Privacy Policy

1. Who We Are

Corpshore Solutions Corporation operates in Ghana under the trading name Corpshore Ghana, with its principal place of business in Accra, Ghana. We are a business process outsourcing (BPO), IT outsourcing, and AI outsourcing company serving clients across Africa, Europe, North America, the Middle East, and the Asia-Pacific region.

For the purposes of the Ghana Data Protection Act 2012 (Act 843) and, where relevant, the EU General Data Protection Regulation 2016/679 (GDPR), Corpshore Solutions Corporation is the data controller in respect of personal data processed through this website and in the course of our business activities. Where we process personal data on behalf of our clients, we act as a data processor and our obligations in that capacity are set out separately in our Data Processing Agreement.

Our registered mailing address is Accra, Ghana. You may contact our data privacy team at any time by writing to: info@corpshore.solutions.

2. Personal Data We Collect

We collect different categories of personal data depending on your relationship with us. The following table explains what we collect and why.

2.1 Website Visitors

• Technical data: IP address, browser type, operating system, referring URL, pages visited, time and date of visits, and session duration. This data is collected automatically through server logs and analytics technologies.
• Cookie data: identifiers stored in cookies or similar technologies on your device. Please refer to our Cookie Policy for full details.

2.2 Contact Form and Enquiry Submissions

• Full name
• Business email address
• Company name and job title
• Country of operation
• Telephone number (optional)
• The content of your message or enquiry
• Services of interest

2.3 Job Applicants

• Full name, contact details (email, phone, postal address)
• Curriculum vitae (CV) or resume, including employment history, educational qualifications, and professional certifications
• Cover letter and supporting documentation
• Right-to-work documentation (where required)
• References (where provided)
• Responses to screening questions
• Interview notes and assessment results

2.4 Business Clients and Prospective Clients

• Contact person details: name, job title, business email, telephone
• Company registration information
• Commercial communications, including statements of work, proposals, and contracts
• Payment and invoicing information (where applicable)
• Correspondence and meeting notes

2.5 Special Category Data

We do not routinely collect special category data (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation) through this website. Where such data is shared with us in the context of a service engagement — for example, where a client supplies us with HR data for processing — this is governed by a separate Data Processing Agreement. If you are a job applicant and voluntarily disclose health information relevant to workplace adjustments, we will treat this data with appropriate care and in accordance with applicable law.

3. How We Collect Your Data

We collect personal data through the following channels:

• Directly from you: when you complete a contact or quote request form on our website, apply for a job through our careers page, correspond with us by email or telephone, or engage with us in person or at events.
• Automatically: through cookies, web server logs, and analytics tools when you visit our website. See our Cookie Policy for more information.
• From third parties: from recruitment platforms or job boards where you have uploaded your CV and consented to sharing with prospective employers; from our clients where we are processing data on their behalf; from publicly available business directories and professional networking sites (for business development purposes only, and limited to business contact information).
• From Zoho products: where you interact with our Zoho-powered CRM, recruitment, or email campaign tools, data is collected in those systems as described in section 6 below.

4. Legal Bases for Processing

Under the Ghana Data Protection Act 2012 and, where applicable, the GDPR, we must have a lawful basis for processing your personal data. The following bases apply to our processing activities:

4.1 Consent

Where you have given us clear, freely given, specific, informed and unambiguous consent — for example, subscribing to our newsletter, accepting non-essential cookies, or providing a CV through a job application — we process your data on the basis of that consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4.2 Contract Performance

Where you are a client or entering into a commercial engagement with us, we process your data as necessary for the performance of that contract, including onboarding, service delivery, invoicing, and contract management.

4.3 Legitimate Interests

We process certain data on the basis of our legitimate interests or the legitimate interests of a third party, provided those interests are not overridden by your data protection rights. Our legitimate interests include operating and improving our website, responding to business enquiries, preventing fraud and misuse, maintaining business records, and conducting business development activities using publicly available professional contact information. We conduct a balancing test before relying on this basis.

4.4 Legal Obligation

We process data where we are required to do so by applicable law, including the Ghana Data Protection Act 2012, Companies Act 2019 (Act 992), tax and financial regulations, and employment law.

4.5 Vital Interests

In rare circumstances, we may process data to protect the vital interests of an individual — for example, in a medical emergency involving one of our staff.

