At MyCredit Score Limited ("MyCredit Score", "we", "our" or "us"), we recognise the importance of protecting personal information and respecting the privacy rights of individuals.

As a credit bureau and provider of credit information and credit scoring services, we process information that may be used to establish, assess and understand an individual's credit profile.

This Data Protection & Privacy Statement explains how we collect, receive, use, store, protect and disclose personal information, the purposes for which we process it, and the rights available to individuals under applicable Ghanaian law.

We are committed to processing personal information in a manner that is lawful, fair, transparent, secure and proportionate to the purposes for which it is collected or otherwise obtained.

This Statement should be read together with any specific notices, terms or disclosures provided to you when you interact with our services.

MyCredit Score Limited is a Bank of Ghana-licensed credit bureau operating in Ghana.

We provide credit information and credit scoring services that support responsible lending and help authorised users make informed credit-related decisions.

Our registered address is:

MyCredit Score Limited

11 Duala Street East Legon, Accra - Ghana

Website: www.mycreditscore.com.gh

Telephone: +233 308 249 490

Email: [email protected]

Where we process personal information, we do so in accordance with applicable Ghanaian laws and regulatory requirements, including the Data Protection Act, 2012 (Act 843) and the legal and regulatory framework governing credit reporting in Ghana.

This Statement applies to individuals whose personal information we may process in connection with our activities, including:

• individuals whose information is contained in credit information supplied to us;
• borrowers and potential borrowers;
• customers and users of our products and services;
• individuals who request access to or correction of their credit information;
• representatives or authorised persons acting on behalf of data subjects;
• individuals whose information is lawfully provided to us by data providers or authorised users;
• visitors to our website and digital platforms; and
• other individuals whose personal information we are legally permitted or required to process.

Where a separate privacy notice applies to a particular product or service, that notice will supplement this Statement.

For purposes of this Statement:

Personal Data / Personal Information means information relating to an identified or identifiable individual.

Processing means any operation performed on personal information, including collecting, receiving, recording, organising, storing, retrieving, using, analysing, sharing, updating, restricting or deleting information.

Data Subject means an individual to whom personal information relates.

Credit Information means information relating to an individual's credit history, credit facilities, repayment behaviour and other information permitted to be collected and processed for credit reporting purposes.

Credit Score means a numerical or other analytical representation generated using relevant information to assess aspects of an individual's credit profile or creditworthiness.

Credit Report means a report issued by a credit bureau which contains a full or partial disclosure of information contained in its database.

Data Provider means an organisation or other permitted source that supplies information to a credit bureau.

Authorised User means a person or organisation permitted under applicable law and regulatory requirements to access credit information.

The information we process depends on our relationship with you and the purpose for which the information is processed.

This may include:

Identification information:

• Full name;
• Date of birth;
• Gender, where relevant and lawfully obtained;
• National identification information;
• Identification document details;
• Other identifiers used to distinguish an individual.

Contact and demographic information

• Telephone number;
• Email address;
• Residential or postal address;
• Other contact information;
• Relevant demographic information.

Credit and financial information

• Credit facilities and loan information;
• Account and facility details;
• Amounts borrowed;
• Credit limits;
• Outstanding balances;
• Repayment history;
• Payment behaviour;
• Delinquency or default information;
• Credit enquiries;
• Information concerning guarantees or other credit-related obligations;
• Other information permitted under applicable credit reporting requirements.

Information relating to credit activity

We may process information concerning applications for credit, existing or previous credit facilities and other information relevant to assessing creditworthiness.

Information generated through our services

We may generate or derive information from data we lawfully process, including credit scores, analytical indicators, risk classifications and other credit-related outputs.

Technical and website information

When you use our website or digital platforms, we may collect limited technical information such as:

• IP address;
• browser and device information;
• operating system;
• website interaction information;
• cookies and similar technologies; and
• information required to maintain the security and functionality of our systems.

We seek to collect and process only information that is adequate, relevant and necessary for the purposes for which it is processed.

We may obtain personal information from a number of lawful sources.

These may include:

• directly from you;
• banks and other financial institutions;
• lenders and credit providers;
• other organisations permitted to participate in or provide information to the credit reporting system;
• authorised data providers;
• authorised users of credit information;
• government agencies and public records, where permitted;
• information made lawfully available to us;
• business partners and service providers;
• fraud prevention or identity verification sources, where permitted; and
• other lawful sources permitted under applicable legislation and regulatory requirements.

Importantly, not all information held by MyCredit Score is necessarily provided directly by the individual concerned.

As a credit bureau, we may receive information from authorised data providers for purposes of maintaining and providing credit information.

We may process personal information for purposes including:

Credit reporting:

To collect, maintain, update and provide credit information to authorised users in accordance with applicable law and regulatory requirements.

