This notice applies to personal data collected through the public Makers & Partners website.
Makers & Partners is an audit, tax and business advisory firm operating in Ghana. For personal data collected through this website, M&P is responsible for determining the purposes and means of processing unless a different role is expressly stated in the relevant engagement or arrangement.
This Privacy Notice explains what personal data we collect through our website, why we collect it, how we use and disclose it, how long we retain it, how we protect it, and how you may exercise your rights under the Data Protection Act, 2012 (Act 843).
This notice applies to personal data collected through the public-facing M&P website, including information submitted through contact, careers, event, newsletter or similar website functions.
It does not replace the privacy terms, engagement letters, contractual arrangements or data-processing requirements that apply to personal data processed in connection with a specific audit, tax, advisory, employment or other engagement. Where a specific engagement provides additional privacy information, that information will apply to the relevant processing.
The type of personal data collected depends on how you interact with the website. We aim to collect only information that is necessary, relevant and not excessive for the stated purpose, consistent with section 19 of Act 843.
When you browse the website, certain technical information may be collected automatically by the website or its service providers, depending on the website configuration. This may include IP address, browser type, device type, operating system, referring page, pages visited, approximate usage information and cookie identifiers.
Unless a form expressly requires it for a stated purpose, please do not submit special personal data or other highly sensitive information through general website forms. Where special personal data is required, M&P will identify the purpose and apply the additional safeguards required by applicable law.
We use personal data collected through the website only for identified and legitimate purposes, including the following:
Lawful basis under Act 843.
Under section 20 of Act 843, personal data should not be processed without prior consent unless an applicable exception or justification applies. Depending on the particular processing activity, M&P may rely on prior consent, the necessity of processing for a contract, an authorisation or requirement of law, a statutory duty, protection of a legitimate interest of the data subject, or a legitimate interest of M&P or an applicable third party. The applicable basis will depend on the purpose and circumstances of the processing.
Where we rely on consent.
Where consent is required, M&P will seek it through an appropriate mechanism and will provide a practical way to withdraw it. Withdrawal of consent does not affect processing already carried out lawfully before the withdrawal.
Where practical and appropriate, M&P collects personal data directly from the individual concerned. Information may also be received from another source where Act 843 permits or requires this, where the individual has made the information public, where consent has been given, or where another lawful circumstance applies.
We may also receive information from recruitment platforms, event registration platforms, professional networks or service providers where this is relevant to the purpose for which the information is processed.
The website may use cookies and similar technologies to support essential website functions, remember preferences, maintain security, and understand how visitors use the website. The specific cookies in use may change as the website and its services are updated.
Where non-essential cookies or similar technologies require consent, M&P will provide an appropriate cookie notice and consent mechanism before those technologies are used, where required. You should be able to change or withdraw your cookie preferences through the website consent mechanism where one is provided. You may also manage cookies through your browser settings; disabling some cookies may affect website functionality.
M&P will periodically review the cookies and similar technologies deployed on the website and update the cookie notice or consent settings where necessary. This approach is consistent with the DPC’s current self-assessment approach, which specifically asks organisations whether their websites use cookies, whether an updated cookie notice is provided, whether consent is recorded, and whether consent can be withdrawn.
M&P does not sell personal data. We may disclose or make personal data available where necessary for a stated purpose, to provide a service, to comply with law, or to protect the rights and security of the Firm, our clients or other individuals.
Where a service provider processes personal data on behalf of M&P, M&P will require appropriate contractual confidentiality and security arrangements consistent with applicable requirements. Under section 30 of Act 843, processing by a data processor on behalf of a data controller is to be governed by a written contract and appropriate confidentiality and security measures.
Some technology, cloud, hosting, professional-network or other service providers used by M&P may process or store personal data outside Ghana. Where personal data is transferred or made accessible outside Ghana, M&P will assess the relevant arrangement and apply appropriate safeguards and contractual, legal or technical measures required by applicable law.
Where personal data originates from a foreign jurisdiction, M&P will also consider applicable requirements in that jurisdiction, as contemplated by section 18(2) of Act 843.
M&P maintains technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration, disclosure, destruction or other unlawful processing. The controls applicable to the website and associated information systems may include access controls, authentication, encryption, confidentiality obligations, secure configuration, monitoring, backup and incident-response arrangements.
