Rekordu Privacy Policy
Last updated: 12 October 2026
Rekordu is operated by PagezTech Ventures, a business registered in Ghana (business name registration no. BN414140425), of Unnumbered Building, Near Vila World School, Baatsona, Greater Accra, Ghana (GZ-100-3692) ("we", "us"). This policy explains what personal data Rekordu holds, why, and your rights. We process personal data in line with Ghana's Data Protection Act, 2012 (Act 843) and, where it applies, the EU and UK GDPR.
Two kinds of data
Account data about shop owners and their staff (name, phone number, optional email, password stored only as a secure hash, and an activity log of what each account does). We are the data controller for this.
Shop records that a shop enters: its sales, stock, IMEI numbers, its customers' names and phone numbers, and, when the shop buys a handset from someone or takes one as a trade in, that seller's identity document type and number. The shop is the data controller for these records and we process them on the shop's behalf (as a processor), only to provide the service.
What we use data for
- Running the service: signing in, recording sales and stock, producing receipts and reports.
- Sending WhatsApp messages the shop has asked for: sale reports to the shop, receipts and repair updates to its customers, and password reset codes.
- Billing, through Paystack, for shops that subscribe.
- Security: rate limiting, fraud prevention and keeping an audit trail.
We do not sell personal data or use it for advertising.
Stolen and lost phone list
Shops can report a handset's IMEI as stolen, lost or involved in fraud. Other Rekordu shops are warned when that IMEI is presented to them. The warning shows only the IMEI, the reason and the date. It never reveals which shop reported it or any customer's details.
Seller identity records
When a shop buys a handset from a member of the public, or accepts one as a trade in, Rekordu requires the shop to record the seller's name, phone number and the type and number of an identity document (for example a Ghana Card, passport, voter ID or driver's licence).
- Why: so that if a handset later turns out to be stolen or lost, the shop can show where it came from and help the owner and the authorities trace it. This protects the shop, the rightful owner of the phone and honest sellers. It is not used for marketing or any other purpose.
- Who can see it: the shop's owner and managers. Auditors see the number partly hidden. Other staff do not see it. It is never printed on receipts, never included in receipt links, and never shared with other shops, including through the stolen and lost phone list.
- Telling the seller: the shop must tell the seller that their ID is being recorded and why, before completing the purchase.
- Disclosure: a shop may give these records to the police or a court when lawfully asked to. We disclose them ourselves only when the law requires it, and will tell the shop unless we are prohibited from doing so.
- How long: the full ID number is kept for 3 years from the purchase, long enough to trace a handset reported stolen. After that only its last 4 characters are kept. If the shop closes its account first, it is deleted with the shop's other records, as described below.
Sellers can exercise their rights over this data, described below, by contacting the shop that bought the handset.
Who we share data with
- Meta (WhatsApp Business Platform) to deliver WhatsApp messages.
- Paystack to take subscription payments.
- Vultr (servers in London, United Kingdom, and server backups) and Cloudflare (network and security) to host the service.
Some of these providers process data outside Ghana, including in the United Kingdom, the European Union and the United States. We only use providers that are bound by contract to protect personal data and to use it solely to provide their service to us. Data is encrypted in transit between your device, our servers and these providers, and access to our servers is restricted to authorised staff. We share with each provider only what it needs: for example, Meta receives the recipient's phone number and the content of each WhatsApp message Rekordu sends, and Paystack receives the payment details for a subscription. Neither has access to a shop's records as a whole.
How long we keep data
Shop records are kept while the shop's account is open. When an owner closes the account, all of the shop's records are permanently deleted 30 days later. Backups are encrypted and kept for up to 180 days, then deleted. Records of server errors are kept for 90 days.
Your rights
You can ask to access, correct or delete personal data about you, or object to its processing. If you are a customer of a shop, contact that shop first, since it controls its records. A shop can erase a customer's name, phone number and email from all of its records; the amounts of past sales stay, because the shop must keep its accounts. Shop owners can download all of their shop's data at any time from Settings. Contact: [email protected]. You may also complain to the Data Protection Commission of Ghana.
Security
Data is encrypted in transit, passwords are hashed, each shop's data is isolated from every other shop, and access within a shop is limited by role. Every account can turn on two-step sign in with an authenticator app, and Rekordu staff must use it. Identity numbers are only shown to the roles listed above, and the activity log keeps only a partly hidden copy.
Cookies
Rekordu uses one cookie, which keeps you signed in. It is needed for the service to work, so there is nothing to opt into. We use no advertising or analytics cookies.