5. How We Use Your Data

We use the personal data we collect for the following purposes:

• To respond to enquiries, quotation requests, and service consultations submitted through our website or by other means.
• To manage our client relationships, deliver contracted services, and communicate regarding those services.
• To process and evaluate job applications, schedule and conduct interviews, and where appropriate offer employment.
• To send marketing communications — only where you have consented to receive them or where we have a legitimate interest and are communicating with existing clients about related services.
• To operate, monitor, and improve our website, including identifying and resolving technical issues.
• To comply with legal and regulatory obligations, including retention of financial and employment records.
• To protect the security and integrity of our systems and to detect, investigate, and prevent fraudulent or malicious activity.
• To conduct internal analytics and business planning.
• To fulfil any purpose for which you specifically provided your data and which was disclosed to you at the time of collection.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data. We share data only in the circumstances described below.

6.1 Technology and Service Providers

• Zoho Corporation: We use Zoho CRM to manage client and prospect data, Zoho Recruit for job applications, and Zoho Campaigns for newsletter distribution. Zoho processes data on our behalf as a data processor. Zoho is ISO 27001 certified and GDPR-compliant. Data processed through Zoho may be stored on servers in India or other jurisdictions; appropriate transfer safeguards are in place.
• Hostinger: Our website is hosted by Hostinger, which stores website data and server logs on our behalf. Hostinger operates data centres in Lithuania and other jurisdictions.
• Google (Analytics): Where you have consented, we may use Google Analytics 4 to collect anonymised website usage statistics. Google processes this data as a data processor. IP anonymisation is enabled.
• Cloudflare: We use Cloudflare for content delivery network (CDN) and security services. Cloudflare may process technical data including IP addresses as part of providing these services.
• Lucide / Google Fonts: Our website loads icon libraries and fonts from third-party CDN providers. These providers may receive your IP address as part of the HTTP request. We have configured where possible to self-host or minimise data exposure.

6.2 Professional Advisors and Regulators

We may share data with our legal advisors, accountants, or auditors on a confidential basis where necessary. We may also disclose data to regulatory or law enforcement authorities where required to do so by law or court order, or to protect our legal rights or the rights and safety of others.

6.3 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to a successor entity. We will notify affected individuals and seek to ensure equivalent protections are maintained.

6.4 With Your Consent

We will share data with other parties where you have given us specific consent to do so.

7. International Data Transfers

As a global outsourcing company serving clients in Europe, North America, the Middle East, and Asia-Pacific, we operate across multiple jurisdictions and may transfer personal data internationally. We take our obligations regarding cross-border data transfers seriously and apply the following safeguards:

• Adequacy decisions: Where the European Commission or the UK Information Commissioner's Office has issued an adequacy decision for the destination country, we rely on that decision as a transfer mechanism.
• Standard Contractual Clauses (SCCs): For transfers to countries without an adequacy decision (including transfers to Zoho's processing infrastructure where relevant), we rely on the European Commission's Standard Contractual Clauses or UK International Data Transfer Agreements (IDTAs) as appropriate.
• Binding Corporate Rules (BCRs): Where service providers have approved BCRs in place, we may rely on these as an alternative transfer mechanism.
• Ghana Data Protection Act 2012, Section 43: For transfers from Ghana, we comply with the requirements of the Ghana Data Protection Act regarding cross-border transfers, including ensuring that the destination country provides an adequate level of protection or that appropriate contractual measures are in place.

You may request a copy of the transfer mechanisms we rely upon by contacting us at info@corpshore.solutions.

8. Data Retention

We retain personal data for no longer than is necessary for the purposes for which it was collected or as required by applicable law. Our standard retention periods are as follows:

• Website enquiries and contact form submissions: 24 months from the date of last contact, unless converted to a client engagement.
• Job applications (unsuccessful candidates): 6 months from the date of decision, after which CVs and supporting documents are deleted unless you have consented to being held on a talent pool for a further 12 months.
• Job applications (successful candidates): Retained as part of the employee record in accordance with our HR data retention policy and applicable employment law. Typically 7 years from the end of employment.
• Client contract records: 7 years from the expiry or termination of the contract, in accordance with applicable limitation periods under Ghana law.
• Financial and invoicing records: 7 years from the relevant financial year, as required by the Revenue Administration Act and related regulations.
• Marketing opt-in records: For the duration of the subscription plus 3 years following unsubscription, to evidence consent.
• Website analytics data: 26 months rolling, in line with Google Analytics 4 default settings (where applicable).
• Server logs: 90 days, unless required longer for security investigation purposes.

At the end of the relevant retention period, we will securely delete or anonymise your personal data. Where data is anonymised rather than deleted, it is no longer personal data and may be retained indefinitely for statistical purposes.

9. Your Rights

You have a number of rights in relation to your personal data. The specific rights available to you depend on the legal basis for processing and the applicable law. Under the Ghana Data Protection Act 2012 and, where applicable, the GDPR, these rights include:

9.1 Right of Access

You have the right to request a copy of the personal data we hold about you, together with information about how we process it. We will respond to subject access requests within 30 days of receipt.

