Privacy Policy

1. Who we are and when this policy applies

GWO SEVO Solutions Ghana Limited (“GWO SEVO”, “we”, “us” or “our”) operates this website and Compass by GWO SEVO.

This policy applies when you visit our website, request an assessment, send an enquiry, subscribe to commercial insights, apply for a role, use Compass or authorise an available account connection.

We determine how information is used to administer our website, manage enquiries and maintain our business relationships. Where we process information solely on a client’s documented instructions, the client determines the purpose of that processing and we act on its behalf. Our agreement identifies the relevant responsibilities; it does not remove our own data-protection obligations.

A particular service may have additional privacy information where its processing differs from this policy.

We handle personal information under the laws applicable to the interaction, including Ghana’s Data Protection Act, 2012 (Act 843), and, where applicable, Nigeria’s Data Protection Act, 2023 and General Application and Implementation Directive, 2025.

2. Information we collect

The information we receive depends on how you interact with us.

We usually receive information directly from you. We may also receive relevant business information from your organisation, an authorised referral or professional sources you have made public.

Where first-party assessment analytics are enabled, they use a random session identifier and approved interaction identifiers rather than your contact details.

Do not include passwords, access tokens, payment-card details, confidential customer lists or sensitive personal information in ordinary website forms or support messages.

3. Information from connected Meta and Google accounts

Compass connections support business-performance reporting and recommendations. They are enabled only for available features and authorised accounts.

Compass account connections are being prepared for client launch. Google Analytics 4 and Google Ads connections are planned features. Describing them here does not mean they are already available.

The intended reporting scope is:

The information available depends on the permissions granted, the selected account and the provider’s reporting capabilities. We explain the requested access before authorisation.

We also process provider-issued access credentials, permission records, connection status, expiry information and limited operational records needed to maintain or troubleshoot a connection. Authorisation takes place with the provider; you do not give us your Meta or Google password.

These reporting connections do not collect private-message content, individual customer lists or individual browsing histories. Summary reporting does not mean that all associated information is anonymous: account identifiers and related records may still identify an individual or organisation.

4. How and why we use information

We use information to:

• respond to assessments and enquiries;
• provide and administer agreed services;
• prepare client-specific reports and recommendations;
• manage accounts, communications, billing and service delivery;
• process recruitment applications;
• provide separately requested marketing communications;
• protect systems, investigate faults and prevent abuse; and
• meet legal obligations and establish, exercise or defend legal claims.

Depending on the circumstances, the legal basis may be a contract, steps you request before entering a contract, consent, a legal obligation or a legitimate interest that does not override your rights. Where we process information for a client, we follow its lawful documented instructions.

Platform authorisation does not replace any separate legal basis, notice or consent required for the underlying information.

Assessments and marketing are separate

Selecting Send My Request asks GWO SEVO to contact you about your assessment. We keep a versioned response-permission record and record no marketing consent from that submission.

An assessment does not, by itself, enrol you in newsletters, advertising audiences or automated marketing follow-up. Where a separate marketing process permits email, telephone, SMS, WhatsApp, partner marketing or audience-related activity, its notice must explain that activity and the applicable choices.

You can unsubscribe from marketing without withdrawing a request for an active service.

Limits on connected-account information

We use connected information for the relevant organisation’s agreed reporting purpose. We do not use these connections to publish content, send messages, create advertisements, change campaigns or budgets, or alter analytics settings.

We do not sell connected information, use it to build advertising audiences, or use one client’s information for another client’s reports or benchmarks. These limits also apply to information derived from connected data.

Compass handles information received through Google APIs in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

Recommendations involve human judgment

Assessment results and Compass recommendations are starting points for review. They do not make decisions with legal or similarly significant effects, and they do not guarantee commercial results.

5. Who may access information

Access is limited to people who need the information for an authorised purpose.

For Compass, this may include authorised users from the relevant organisation and GWO SEVO personnel assigned to deliver the agreed reporting, analysis or support.

Where Google’s Limited Use rules apply, human review requires your affirmative agreement to review the specific information, unless an applicable security, legal or other permitted exception applies.

We may use service providers for hosting, communications, security, support and other necessary technology services. Where they process information on our behalf, they must work under appropriate confidentiality, security and processing terms.

Other disclosures may involve:

• professional advisers, auditors or insurers subject to confidentiality;
• a client or delivery partner you have asked us to involve;
• separately authorised marketing providers, subject to the restrictions above;
• authorities where disclosure is lawful and necessary; or
• a successor in a lawful business reorganisation, subject to applicable safeguards.

These general provisions do not expand permission to use or disclose connected-account information. Provider-specific restrictions take precedence, including any requirement for explicit prior consent before a business-transfer disclosure.

