Privacy Policy

Who we are

Professional Agile Certification — Africa (PACA) is the data controller for the personal data described in this notice.

We process personal data under Ghana's Data Protection Act, 2012 (Act 843) and, where members are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation.

What we collect

The data we hold depends on how far you go through the membership process.

• •Account details: your name, email address, phone number and password (stored only as an argon2id hash — we never hold your password itself).
• •Application details: postal address, country, gender if you choose to state it, educational qualifications, year of graduation, occupation and employer.
• •Supporting documents: your CV, professional or educational certificates, student ID, recommendation letter or evidence of retirement, depending on the membership type you apply for.
• •Referee details: the names and email addresses of the referees you nominate.
• •Assessment records: the questions served to you, the answers you gave, your score and the outcome of each attempt.
• •Technical data: IP address, browser user agent and timestamps, recorded against sign-ins and significant actions for security and audit purposes.

Why we process it

Each purpose has a lawful basis:

• •To assess your membership application and administer your membership — necessary for the performance of our contract with you.
• •To deliver and invigilate assessments and issue certificates — necessary for the performance of our contract with you.
• •To publish your name, membership type and credential status on our public verification page — necessary for our legitimate interest in maintaining a credible, checkable register of certified practitioners.
• •To send you service messages about your application, payments and certificates — necessary for the performance of our contract.
• •To send you marketing about courses, events and partner offers — only with your separate, freely-given consent, which you may withdraw at any time.
• •To detect and investigate misconduct in assessments — necessary for our legitimate interest in protecting the integrity of the credential.

Public information

Certificates issued by PACA carry a credential identifier that can be checked on a public verification page. That page shows the holder's name, membership type, issue date and current status. This is deliberate: a certificate nobody can verify is worth little.

Your inclusion in the public professional directory is optional and off by default. You can switch it on or off from your profile at any time.

How long we keep it

Account and membership records are kept for as long as you hold a membership and for six years afterwards, so that we can answer questions about credentials we have issued.

Supporting documents such as CVs and identity documents are kept for the duration of the application process and for twelve months after a decision, then deleted.

Assessment attempt records, including the questions served and answers given, are kept for six years so that a disputed result can be investigated.

Audit logs are kept for six years.

Who we share it with

We share personal data only where necessary to run the service: with our payment provider to process subscription payments, with our email provider to send you service messages and certificates, and with our hosting and infrastructure providers.

We do not sell personal data, and we do not share it with partner training providers unless you ask us to.

International transfers

There is currently no major cloud region located in Ghana. Our infrastructure is hosted in an African region where available, and your data may therefore be processed outside Ghana. Where data leaves Ghana or the EEA, we rely on appropriate safeguards including standard contractual clauses.

Your rights

You may ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to processing based on legitimate interests. You may withdraw marketing consent at any time without affecting your membership.

You can raise a request from your account, and we will respond within the statutory time limit. If you are unhappy with how we handle it, you may complain to Ghana's Data Protection Commission or, if you are in the EEA or UK, your local supervisory authority.

Deleting your account does not remove the public record of a credential we have already issued, since third parties rely on it. We will, however, remove the personal data that is not needed to support that record.

Security

Passwords are hashed with argon2id. Uploaded documents are stored in private object storage and served only through short-lived signed links. Access to member data is restricted by role, administrator accounts require two-factor authentication, and privileged actions are recorded in an append-only audit log.