9.2 Right to Rectification

You have the right to request that inaccurate or incomplete personal data be corrected without undue delay.

9.3 Right to Erasure

You have the right to request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent (and no other legal basis applies), where you object and we have no overriding legitimate grounds, or where the data has been unlawfully processed. This right is subject to certain exceptions, including where we are required to retain data by law.

9.4 Right to Restriction

You have the right to request that we restrict the processing of your data in certain circumstances — for example, while we are verifying the accuracy of data you have contested.

9.5 Right to Data Portability

Where processing is based on consent or contract performance and is carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.

9.6 Right to Object

You have the right to object at any time to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defence of legal claims. You may also object at any time to processing for direct marketing purposes, and we will cease without requiring justification.

9.7 Rights Related to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you. We do not currently make such decisions.

9.8 How to Exercise Your Rights

To exercise any of the above rights, please contact us at info@corpshore.solutions with sufficient information to identify your request. We may ask for proof of identity before processing your request. We will not charge a fee for reasonable requests but reserve the right to charge a reasonable administrative fee or decline manifestly unfounded or excessive requests.

10. AI and Data Processing Services

One of Corpshore Ghana's core service lines is AI outsourcing and data services, including training data annotation, data labelling, content moderation, and AI model evaluation. In delivering these services, we act as a data processor on behalf of our clients. We do not use client-supplied training data for our own purposes.

Where clients engage us to process datasets that may include personal data — for example, annotating images that contain identifiable individuals, labelling text datasets that include personal information, or reviewing content for AI moderation pipelines — we do so strictly under the terms of our Data Processing Agreement and in accordance with documented client instructions.

We apply the following principles to all AI-related data processing:

• Personal data processed for AI training purposes is handled with the same safeguards as any other personal data.
• Access to data is restricted to authorised annotators and project managers on a need-to-know basis.
• Data is not retained beyond the project term without specific contractual authorisation.
• We do not use any client dataset for training Corpshore's own internal AI models without explicit written consent.
• We comply with applicable guidance from the Ghana Data Protection Commission and relevant sector regulators regarding the use of personal data in AI systems.

Clients who supply personal data to us for AI-related processing are responsible for ensuring they have a lawful basis for that processing and for the original collection of the data. Clients should execute our Data Processing Agreement before supplying any such data.

11. Cookies

Our website uses cookies and similar technologies. We use strictly necessary cookies to operate the site, and optional cookies for analytics and functionality improvements. A full explanation of the cookies we use, their purpose, duration, and how you can manage your preferences is available in our Cookie Policy. You may withdraw consent to non-essential cookies at any time by adjusting your browser settings or using the cookie preference centre on our website.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These measures include:

• Encryption of data in transit using TLS (Transport Layer Security) protocol.
• Access controls limiting data access to authorised personnel on a role-specific basis.
• Regular security assessments and vulnerability management.
• Staff training on data protection and information security.
• Secure disposal of data at end of retention period.
• Incident response procedures for managing data breaches.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Ghana Data Protection Commission in accordance with the requirements of Act 843 and, where applicable, the relevant supervisory authority under the GDPR within 72 hours of becoming aware of the breach. We will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

No system is completely secure. Whilst we take reasonable precautions, we cannot guarantee the absolute security of data transmitted over the internet. You transmit data at your own risk.

13. Children's Privacy

Our website and services are intended for business professionals and are not directed at children under the age of 18. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal data without appropriate parental consent, please contact us at info@corpshore.solutions and we will take appropriate steps to delete such information.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. We will post the revised policy on this page with an updated effective date. Where changes are material, we will provide a more prominent notice, such as an email notification to subscribers or a banner on our website. We encourage you to review this policy periodically.

The version of this policy in force at the time of your most recent interaction with us governs our handling of your data at that time.

15. Contact Us and Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing activities, please contact us:

• Email: info@corpshore.solutions
• Post: Data Privacy, Corpshore Ghana, Accra, Ghana

We are committed to resolving privacy concerns promptly and fairly. If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Commission of Ghana, established under the Data Protection Act 2012 (Act 843):

• Website: www.dataprotection.org.gh
• Address: Data Protection Commission, Accra, Ghana

If you are an EU or UK data subject and consider that we have violated your rights under the GDPR or UK GDPR, you may also lodge a complaint with the supervisory authority in your country of habitual residence, place of work, or the location of the alleged infringement.

This Privacy Policy is governed by the laws of the Republic of Ghana. Nothing in this policy limits any rights you may have under applicable mandatory laws in your country of residence.