Privacy Policy

1. Who We Are

Oxzy Organisation ('Oxzy', 'we', 'us', 'our') is a Ghanaian youth organisation founded in 2021, based at Onyasia Crescent, Roman Ridge, Accra, Ghana. We are the data controller responsible for any personal information you provide to us through our website, registration forms, or membership applications.

We operate the following platforms and programmes:

• The Young Entrepreneurs' Summit (YES) — an annual virtual summit
• The Entrepreneurs Club — a membership community for young entrepreneurs
• The Ghana Youth Government (GYG) — a civic leadership platform
• Our website at oxzy.org and any associated subdomains

2. Legal Basis for Processing Your Data

This Privacy Policy is issued in compliance with Ghana's Data Protection Act, 2012 (Act 843), which governs the collection, storage, use, and disclosure of personal data. Under Act 843, Oxzy acts as a data controller and is obligated to:

• Process your personal data only for specified, legitimate purposes
• Obtain your informed consent before collecting personal information
• Ensure your data is accurate, up to date, and securely stored
• Respect your rights as a data subject, including the right to access, correct, and withdraw consent
• Register as a data controller with Ghana's Data Protection Commission (DPC)

3. What Personal Data We Collect

We collect the following categories of personal data, depending on how you interact with Oxzy:

4. How We Use Your Personal Data

We use your personal data only for the purposes you have consented to, in accordance with Section 17 of Act 843. Specifically:

• To register you for YES 2026 and send you event joining details and reminders
• To process your application for the Entrepreneurs Club and manage your membership
• To communicate with you about Oxzy programmes, updates, and announcements
• To send you educational content, event recordings, and community resources
• To operate and improve the Ghana Youth Government platform and its governance polls
• To understand our audience and improve the quality of our events and programmes
• To track referrals and manage our ambassador programme
• To comply with our legal obligations under Ghanaian law

We will never use your data for purposes incompatible with those listed above without first obtaining your explicit consent.

5. Legal Grounds for Processing

Under Section 20 of Ghana's Data Protection Act 2012, we process your personal data on the following grounds:

• Consent — you have given us clear, informed consent by submitting your registration or membership form
• Contractual necessity — processing is required to provide you with the service or membership you applied for
• Legitimate interests — to improve our programmes and communicate relevant updates to our community

You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Who We Share Your Data With

Oxzy does not sell, rent, or trade your personal data to any third party. We may share your information only in the following limited circumstances:

• Service providers — such as our website hosting provider (Vercel), form tools (Tally/Typeform), database provider (Supabase), and email communication tools. These providers process data on our behalf and are contractually bound to protect it.
• Payment processors — Paystack, who handle membership payment transactions. Paystack's own privacy policy governs their handling of payment data.
• Event co-organisers and sponsors — only aggregate, non-identifiable data (such as total registrant numbers by sector) is shared with sponsors. No individual personal data is disclosed.
• Legal authorities — if required to do so by Ghanaian law or a valid court order.

All third-party providers used by Oxzy are required to handle your data securely and in accordance with applicable data protection laws.

7. Your Rights as a Data Subject

Under Ghana's Data Protection Act 2012 (Act 843), you have the following rights regarding your personal data:

To exercise any of these rights, contact us at: contact@joinoxzy.org— subject line: 'Data Rights Request'. We will respond within 21 days.

8. How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law:

• Event registrant data (YES 2026) — retained for 2 years after the event, then securely deleted unless you become an Entrepreneurs Club member
• Entrepreneurs Club membership data — retained for the duration of your membership plus 2 years after cancellation
• Ghana Youth Government poll data — retained in anonymised, aggregate form only. Individual identifiers are deleted within 6 months of collection
• Financial transaction records — retained for 7 years as required by Ghanaian financial regulations
• Website analytics data — retained for 13 months, then automatically deleted

9. How We Protect Your Data

We take the security of your personal data seriously and implement appropriate technical and organisational measures in accordance with Section 28 of Act 843, including:

• All data is stored on encrypted servers via Supabase (PostgreSQL database with row-level security)
• Access to personal data is restricted to authorised Oxzy team members only, on a need-to-know basis
• Our website uses HTTPS encryption for all data transmission
• Payment data is handled exclusively by Paystack and is never stored on Oxzy servers
• We conduct periodic reviews of our data security practices

In the event of a data breach that affects your rights and freedoms, we will notify the Data Protection Commission and affected individuals as required by law.

10. Children and Young People

Oxzy's programmes are designed for young people aged 18 and above. We do not knowingly collect personal data from children under the age of 18 without parental or guardian consent.

If your application indicates you are under 18, we will require written consent from a parent or guardian before processing your data. If we discover we have collected data from someone under 18 without appropriate consent, we will delete it immediately.

11. Cookies and Website Analytics

Our website (oxzy.org) may use cookies and analytics tools to understand how visitors use the site. These may include:

• Strictly necessary cookies — required for the site to function and cannot be disabled
• Analytics cookies — used to understand visitor behaviour in aggregate. We use anonymised analytics only

You may disable non-essential cookies through your browser settings at any time. This will not affect your ability to access our services.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in Ghanaian data protection law. When we make material changes, we will notify registered members by email and update the 'Last Reviewed' date at the top of this document.

We encourage you to review this policy periodically. Continued use of Oxzy services after notification of changes constitutes acceptance of the updated policy.