Privacy & Data Protection Policy

AxiomERP ("we", "our", "us") is committed to protecting the privacy and personal data of our customers, their employees, and all individuals whose information is processed through the AxiomERP platform. This Policy explains what data we collect, how we use it, and the rights you have over it.

This Policy is issued in compliance with the Ghana Data Protection Act, 2012 (Act 843) and aligns with internationally recognised data protection principles.

1. Who We Are

AxiomERP is a multi-tenant enterprise resource planning (ERP) platform operated by Axiostekltd. We act as the data controller for information you provide when registering for the platform, and as a data processor for the employee, customer, and operational data you store within your tenant workspace.

2. Data We Collect

We collect and process the following categories of personal data:

• Account data: name, email address, phone number, job title, and profile photograph of platform users.
• Organisational data: company name, registration number, address, tax identification numbers, and bank details provided during onboarding.
• Employee & HR data: names, national ID numbers, date of birth, employment history, salary and payroll information, SSNIT and PAYE details, leave records, and performance data entered by tenant administrators.
• Transactional data: financial records, inventory movements, purchase orders, sales transactions, and point-of-sale receipts.
• Usage data: IP addresses, browser type, device identifiers, pages visited, and feature interactions collected automatically when you use the platform.
• Communications: support requests, emails, and any messages you send to our team.

3. How We Use Your Data

We use personal data only for the following lawful purposes:

• Providing, operating, and maintaining the AxiomERP platform.
• Processing payroll, tax filings, and statutory deductions (SSNIT, PAYE) on behalf of tenant companies.
• Sending service notifications, security alerts, and platform updates.
• Responding to support queries and troubleshooting technical issues.
• Analysing platform usage to improve features and performance (using anonymised or aggregated data where possible).
• Complying with legal and regulatory obligations under Ghanaian law.
• Preventing fraud, unauthorised access, and other security threats.

We do not sell personal data to third parties. We do not use your data for unsolicited marketing without your explicit consent.

4. Legal Basis for Processing

We process personal data on the following legal bases:

• Contract performance: processing necessary to deliver the services you have subscribed to.
• Legal obligation: compliance with Ghanaian tax, labour, and financial reporting laws.
• Legitimate interests: securing the platform, preventing abuse, and improving our services.
• Consent: for any processing not covered above, where we will ask for your explicit consent.

5. Data Sharing and Disclosure

We may share personal data with:

• Cloud infrastructure providers (servers and databases) who process data on our behalf under strict data-processing agreements.
• Payment processors for subscription billing purposes.
• Email and SMS delivery services for platform notifications.
• Regulatory bodies (e.g. Ghana Revenue Authority, Social Security and National Insurance Trust) where required by law.
• Law enforcement where required by a valid court order or legal process.

All sub-processors are bound by confidentiality obligations and may only process data on our documented instructions.

6. Data Storage and Security

Your data is stored on servers located within or transferred in compliance with applicable data protection laws. We implement the following safeguards:

• Encryption of data in transit (TLS 1.2+) and at rest.
• Role-based access controls ensuring users see only the data their role permits.
• Multi-tenant isolation — one company's data is never accessible to another.
• Cryptographic audit trails for financial and compliance records.
• Regular security assessments and penetration testing.
• Automated backups with tested restoration procedures.

7. Data Retention

We retain personal data for as long as your account is active and as required to fulfil the purposes described in this Policy. Specifically:

• Account data is retained for the duration of your subscription and deleted within 90 days of account closure upon request.
• Financial and payroll records are retained for a minimum of 7 years in compliance with Ghana's Income Tax Act and Companies Act.
• Audit logs are retained for a minimum of 5 years.
• Usage logs are retained for up to 12 months.

8. Your Rights

Under the Ghana Data Protection Act 2012, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Correction: request that inaccurate or incomplete data be corrected.
• Deletion: request deletion of your personal data, subject to legal retention requirements.
• Objection: object to processing based on legitimate interests.
• Data portability: request your data in a structured, machine-readable format.
• Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at privacy@axiomerp.com. We will respond within 30 days.

9. Cookies

The AxiomERP platform uses essential session cookies to keep you signed in and maintain your workspace context. We do not use advertising or tracking cookies. You may disable cookies in your browser settings, but this will prevent you from signing in.

10. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will notify account administrators by email and display a notice within the platform at least 14 days before changes take effect. Continued use of the platform after that date constitutes acceptance of the updated Policy.

11. Contact Us

If you have questions about this Policy or wish to exercise your data rights, please contact our Data Protection Officer:

You also have the right to lodge a complaint with the Data Protection Commission of Ghana if you believe your data rights have been infringed.