JumaLink Privacy Notice

Version 2026-09-04

Effective: 4 September 2026

This notice explains how JumaLink collects, uses, and protects personal data in its mobile application, website, management tools, and marketplace services (the "Platform"), and what rights you have over that data.

JumaLink is the data controller for the processing described here. We aim to process personal data in accordance with Ghana's Data Protection Act, 2012 (Act 843). Please read this notice alongside the JumaLink Terms of Service.

1. Personal data we collect

Depending on how you use the Platform, we collect:

  • Account and contact data, including your name, email address, phone number, account type, authentication identifiers, and consent records;
  • Profile and marketplace data, including an artisan bio, services, prices, portfolio images and videos, verification status, coarse city or region, job history, and eligible reviews;
  • Job and communication data, including requests, agreed amounts, state-change history, messages, reports, blocks, feedback, and support correspondence;
  • Location data, when you grant permission, including device coordinates, a formatted address, and locations recorded in connection with a job. Exact coordinates are used for location and job features but are never included in public artisan listings, where distance is shown from a coarse fallback-city location in five-kilometre bands;
  • Device and technical data, including app version, operating system, a per-install device identifier, push token, crash and error context, and privacy-minimised product events; and
  • Records of safety and administrative activity, needed to investigate fraud, safety incidents, disputes, account deletion, and staff actions.

We do not ask analytics services to capture report text, chat content, precise location, access tokens, passwords, or one-time codes, and session replay is not enabled. Please do not put unnecessary sensitive information into free-text messages, reports, reviews, or feedback.

2. How we use your personal data

We use personal data to create and secure accounts; show marketplace profiles; match clients and artisans; operate messages, jobs, completion confirmation, reviews, support, reports, and blocking; verify job activity and investigate reports, disputes, and fraud; send the notifications you ask for; improve reliability; detect and prevent abuse; enforce our Terms; and meet our legal obligations.

3. Our legal bases for processing

Depending on the activity, we rely on:

  • performance of our contract with you, to provide the Platform and the features you use;
  • your consent, for optional processing such as location or marketing. You may withdraw consent at any time, although doing so may disable the related feature;
  • our legitimate interests in operating a safe, secure, and reliable service; or
  • compliance with a legal obligation.

Acceptance of the current Terms and Privacy Notice is required for marketplace participation.

4. Information that is public or shared

An active artisan's name, photo, bio, service catalogue, portfolio, coarse location, verification status, completed-job count, and eligible reviews may be public. Contact details, exact coordinates, and formatted addresses are never part of a public profile.

Clients and artisans involved in the same job or conversation receive the information they need to communicate and complete it.

When an artisan marks a job complete, we may share with the client what our checks indicate about that completion. We do not disclose either party's coordinates or address to the other.

Authorised staff may access data needed for support, moderation, verification, security, and account administration; that access is role-restricted and audited.

5. Service providers and international transfers

We use service providers only as needed to operate JumaLink. They act on our instructions under a written agreement, receive only the data their purpose requires, and may not use it for their own purposes. They support account authentication and secure data hosting, media hosting and delivery, push notifications, privacy-minimised product analytics, maps and location features, and transactional email.

The current list of these providers, with the purpose and processing location of each, is published at https://jumalink.com/subprocessors and is updated whenever a provider changes.

These providers may process personal data outside Ghana. We assess each provider's safeguards and limit the data sent to it. We may also disclose information where required by law, court order, or an authorised regulator. We do not sell personal data, and we do not share it with third-party advertising brokers.

6. How long we keep your data

While your account is active, we keep information for the purposes described above.

Location recorded for a job is kept with that job record, so that a report or dispute raised later can be investigated.

When an in-app account deletion succeeds, we immediately revoke active sessions and push tokens, remove profile and portfolio objects from our media provider and legacy storage, disable sign-in, and scrub direct profile identifiers. Soft-deleted profile content is physically purged after 30 days.

An anonymised account, job, report, consent, and audit shell may be retained for up to 90 days for dispute, fraud, security, and compliance purposes. If a deletion at a media provider is still failing at that point, final purging may be deferred only while the deletion is retried and monitored, and completes once cleanup succeeds. A longer period may be required by law. Backups age out on our infrastructure provider's separate backup cycle and are not restored for ordinary product use.

7. Your rights

Under the Data Protection Act, 2012 (Act 843), you may ask us to:

  • confirm whether we hold personal data about you, and give you access to it;
  • correct data that is inaccurate or incomplete;
  • provide a portable export of your data;
  • delete data we have no authority to retain;
  • object to, or restrict, certain processing; or
  • withdraw a consent you previously gave.

We may need to verify your identity before acting on a request, and we may retain a limited record where the law or a legitimate dispute requires it. If you are not satisfied with our response, you may complain to Ghana's Data Protection Commission.

8. Accessing, exporting, and deleting your data

The app lets you update your profile, request a portable export, and delete your account.

An export covers the account data we can safely associate with you: your profile; your legal acceptances and consent records; your artisan application, services, and portfolio if you have one; your jobs and their history; your conversations and the messages you wrote; reviews you wrote and reviews about you; blocks, reports, and feedback you submitted; your data requests; your registered devices; your uploaded media; and your account activity log.

A job record includes where the work was, at the level of detail you were shown in the app, and the result of any location check recorded against the job. A client's copy of a job carries the address they gave; an artisan's copy carries only what the app disclosed to them, which is an approximate area before they accepted the job.

An export does not include passwords, password hashes, access or refresh tokens, one-time codes, encryption secrets, internal security signals, other users' private data, or confidential staff investigation notes. Those exclusions are listed in the export itself.

9. How we protect your data

We use least-privilege access controls, restricted staff roles with multi-factor authentication, secure device credential storage, transport encryption, audit logs, validated and size-limited media uploads, and data minimisation.

No system can guarantee absolute security. If we identify unauthorised access that requires notification, we will follow our incident process and notify the Data Protection Commission and the people affected, as required.

10. Children

The Platform is intended for adults. You must be at least 18 to create an account, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this notice

We may update this notice as the Platform, our providers, or the law change. We will identify a material change by updating the effective date and publishing a new version, and where appropriate we will ask active users to accept it before continuing to use the marketplace.

12. How to contact us

Questions and privacy requests: support@jumalink.com

You may also contact Ghana's Data Protection Commission through its official website at https://dataprotection.org.gh/.