Credit scoring and analytics:

To develop, calculate and provide credit scores, analytical outputs and other credit-related services.

Credit assessment:

To support authorised users in assessing credit applications, creditworthiness and credit risk.

Identity and information verification:

To verify information and support the integrity and reliability of our services.

Data quality and accuracy:

To validate, reconcile, update and maintain the accuracy and integrity of credit information.

Fraud and financial crime prevention:

To detect, investigate and help prevent fraud, identity theft and other unlawful activities where legally permitted.

Regulatory and legal compliance:

To comply with applicable laws, regulations, regulatory requirements, court orders and lawful requests from competent authorities.

Dispute and complaint management:

To investigate and resolve requests, complaints and disputes concerning personal or credit information.

System and information security:

To protect our systems, information and services against unauthorised access, misuse, fraud, cyber threats and other security risks.

Service development and improvement:

To analyse and improve our services, systems, models and processes, including using aggregated or appropriately protected information where appropriate.

Statistical and research purposes:

Where permitted by law, information may be used for statistical, analytical or research purposes, subject to appropriate safeguards.

We will not use personal information for purposes that are incompatible with the purposes for which it was collected or otherwise lawfully obtained, except where permitted or required by applicable law.

Depending on the circumstances, we may process personal information where:

• processing is necessary to comply with a legal or regulatory obligation;
• processing is authorised or required under applicable credit reporting laws and regulations;
• processing is necessary for the performance of a contract or steps taken at the request of a data subject;
• processing is necessary for a legitimate purpose that is not overridden by the rights and freedoms of the individual;
• you have provided consent where consent is required; or
• another lawful basis recognised under applicable Ghanaian law applies.

Because MyCredit Score operates as a credit bureau, certain processing activities may be undertaken without obtaining consent directly from the individual where the processing is otherwise authorised or required by law or regulation.

Where we rely on consent, you may withdraw your consent in accordance with applicable law. Withdrawal of consent will not affect processing that was lawfully undertaken before the withdrawal.

Credit scoring is an important part of our services.

We may analyse information contained in or derived from credit information to generate credit scores and other analytical outputs.

These processes may involve statistical models, rules, algorithms or other analytical techniques.

A credit score is an analytical assessment based on relevant information and should not be interpreted as a guarantee that an individual will receive or be denied credit.

A credit bureau generally does not make the final lending decision. The organisation providing credit is responsible for its own lending decisions and may consider a credit score together with other information.

Where personal information is used in profiling or automated decision-making, MyCredit Score will apply appropriate safeguards required by applicable law and regulatory requirements.

Where applicable, individuals may have rights relating to automated decision-making and may request information concerning the relevant processing in accordance with the Data Protection Act, 2012 (Act 843).

We will not disclose proprietary information that would compromise the security, integrity or commercial confidentiality of our credit scoring models.

The accuracy and integrity of credit information are extremely important.

We maintain processes designed to ensure that information held and processed by us is accurate, relevant, up to date and appropriately maintained.

Where information is supplied by a data provider, the data provider remains responsible for the accuracy and integrity of information it submits in accordance with applicable requirements.

If you believe that information relating to you is inaccurate, incomplete, outdated or incorrectly attributed, you may contact us to request that the matter be reviewed.

Further information about disputing credit information is provided below.

If you believe that your credit information is incorrect, you may submit a dispute to MyCredit Score through our designated dispute-resolution channel.

A dispute should, where applicable, include sufficient information to enable us to identify the individual and the information being challenged.

Depending on the nature of the dispute, we may:

• review the information in our records;
• investigate the source of the information;
• contact the relevant data provider;
• request supporting information or documentation;
• correct information where an error is established; or
• take other appropriate action in accordance with applicable law and regulatory requirements.

Where the information was supplied by a data provider, the matter may need to be referred to that provider for verification or correction.

We will not knowingly maintain inaccurate credit information once an error has been established and appropriate correction procedures have been completed.

Dispute Contact: [email protected]

We may disclose or provide access to personal information where permitted or required by law.

Depending on the circumstances, recipients may include:

• authorised users of credit information;
• participating financial institutions and credit providers;
• authorised data providers;
• regulators and government authorities;
• courts, law enforcement agencies or other competent authorities where legally required;
• service providers and technology partners supporting our operations;
• professional advisers, auditors and consultants;
• fraud prevention and identity verification providers; and
• other parties where disclosure is authorised or required by applicable law.

We do not sell personal information simply for the purpose of allowing unrelated third parties to market their products or services to you.

We may engage third-party service providers to support our operations.

These may include providers of:

• cloud and hosting services;
• information technology;
• cybersecurity;
• data storage;
• software and platform services;
• identity verification;
• communications;
• analytics;
• professional services; and
• other operational support.

