Privacy Notice

1. Who we are

Obrempong-Aseda Management Services Ltd ("OAMS", "we", "us") is a vehicle hire-purchase and fleet investment platform incorporated in the Republic of Ghana. We are the data controller for personal information collected through our marketing site, driver portal, investor portal and admin systems.

2. Information we collect

To deliver the work-and-pay programme and meet our obligations under the Data Protection Act, 2012 (Act 843) we collect:

• Identity and contact — full name, phone number, email, residential address, Ghana Card number, date of birth, photograph.
• Driving credentials — driver's licence number, licence class, expiry, DVLA reference, accident history, references from previous driving work.
• Guarantor information — full name, relationship, phone, occupation, and ID details for each of two guarantors.
• Financial — payments, instalment history, mobile-money or card details processed by Paystack (we do not store card numbers).
• Vehicle telematics — GPS location and immobiliser status while a contract is active, for asset-protection purposes only.
• Marketing leads — name, phone, city and any details voluntarily entered on our forms; with consent.
• Technical — IP address, browser, device type, audit-log entries (every state change is timestamped with actor, IP and user-agent).

3. Why we use it (legal basis)

• Contract performance — to assess applications, manage hire-purchase contracts, take payments, send receipts, manage vehicle compliance documents.
• Legitimate interest — to prevent fraud, repossess collateral on default per the signed agreement, audit our own actions.
• Consent — for marketing communications. You can withdraw consent any time by replying STOP to an SMS or emailing us.
• Legal obligation — tax, accounting and regulatory record-keeping.

4. Sharing

We share personal information only with:

• Processors who help us run the service: Neon (database, US-East, encrypted at rest), Vercel (hosting), Paystack (payments), Arkesel (SMS in Ghana), Resend (email), Cloudinary (private document storage with signed URLs).
• Authorities — DVLA, NCA, GRA or law-enforcement on lawful request.
• Investors and guarantors — only the minimum information required to evidence the asset they fund or the obligation they have guaranteed.

We never sell personal data. We do not use it for ad targeting outside our own communications.

5. Security

Personal information classified as PII (Ghana Card, payout details, sensitive notes) is envelope-encrypted with AES-256-GCM at the application layer, in addition to Neon's at-rest encryption and TLS in transit. Passwords are hashed with argon2id. Documents in Cloudinary are private with signed URLs scoped per access. Every state change is recorded in an append-only audit log.

6. Retention

We keep records for the longer of (a) the duration of an active contract or business relationship, and (b) seven (7) years thereafter, to satisfy tax, accounting and legal obligations. Marketing leads that don't convert are deleted after 24 months unless you ask sooner.

7. Your rights

Under Act 843 you have the right to access, correct, port or delete your personal information; to object to processing; and to lodge a complaint with the Ghana Data Protection Commission. Email privacy@40analytics.com and we will respond within 14 days.

8. Cookies

We use a single first-party HTTP-only session cookie (oams_session) to keep you signed in. We do not run third-party advertising or analytics cookies on this site.

9. Changes

We will notify drivers and investors by email or SMS before any material change to this notice takes effect.

10. Contact

Obrempong-Aseda Management Services Ltd
Accra, Ghana
hello@oams.40analytics.com