Privacy Policy

Last updated: 2026-05-17 · Governed by the laws of the Republic of Ghana

1. Who we are

The service is operated jointly by Activa International Insurance Ghana Ltd. (the underwriter, licensed by the National Insurance Commission of Ghana), LTX Technologies (the technology platform), and MTN Ghana (the distribution and payments channel). For the purposes of the Data Protection Act, 2012 (Act 843), Activa is the primary data controller and LTX is the data processor.

2. What data we collect

Information you give us

• Identity: full name, date of birth, Ghana Card number, region, language.
• Contact: MTN MoMo MSISDN, email address, optional alternative phone.
• Biometric verification artefacts: a live selfie and a photo of the front (and optionally the back) of your Ghana Card, used only for face matching at enrolment.
• Claim evidence: SMS screenshots, police reports, receipts, or other files you upload when filing a claim.

Information collected automatically

• Transaction metadata: wallet identifier, premium amount, debit reference, success/failure result.
• Fraud signals: claim frequency, device fingerprint, score from our risk model.
• Technical: IP address, user-agent, session timing, audit-log entries of every privileged action.

Information from third parties

• MTN KYC API: the registered name and region tied to your MoMo wallet.
• Sanctions screening: name-match results from public sanctions/PEP datasets (OpenSanctions or equivalent).

3. Why we collect it

1. To provide cover. KYC, premium debit, claim payout, fraud prevention, customer support.
2. To meet our regulatory obligations. NIC reporting (Schedules 5 and 7), Bank of Ghana payment-system rules, anti-money-laundering screening, DPA record-keeping.
3. To improve the product. Aggregate, de-identified analytics — never used to single you out.

We do not sell your personal data to third parties.

4. Who we share it with

• MTN Ghana — to debit premiums and settle claim payouts to your wallet.
• Reinsurers and co-insurers — only the minimum claim metadata needed to settle their share (no biometric files).
• Service providers under contract — cloud hosting (data localised in Ghana where regulator-required), email delivery, SMS gateway. All bound by written DPA-compliant processing agreements.
• Regulators and law enforcement — only when compelled by Ghanaian law or a valid court order.

5. How long we keep it

• Active policy records: for the life of the policy plus 7 years after cancellation (NIC requirement).
• Claim records: 7 years after final settlement.
• Biometric verification files (selfie + card photo): deleted within 30 days of successful enrolment; only the verification result (pass/fail + score) is retained.
• Audit logs: 5 years, append-only with cryptographic hash-chaining.
• Marketing-list opt-ins: until you withdraw consent.

6. Your rights under the Ghana DPA

You have the right to:

• Access the personal data we hold about you — request a copy at any time.
• Correct inaccurate or outdated data.
• Object to processing for direct marketing.
• Withdraw consent where processing relies on consent (this may end your cover).
• Erasure after cancelling your policy and once retention obligations expire.
• Lodge a complaint with the Data Protection Commission of Ghana (dataprotection.org.gh).

Export and erasure are available self-service from the portal at Privacy & data when signed in.

7. How we protect it

• TLS 1.2+ for all transport; AES-256 at rest for biometric artefacts.
• Ghana Card numbers and other identifiers are field-level encrypted in the database.
• Staff access gated by role, two-factor authentication, and audit-logged.
• Quarterly penetration tests; annual SOC-equivalent control review.
• Sub-processors are vetted and contractually bound by the same standards.

8. Contact us

Data Protection Officer: support@ltx-momo.test
Phone: +233 30 000 0000
Postal: Activa International Insurance Ghana Ltd., Accra, Ghana.

If you have a security concern in particular, see our Vulnerability Disclosure Policy.