Privacy policy.

Dakyworld (‘we’, ‘us’, ‘our’) operates dakyworld.com and provides digital systems, automation and related services. Our address is Kumasi, Ashanti Region, Ghana.

For everything described on this page we are the data controller — we decide why and how your personal data is used. Where we work inside a client’s own systems under a signed agreement, we act as a data processor on that client’s instructions instead, and their privacy notice governs that data rather than this one. Section 11 explains the difference.

Data protection enquiries: privacy@dakyworld.com. We have not appointed a Data Protection Officer; that address reaches the people who can act on your request.

We are established in Ghana, so Ghana’s Data Protection Act, 2012 (Act 843) applies to everything we do.

If you are in the European Economic Area or the United Kingdom, the GDPR and the UK GDPR also apply to us in respect of your data, because we offer services to people in those places and because our website can measure visitors there. Where the two regimes differ we apply whichever gives you more protection, and the rights in section 9 are available to everyone who asks, wherever they live — we do not think it is worth anyone’s time to argue about which statute entitles them to a copy of their own data.

We are not established in the EU or the UK and have not appointed a representative there under Art 27 GDPR, on the basis that our processing of EEA and UK data is occasional, small in scale and unlikely to result in a risk to anyone — the exemption that article provides. If that ceases to be true we will appoint one and say so here. In the meantime, write to privacy@dakyworld.com and you will reach us directly.

Everything we collect is listed below, with the reason we need it, the legal ground we rely on and how long we keep it. If a purpose is not in this table, we are not using your data for it.

The enquiry form asks for a name and an email because we cannot reply without them. Everything else on it is optional, and leaving it blank changes nothing about the answer you get.

This site sets no cookies at all until you choose to allow them. There is no tracking pixel, no advertising tag, no social widget and no embedded video. The typefaces are served from our own server rather than from Google, so loading a page does not tell anyone else that you did.

What we store, and when:

You can change your mind whenever you like: open your cookie settings, or use the Cookie settings link in the footer of every page. Withdrawing is exactly as easy as consenting, takes effect immediately, and deletes the cookies that were set. Refusing costs you nothing — every part of this site works the same either way.

If your browser sends a Global Privacy Control or Do Not Track signal we treat it as a refusal and do not show you the banner at all. You can still switch analytics on deliberately if you want to.

We approach businesses that we think we can help, so you may hear from us without having contacted us. You are entitled to know how that happened, so here it is.

We collect business contact details — a company name, a role, a work email address or a business phone number — from the company’s own website, public business directories and public professional profiles. We do not buy contact lists, we do not guess at personal email addresses, and we do not scrape private accounts or anything behind a login.

We rely on our legitimate interest in offering a relevant business service to another business (Art 6(1)(f)), and we have weighed that against your interests: the data is professional rather than personal, the message is about your work, it is easy to identify us, and one word ends it. Where local law requires prior consent for an unsolicited approach, we do not send one.

You have an absolute right to object to direct marketing (Art 21(2)) — there is no balancing test and we do not get to argue. Reply ‘stop’ to any message, or write to privacy@dakyworld.com, and we will stop immediately. We keep a record of your address on a suppression list for one reason only: so that nothing reaches you again by accident. You may also ask us to erase it entirely, and we will.

We do not sell personal data and we do not share it for anyone else’s marketing. We use the following service providers, each under a written contract that permits them to act only on our instructions:

Hosting and delivery

Railway and GitHub, to serve this website and run our systems.

Analytics

Google Analytics 4 (Google Ireland Limited). Only if you have allowed it.

Email

Our email provider, to send and receive correspondence with you.

Payments

Stripe, Paystack and our bank. They receive what they need to take a payment. We never see or store your full card number.

AI and automation platforms

The providers behind the tools we use to draft, research and deliver work. See section 10.

We will also disclose data where the law requires it, and to our professional advisers where necessary. If the business is ever sold or merged, your data would transfer with it and you would be told before anything changed.

We are in Ghana, and several of the providers above are in the United States or the European Union. That means your data will usually cross a border, and we should say so plainly rather than leave it in a footnote.