Some recipients may process information outside your country. Where a transfer is restricted, we use an applicable lawful mechanism and appropriate safeguards. You may contact us for information about the providers, locations and safeguards relevant to your information.

6. How long we keep information

We retain information only while it is needed for the stated purpose, subject to applicable legal and platform requirements.

Different records serve different purposes:

• Account and service records: retained for the relevant relationship and any necessary legal, accounting or dispute-related period.
• Connected reports and underlying information: retained only while needed for the authorised reporting purpose, with earlier deletion where required by a valid request, the provider or law.
• Connection credentials: retained only while needed for authorised access. Credentials that are revoked or no longer needed are removed, and authorisations are revoked where required.
• Operational and security records: retained for the period needed to investigate faults, protect systems and meet applicable obligations.
• Marketing records: retained until you unsubscribe or the subscription closes, with a minimal suppression record where necessary to respect your choice.

For preliminary contract processing covered by Nigeria’s General Application and Implementation Directive, personal information is destroyed within six months if the contract does not proceed, unless a justifiable ground supports keeping it for a future legal claim. This is a specific rule for that processing, not a general retention period for connected accounts. NDPC General Application and Implementation Directive

Where law requires retention after a deletion request, we retain only the necessary records and restrict their use. General business convenience does not override platform deletion requirements.

Residual backup copies remain subject to the same protections and deletion obligations. They must not be restored to ordinary use following a valid deletion request; completed deletion instructions must be reapplied if a backup is restored.

7. Security, cookies and website technology

We use access controls, private records, input validation, rate limiting and anti-abuse measures to protect information.

Connected-account credentials are handled on our servers, with restricted access and encryption for stored access tokens. They are not included in client reports or requested through ordinary forms.

No internet service is completely secure. If a personal-data breach occurs, we assess it and notify affected people or regulators where required.

Our Cookie Policy explains browser storage and website technology. The website retrieves webfonts from Google, which can disclose connection information such as an IP address and browser details. Where Google reCAPTCHA is enabled, it assesses form activity for abuse under Google’s applicable terms.

Website cookies and security tools are separate from authorising Compass to access a business account.

8. Disconnecting accounts and deleting connected data

You can withdraw a connection’s authorisation through the relevant Meta or Google account settings. You can also contact us to request disconnection.

Withdrawing access stops further retrieval through that authorisation. It does not necessarily delete information previously imported into Compass.

To request deletion:

1. Visit our Contact Us page and state “Compass data deletion”.
2. Identify your organisation and the relevant connected account, Page or property.
3. Tell us whether you want disconnection, deletion of stored information, or both.

You do not need an active Compass account to make a request. Do not send passwords, access tokens or identity documents unless we request necessary verification through an appropriate channel.

We may ask for limited information to confirm your identity or authority and locate the records. We will handle the request promptly, explain the outcome and identify any records that must be retained by law.

Deletion covers relevant imported information and reports derived from it, subject to those limited exceptions. We also delete connected information when it is no longer needed, the relevant service ends, or applicable platform rules require deletion.

Deleting information held by GWO SEVO does not delete the original information held in your Meta or Google account.

9. Your privacy rights

Depending on the law that applies, you may be entitled to:

• understand how your information is used;
• request access and information about its source, purpose and recipients;
• correct inaccurate or incomplete information;
• request deletion, restriction or portability;
• object to processing, including direct marketing;
• withdraw consent;
• request human review of certain automated decisions; and
• complain to the relevant privacy regulator.

Withdrawing consent does not affect processing that was lawful before withdrawal. Where a right is limited by an applicable exception, we will explain the reason unless the law prevents us from doing so.

If we hold information only on a client’s instructions, we may need to refer your request to that client and assist it with the response. You may still contact us, and we will explain the appropriate route.

We do not discriminate against people for exercising privacy rights.

Our business website and Compass are not directed to children. Contact us if you believe a child has supplied personal information so we can assess and remove it appropriately.

10. Contact, complaints and changes

Use our Contact Us page for privacy questions, requests or complaints. State that your message concerns privacy.

GWO SEVO Solutions Ghana Limited
No. 71 Swaniker Street, Abelenkpe, Greater Accra Region, Ghana.

You may also complain to the relevant regulator, including the Ghana Data Protection Commission or the Nigeria Data Protection Commission. Where applicable, you may contact the supervisory authority responsible for your residence, workplace or the relevant processing.

We may update this policy when our services, processing or applicable requirements change. We will update the publication date and give appropriate notice of material changes.

Before using connected information for a materially different purpose or accessing additional information, we will provide the required disclosure and obtain any necessary renewed consent or authorisation. Updating this page alone does not grant that permission.