communications Metadata: Recipient telephone numbers formatted in E.164 standard (e.g. +233XXXXXXXXX), destination network operators (MTN, Telecel, AT), message segment metrics, delivery status timestamps, and error codes.

D. Technical & Security Telemetry: IP addresses, browser user agents, API key identifiers (`prefix`), request duration, and API trace IDs (`X-Request-Id`).

3. Zero-Knowledge OTP Verification Security

Nopexo Verify is engineered specifically to prevent internal or unauthorized interception of sensitive verification credentials:

Zero Plaintext Storage: One-time password (OTP) codes are never saved in plaintext in our database. Only cryptographically salted one-way hashes are retained for verification matching.
Ephemeral SMS Bodies: SMS message bodies containing OTP challenge codes are sealed with AES-256-GCM encryption in memory during queue dispatch and permanently erased from disk immediately upon dispatch.
Masked Logs: Phone numbers in customer verification logs and staff administrative screens are masked (e.g. +233 24 ••• ••89) to prevent unauthorized employee inspection.

Zero Plaintext Verification

Neither Nopexo engineering staff nor administrative operators can view your users' active OTP codes at any point in the verification lifecycle.

4. Purposes & Legal Bases for Processing

We process personal data only when a lawful basis exists under Act 843:

Contractual Performance: Delivering SMS messages, dispatching OTP challenges, issuing webhooks, and managing wallet transactions.
Regulatory & Telecommunications Compliance: Retaining message transmission audit trails as required by telecommunications laws and lawful intercept regulations in Ghana.
Fraud Prevention & Network Security: Detecting brute-force verification attacks, identifying fraudulent traffic pumping (AIT), and enforcing rate limits.
Customer Support & System Alerts: Sending critical platform maintenance notices, low-balance warnings, and responding to support tickets.

5. Data Sharing & Third-Party Processors

We do not sell, rent, monetize, or trade customer contact lists or recipient numbers to advertising brokers or third parties.

We share data strictly with authorized infrastructure partners necessary for service delivery:

Upstream Telecommunications Aggregators & Carriers: We route messages to certified telecommunications gateways (including Sailup) and direct carrier connections with Ghanaian Mobile Network Operators (MTN Ghana, Telecel Ghana, AirtelTigo/AT).
Payment Processors: Verified third-party payment gateways (e.g., Paystack) to authorize card and Mobile Money collections.
Regulatory & Law Enforcement: We may disclose message transmission records if compelled by a lawful court order, subpoena, or statutory warrant from a recognized Ghanaian law enforcement or regulatory agency.

6. Security Architecture & Safeguards

Nopexo employs defense-in-depth technical and organizational controls to protect personal data:

TLS 1.3 Encryption: All communications with our web applications and APIs are enforced via HTTPS with Strict Transport Security (HSTS).
AES-256-GCM at Rest: Sensitive webhook secrets and database credentials are encrypted at rest with hardware-backed encryption keys.
Mandatory TOTP Multi-Factor Authentication: All internal staff and operations administrators must authenticate with hardware-backed or app-based TOTP two-step verification.
Tenant Database Isolation: Every query executed by the platform API explicitly scopes records to the authenticated `organizationId`, preventing cross-tenant data exposure.
Immutable Audit Logging: All administrative actions, wallet adjustments, and role modifications are recorded in an append-only audit trail protected by database-level triggers.

7. Data Retention & Deletion

API Request Telemetry: Detailed API request logs and trace metadata are retained for thirty (30) days and automatically purged thereafter.
Message Delivery Records: Message delivery status records and timestamps are retained for ninety (90) days to support customer delivery queries and carrier reconciliation, after which content is purged and metadata is aggregated.
Financial & Ledger Data: Double-entry ledger entries and payment records are maintained for seven (7) years to satisfy statutory tax, accounting, and audit compliance under Ghanaian law.
Contact Audiences: Customers maintain full control over audience contact records, CSV imports, and suppression lists, and may delete individual contacts or groups at any time.

8. Rights of Data Subjects (Act 843)

Under the Ghana Data Protection Act, 2012 (Act 843), individuals whose data is processed have enforceable rights:

Right to Access: You may request confirmation of whether personal data concerning you is being processed and obtain a copy of that data.
Right to Rectification: You may request correction of inaccurate, misleading, or outdated personal information.
Right to Erasure & Objection: You may object to the processing of personal data for direct marketing purposes. When a recipient opts out, Nopexo immediately registers the number on an automated suppression list.
Right to Complain: You have the right to lodge a formal complaint with the Data Protection Commission (DPC) of Ghana if you believe your privacy rights have been infringed.

9. Data Protection Officer (DPO) Contact

For privacy inquiries, data subject access requests (DSAR), or regulatory correspondence, please contact our Data Protection Officer:

NexHub 360 Ltd. — Attention: Data Protection Officer

Email: privacy@nopexo.com | dpo@nexhub360.com

Address: NexHub 360, Accra, Greater Accra Region, Ghana

Have questions regarding these policies?

Our legal and data compliance team is available to assist you with compliance inquiries or enterprise DPAs.

Contact Legal