Security controls are reviewed and improved based on risk, technology, operational changes and identified vulnerabilities. No method of transmission or electronic storage can be guaranteed to be completely secure; however, M&P will take reasonable and appropriate measures to protect personal data under its control.
M&P retains website-related personal data only for as long as necessary for the purpose for which it was collected, or for as long as required or permitted by law, professional obligations, contractual requirements, dispute resolution or legitimate record-keeping needs. Retention periods may therefore differ depending on the category and purpose of the information.
|
Category |
Purpose |
Indicative retention |
|
Website visitor technical data |
Website operation, security and analytics |
Up to 12 months, subject to technical configuration and applicable requirements |
|
Website enquiry/contact data |
Responding to enquiries and maintaining business correspondence |
Up to 24 months after last contact, unless a longer period is justified by law or an ongoing relationship |
|
Job applicant information |
Recruitment and selection |
Up to 6 months after closure of the recruitment process, unless a longer period is justified or agreed |
|
Prospective/existing client contact and engagement information |
Proposal, relationship and service administration |
For the period specified in the applicable engagement/retention requirements |
These periods are indicative and do not override a legal hold, regulatory requirement, contractual obligation, or an approved retention schedule applicable to the relevant record.
Subject to the conditions and exemptions in Act 843, you may have rights including the following:
These rights are not absolute and may be subject to lawful limitations, exemptions or overriding obligations. M&P will assess requests under the applicable provisions of Act 843 and its internal Data Subject Request procedure.
To make a data-subject request, ask a question about this notice, or raise a privacy concern, contact the Data Protection Officer using the details below. We may need to verify your identity before acting on a request in order to protect personal data from unauthorised disclosure.
M&P will record and handle requests through its internal data-subject request process and will communicate the outcome to the requester as appropriate.
We encourage you to contact M&P first so that we can investigate and address your concern. You may also contact the Data Protection Commission of Ghana if you believe your personal-data rights have been infringed or your concern has not been adequately addressed.
Data Protection Commission, Ghana
Pawpaw Street, East Legon, Accra, Ghana
Email: info@dataprotection.org.gh
Website: https://dataprotection.org.gh/
The DPC is the statutory regulator responsible for implementing the Data Protection Act, 2012 (Act 843).
Our website may contain links to third-party websites, platforms or social-media services. Those third parties operate under their own privacy notices and terms. M&P does not control the privacy practices of third-party websites and is not responsible for their processing once you leave the M&P website. You should review the relevant third party’s privacy information before providing personal data.
The M&P website is designed primarily for business, professional and recruitment audiences and is not directed specifically to children. We do not intentionally seek to collect children’s personal data through general website forms. If you believe that a child has provided personal data to us, please contact the Data Protection Officer so that the circumstances can be reviewed and appropriate action taken.
Where website information is used in an automated process that could significantly affect an individual, M&P will assess the processing and provide the information and safeguards required by applicable law. The Firm will not rely on a website privacy notice as a substitute for specific information that may be required for a particular automated decision or recruitment process.
M&P may update this Privacy Notice when there are changes to our processing activities, website functionality, technology, internal policies, professional obligations, regulatory guidance or applicable law. The latest version will be published on the website with its effective date and version number.
Where a change materially affects how we use personal data, M&P will take reasonable steps to bring the change to the attention of affected individuals where appropriate.
For privacy questions, data-subject requests, or concerns relating to the processing of personal data through the M&P website, please contact:
Data Protection Officer
Makers & Partners
Email: [insert DPO email address]
Postal address: [insert firm postal address]
Website: [insert official website address]
This Privacy Notice is not a substitute for separate website Terms of Use. If M&P wishes to regulate use of its website content, trademarks, reports, publications, images, logos and other intellectual property, a separate Website Terms of Use should be adopted and published alongside this Privacy Notice.
M&P should ensure that text, images, publications, graphics, software, logos and other materials used on its website are either owned by M&P, properly licensed, used with permission, or otherwise lawfully available for the intended use. Third-party content should not be reproduced merely because it is publicly accessible.
|
Document title |
Website Privacy Notice |
|
Owner |
Makers and Partners |
|
Effective date |
26 August 2026 |
Makers & Partners - Copyright . All rights reserved.
