This Privacy Policy explains how Lottraq Ghana Limited (“Lottraq”, “we”, “us”) collects, uses, shares and protects personal data when you use the Lottraq website and services (the “Platform”). It applies to buyers, private sellers, dealers and their staff, and visitors.
We handle personal data in line with the Data Protection Act, 2012 (Act 843) of Ghana. Our registration with the Data Protection Commission is in progress.
The data controller is Lottraq Ghana Limited, a company in Ghana. For anything about your personal data, email [email protected].
What we collect depends on how you use the Platform:
Dealers use Lottraq to manage their own customers. A dealer can record leads and follow-ups, trade-in appraisals and test drives. For a test drive, the dealer may record your name, phone number and driving licence number and photograph your licence. Licence photos are kept in private storage and are never public.
For this information, the dealer decides what to collect and why, and is responsible for it. Lottraq stores and processes it on the dealer’s behalf. To see, correct or delete it, contact the dealer. You can also contact us and we will help.
Act 843 lets us process personal data only where we have a lawful reason. Ours are:
| Purpose | Lawful basis |
|---|---|
Creating and running your account, sending sign-in and verification codes by email | Needed to provide the service you asked for (contract) |
Publishing listings, passing your enquiry or offer to the seller or dealer, running cash offers and messaging | Contract |
Taking payment for reports, boosts and subscriptions, and keeping the records | Contract; legal obligation (tax and accounting records) |
Storing the customer records dealers keep on the Platform | Contract with the dealer, who is responsible for its own lawful basis |
Optional AI-assisted features, such as help writing a listing, photo tagging and car value estimates | Contract (you choose to use the feature) |
Verifying dealers, moderating listings and calculating trust scores | Legitimate interest in a safe, trustworthy marketplace |
Preventing fraud, spam and automated abuse, and securing accounts | Legitimate interest; legal obligation |
Answering support requests and resolving disputes | Contract; legitimate interest |
Responding to lawful requests from courts, regulators or the police | Legal obligation |
We do not send SMS or WhatsApp messages at present, and we do not send marketing messages by either channel. If we start, we will ask for your consent first where the law requires it, and you can withdraw it at any time.
To protect sign-up, sign-in and enquiry forms, we use a captcha check run by our security provider, a form timer, rate limits and a hashed fingerprint derived from your IP address and browser headers. These can block a request that looks automated. If you are blocked by mistake, try again or contact us.
To stop deals being moved off the Platform to avoid its protections, phone numbers and other contact details in messages may be hidden. A message our filters flag may also be checked automatically, which can involve an AI service provider.
Dealers have a trust score calculated from their verification status, reviews, dispute history, listing accuracy, time on the Platform and completed sales. It is shown to buyers. A dealer who thinks their score is wrong can ask us to review it.
We do not sell your personal data. We share it only in these cases:
To decode a VIN and build vehicle history reports, we send the VIN, and sometimes the make, model and year, never your personal details, to public vehicle-data services outside Ghana. We do not currently check vehicles against DVLA records. Information a seller adds about their own vehicle is labelled as owner-declared and is never presented as independently verified.
We use service providers to run the Platform. Most of them process data outside Ghana. Where that happens, we rely on their contractual commitments and security measures to keep your data protected to the standard Act 843 requires.
| Type of provider | What they do | Where |
|---|---|---|
Hosting provider | Runs our servers, database, search and error monitoring | Outside Ghana |
Network security and storage provider | Protects the Platform against attacks, runs the captcha check on our forms, and stores photos, documents and database backups | Global network, including outside Ghana |
Payment processor | Processes payments for reports, boosts and subscriptions. Receives your email address and payment details on its own checkout | Ghana and other countries where it operates |
Email delivery provider | Sends our emails, such as sign-up codes and notifications | Outside Ghana |
AI service providers | Power the optional AI features: help writing listings, photo tagging, photo-based car value estimates, message reply suggestions and summaries for dealers, and the automated message check described above | Outside Ghana |
Public vehicle-data services | Decode VINs and supply recall and specification data. They receive vehicle details only, never personal data | Outside Ghana |
Map-image service | Supplies the map images on search and dealer location maps. Your browser loads them directly, which shares your IP address with that service | Outside Ghana |
You can ask us for the names of our service providers at [email protected]. Error reports from the Platform go to a monitoring system we run ourselves on our hosting. Before an error report is stored, we strip passwords, codes, tokens, cookies, request bodies, email addresses, phone numbers and Ghana Card numbers from it.
| Data | How long |
|---|---|
Account and listing data | Until you delete your account |
Sign-in sessions | Until 30 days after you last used the Platform on that device. Sooner if you sign out, or when you close the browser if you didn’t choose to stay signed in |
Offers, deal records and payment records | As long as tax, accounting and dispute-resolution needs require, even after account deletion. Your contact details are removed from them when you delete your account |
Customer records a dealer keeps (leads, test drives, trade-ins) | Until the dealer deletes them or closes their account |
Security and audit logs | As long as needed to investigate abuse and meet legal obligations |
Error reports | 30 days |
Database backups | A limited period, then deleted on a rolling basis |
When you delete your account, we remove or anonymise your personal data. Your name becomes “Deleted user” and your contact details are removed. We delete your sessions, saved items, garage, notifications, verification records and profile images. Records other people rely on, such as offers, conversations, listings and reviews, are kept without your contact details. Deletion is refused while you still have open obligations, for example a listing under offer or an open dispute.
The owner of a dealer account cannot delete their own account while the business account is open. To close a business account, email [email protected] and we will do it for you.
Under Act 843 you have the right to:
You can correct most details yourself in your profile or dealer settings. You can delete your account under Profile (personal accounts) or Settings (dealer team members). We do not yet have a self-service download of your data. To get a copy, or for anything else, email [email protected] from the address on your account. We may ask you to confirm your identity before we act. We will respond within the time Act 843 allows.
If you are unhappy with how we have handled your data, you can complain to the Data Protection Commission of Ghana. We would like the chance to put it right first.
All traffic is encrypted in transit (HTTPS). Passwords are hashed. Sign-in uses httpOnly cookies that page scripts cannot read, and signed-in dashboards sign you out after a period of inactivity (currently 30 minutes). Staff access is limited by role and logged. No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Commission as the law requires.
We use only the cookies and browser storage needed to keep you signed in, protect forms and remember a few display choices. We use no advertising or analytics cookies. Our Cookie Policy lists each one.
The Platform is for people aged 18 and over, and our Terms require you to confirm you are when you create an account. We do not ask for your date of birth. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
When we change this Policy in a material way, we publish a new version with a new date and version number above, and take reasonable steps to tell you about significant changes, for example by email. We keep a record of the version you accepted.
Questions about this document? Email [email protected] (privacy) or [email protected] (everything else).