Where data leaves the EEA or the UK, we rely on one of the following: the European Commission’s Standard Contractual Clauses (or the UK’s International Data Transfer Addendum) in our contract with the provider; the provider’s certification under the EU–US Data Privacy Framework, which covers Google and Stripe; or, for a transfer to us in Ghana, your explicit consent or the necessity of the transfer to perform our contract with you (Art 49(1)(a) and (b)). Ghana has not been the subject of an EU adequacy decision, and we are not going to imply otherwise.

Where data leaves Ghana, we take the steps required by section 18 of Act 843 to ensure the recipient is subject to comparable protection.

You may ask us for a copy of the safeguards that apply to a particular transfer, and we will send them.

The retention period for each kind of data is in the table in section 3, because a single sentence saying ‘as long as necessary’ tells you nothing you could hold us to.

When a period ends, the data is deleted or irreversibly anonymised. The one exception is a suppression record — the note that says not to contact you — which we keep indefinitely, because deleting it is how a business ends up emailing someone who has already asked it not to.

Whoever you are and wherever you live, you can ask us to do any of the following:

Get a copy of your data

Everything we hold about you, and the information on this page applied to your particular case (Art 15).

Correct it

If something is wrong or incomplete, tell us and we will fix it (Art 16).

Delete it

We will erase it unless the law requires us to keep it — invoices, for instance, have to survive for six years (Art 17).

Restrict what we do with it

Ask us to hold it but stop using it, for example while a dispute about accuracy is resolved (Art 18).

Take it elsewhere

Receive the data you gave us in a machine-readable file, or have us send it to another provider (Art 20).

Object

Object to any use that rests on our legitimate interests (Art 21(1)). For direct marketing the right is absolute and we stop, full stop (Art 21(2)).

Withdraw consent

Where you consented — analytics, the newsletter — you can withdraw at any time, as easily as you gave it (Art 7(3)). Withdrawing does not undo what was lawful before.

Complain

See below. You do not have to come to us first, though we would rather you did.

Write to privacy@dakyworld.com with the subject ‘Data Request’. We reply within 10 business days, and in every case within the one month the GDPR allows; if a request is genuinely complex we may take up to two further months, and we will tell you why inside the first month. It is free. We will not charge you, and we will not make you create an account to ask. We may ask you to confirm who you are, but only enough to be sure we are not handing your data to somebody else.

Complaining to a regulator

Ghana

Data Protection Commission — dataprotection.org.gh

European Economic Area

The supervisory authority of the country you live or work in, or where the problem happened. The list is at edpb.europa.eu.

United Kingdom

Information Commissioner’s Office — ico.org.uk

We use AI tools to draft, research and deliver work. Where those tools process client or contact data we use enterprise tiers whose terms exclude that data from being used to train models, and we do not paste client data into consumer chatbots. Operational data processed through our AI and automation pipelines is never used to train public or third-party models. That is an explicit commitment, not an aspiration.

Some of our outreach is drafted with AI assistance and researched from public sources. A person reviews it before it is sent.

We do not make decisions about you by automated means alone that produce legal effects or similarly significant effects, and we do not carry out profiling of that kind (Art 22). There is no credit scoring, no automated rejection, and no algorithm deciding whether you can be a client.

Under a client engagement we often handle data belonging to your customers — a CRM, a mailing list, an order history. For that data you are the controller and we are your processor: we act only on your documented instructions, and we do not decide what happens to it.

Our Master Service Agreement contains the terms Art 28 GDPR requires of a processor: confidentiality, security, notice before any sub-processor is engaged, assistance with your obligations and with data subject requests, notification of a personal data breach without undue delay, and deletion or return at the end. If you need a separate Data Processing Agreement for your own compliance file, ask and we will sign one.

If one of your customers writes to us about their data, we pass it to you rather than answering ourselves — it is your decision to make, not ours.

We use TLS in transit, encryption at rest for sensitive data, need-to-know access control and regular review. All client credentials — server access, database logins, admin passwords — live in a zero-knowledge password vault, never in plaintext, email or a shared document.

If a breach happens that is likely to risk your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and tell you directly without undue delay where the risk to you is high (Arts 33 and 34). We would rather tell you about a problem than be found to have sat on it.

Our services are for businesses. We do not knowingly collect data from anyone under 18, and if we discover that we have, we delete it.

If we change how we use personal data, we will update this page and change the date at the top of it. Where a change materially affects you we will tell you directly, and where it needs your consent we will ask for it again rather than assume the old answer still applies. Earlier versions are available on request.