Where a service provider processes personal information on our behalf, we take appropriate steps to ensure that the provider is subject to suitable contractual, confidentiality, security and data protection obligations.

Some of our technology, service providers or business operations may involve the processing or storage of information outside Ghana.

Where personal information is transferred or processed outside Ghana, we will take appropriate steps to ensure that the transfer and subsequent processing comply with applicable Ghanaian data protection requirements and any other applicable regulatory obligations.

We recognise that credit information is sensitive and requires appropriate protection.

We implement reasonable technical and organisational measures designed to protect personal information against:

• unauthorised access;
• unauthorised disclosure;
• alteration;
• loss;
• destruction;
• misuse; and
• other unlawful or accidental processing.

Our safeguards may include access controls, authentication mechanisms, encryption where appropriate, monitoring, logging, security testing, employee awareness and other information security controls appropriate to the nature and risk of the information being processed.

Access to personal and credit information is restricted to persons who require access for legitimate business, regulatory or legal purposes.

We maintain procedures for identifying, assessing, managing and responding to personal data breaches.

Where a breach occurs, we will take appropriate steps to contain and investigate the incident, assess the potential impact, implement remedial measures and make any notifications required by applicable law or regulatory requirements.

We retain personal information only for as long as reasonably necessary for the purposes for which it is processed, subject to applicable legal, regulatory, contractual, operational and dispute-resolution requirements.

Because MyCredit Score operates within a regulated credit reporting environment, certain credit information may be required to be retained for periods prescribed by applicable laws, regulations or regulatory requirements.

When information is no longer required, we will take appropriate steps to securely delete, destroy, anonymise or otherwise dispose of it, subject to any applicable retention requirements.

Subject to applicable law and any relevant exceptions, you may have rights in relation to your personal information, including the right to:

• be informed about the processing of your personal information;
• request access to personal information held about you;
• request correction of inaccurate or incomplete information;
• object to certain processing;
• request cessation or restriction of processing in applicable circumstances;
• withdraw consent where processing is based on consent;
• object to direct marketing;
• seek appropriate remedies where your data protection rights have been infringed; and
• exercise other rights provided under applicable Ghanaian data protection law.

Some rights may be subject to legal or regulatory limitations, particularly where processing is necessary for credit reporting, regulatory compliance, legal obligations or other lawful purposes.

To exercise your data protection rights, request access to your information or raise a privacy-related concern, please contact:

Data Protection / Privacy Contact

MyCredit Score Limited

11 Duala Close, East Legon, Accra, Ghana

Email: [email protected]

Telephone: +233 549 69 30 54

We may need to verify your identity before processing certain requests. This is intended to protect your information from unauthorised disclosure.

We will handle requests in accordance with applicable legal and regulatory requirements.

We encourage you to contact us first if you have a concern about how we have processed your personal information or credit information.

We will investigate and respond to complaints in accordance with our applicable procedures and regulatory obligations.

Where you are not satisfied with the resolution of a data protection concern, you may have the right to lodge a complaint with the Data Protection Commission of Ghana, subject to its applicable procedures.

For matters concerning credit reporting, you may also have rights to pursue applicable complaint or regulatory channels provided under the credit reporting framework.

Our website may use cookies and similar technologies to support essential website functionality, security, performance and analytics.

Cookies may allow us to understand how visitors interact with our website and help us improve its functionality.

Where required, we will provide appropriate information or obtain consent for the use of non-essential cookies.

You may also be able to control or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of parts of our website.

Where we send marketing or promotional communications, we will do so in accordance with applicable data protection requirements.

Where consent is required, we will obtain the appropriate consent before sending direct marketing communications.

You may opt out of direct marketing communications at any time using the available unsubscribe mechanism or by contacting us.

Opting out of marketing will not prevent us from sending communications that are necessary for providing services, fulfilling legal or regulatory obligations, managing your account or addressing a request or complaint.

Our services are primarily intended for individuals and organisations participating in or connected with the credit reporting and financial services ecosystem.

Where we process information relating to a child or other person requiring special protection, we will apply the safeguards required by applicable law.

We may update this Data Protection & Privacy Statement from time to time to reflect changes in our services, technology, legal requirements or regulatory obligations.

Where appropriate, we will notify users of material changes through our website or other appropriate communication channels.

The "Last Updated" date at the beginning of this Statement indicates when it was most recently revised.

MyCredit Score is committed to responsible management of personal and credit information.

We recognise that reliable credit information depends not only on accurate data, but also on trust, transparency, security and accountability.

We will continue to strengthen our processes, systems and controls to protect personal information and support the integrity of Ghana's credit reporting ecosystem.

MyCredit Score Limited

Data Protection & Privacy Contact: [email protected]

Dispute Resolution Contact: [email protected]

General Contact: [email protected]

Telephone: +233 308 249 490