Privacy Policy

Bloom Graphics and Software Development, trading as Bloom Vouchers ("Bloom Vouchers", "we", "us" or "our"), respects your privacy. This Privacy Policy explains what personal data we collect when you use the Platform, why we collect it, who we share it with, how long we keep it, and your rights.

It applies to Buyers, gift Recipients, Business Owners and Team Members, and anyone who visits our website. It is issued under the Data Protection Act, 2012 (Act 843) of the Republic of Ghana. Capitalised words have the meanings given in our Terms of Service.

2.1Bloom Vouchers

We are the data controller for the personal data we collect to run the Platform: accounts, Orders, Vouchers, payments, Payouts, identity checks, security and support.

2.2Businesses

A Business that receives your details through an Order is a separate data controller for how it uses them, for example to book you in. It must use them only to honour your Voucher and serve you, and must comply with Act 843.

2.3Our service providers

The providers listed in section 6 process data on our behalf, under contracts with us and their own legal obligations.

3.1When you buy a Voucher

Your name, phone number and email address; the Offer, quantity and amount; and the order reference, payment status and times reported by the Payment Provider.

3.2When someone sends you a gift

The Buyer gives us your name and phone number, and may add a personal message. We use these only to deliver the Voucher and show it to you.

3.3Business Owners and Team Members

Your name, email address and phone number (confirmed with an SMS code), your sign-in details (a password, or your Google account’s name and email), your role, and your Business’s name, categories, link name, logo, Offers and photos.

3.4Identity verification

When an Owner verifies their identity, our partner Didit collects their identity document and a selfie or liveness check, under its own privacy policy. We receive and keep the result and the details Didit returns with it, such as name, date of birth and document details.

3.5Payouts

The payout account (mobile money number, or bank and account number), the account holder’s name as confirmed by the Payment Provider, and a record of every withdrawal.

3.6Vouchers and redemption

Voucher codes, status and expiry dates, and when and by which Team Member each Voucher was redeemed, or its redemption undone.

3.7Messages

Records of the SMS and emails we send (to whom, when, and whether they were delivered), and anything you write to us.

3.8Technical data

IP address, browser and device type, and the page or action involved in a request, from server logs and error reports. We use your IP address and phone number to limit repeated checkout attempts.

3.9Camera

The redemption screen uses your device’s camera only to read QR codes. The camera feed is processed on your device; only the code it reads is sent to us. No images are stored.

4.1To provide the service you asked for

• process Orders and payments, and issue Vouchers;
• deliver Vouchers, receipts and sale notices by SMS and email;
• let Businesses check and redeem Vouchers;
• run Business accounts, team access and Payouts;
• answer questions and resolve problems.

4.2To meet legal obligations

Keep financial records for tax and audit, verify the identity of the people we pay, and respond to lawful requests from courts and regulators.

4.3For our legitimate interests

Prevent fraud and abuse, keep the Platform secure, fix errors and improve the service. We weigh these interests against your rights, and don’t rely on them for anything you would not reasonably expect.

4.4With your consent

We will ask before sending you marketing. We don’t send marketing to Buyers or Recipients, and you can withdraw any consent at any time.

Some checks are automatic: the Payment Provider decides whether a payment succeeds, Didit decides whether an identity is verified, and our systems limit repeated attempts and hold unusual Orders for review. If an automated decision affects you, you can ask for a person to review it.

6.1The Business you buy from

Your name, phone number and email, the Recipient’s name and phone number for gifts, and the Order and Voucher details, so the Business can honour the Voucher and help you.

6.2Service providers

• Paystack: payments, payout account checks and transfers
• Google Cloud and Firebase: hosting, sign-in, database and file storage
• Arkesel: text messages and verification codes
• Didit: identity verification
• Hostinger: sending email
• Sentry: error monitoring

6.3Payment and financial institutions

The banks, card networks and mobile money operators involved in a payment or Payout, as needed to complete or investigate it.

6.4Authorities

Courts, regulators, the police or other authorities where the law requires it, or where needed to prevent fraud or protect someone’s safety or rights.

6.5If our business changes

A buyer or successor if all or part of our business is sold or reorganised. This Policy will continue to protect your data.

6.6Other websites

Business pages may link to other services, such as WhatsApp for sharing. Their own privacy policies apply when you use them.

Some of our providers store or process data outside Ghana, including in the United States and the European Union. Our hosting runs on Google Cloud in the United States. When data leaves Ghana, we use providers with appropriate safeguards, such as contractual protections and recognised security standards, as Act 843 requires.

• encryption in transit (HTTPS) and at rest with our cloud providers;
• database rules that stop browsers from reading sensitive records, which only our servers can access;
• roles, so staff see no money and only Owners can withdraw;
• SMS codes to add payout accounts and to withdraw;
• limits on repeated attempts, and records of every redemption and Payout.

No system is completely secure. If a breach puts your data at risk, we will tell the Data Protection Commission and the people affected, as Act 843 requires.

• Orders, payments, Vouchers, Balances and Payouts: six (6) years after the transaction, for tax and audit
• Business accounts: while the account is open; then deleted or anonymised, except records we must keep
• Identity verification results: while the account is open, and up to six (6) years after it closes, for compliance
• Delivery records: as long as the Order they belong to
• SMS verification codes: a few minutes; afterwards we keep only the fact that a number was confirmed
• Records of repeated attempts: deleted automatically soon after the limit period ends
• Error reports: up to 90 days
• Messages you send us: up to three (3) years

• tell you what personal data we hold about you, and give you a copy;
• correct data that is inaccurate or incomplete;
• delete data we no longer need or have no lawful reason to keep;
• stop processing that causes you unwarranted damage or distress, or that is for direct marketing;
• have a person review an automated decision that affects you.

To make a request, contact us using the details below. We may need to confirm your identity first, and we aim to reply within 30 days. Some data, such as transaction records, must be kept by law even if you ask us to delete it.

If you are not satisfied with our answer, you can complain to the Data Protection Commission (www.dataprotection.org.gh).

When you receive customers’ details through the Platform, you must use them lawfully: only to honour Vouchers and serve those customers, kept secure, and never for marketing without consent. Team Members see customer details only as their role allows.

The Platform is not for people under 18, and we don’t knowingly collect their data, apart from a gift Recipient’s name and phone number given by a Buyer. If you send a gift to someone under 18, make sure their parent or guardian agrees. If you think we hold a child’s data without this, contact us and we will delete it.

13.1What we use

• Session cookie (__session): keeps Business users signed in. It is strictly necessary and expires on its own.
• Theme setting: remembers light or dark mode. It stays in your browser and is not sent to us.

13.2What we don’t use

We don’t use advertising or analytics cookies, and we don’t track you across other websites.

13.3Your choices

You can block or delete cookies in your browser, but you won’t be able to sign in to a Business account without the session cookie.

We may update this Policy. The new version is posted on this page with a new effective date, and we will tell account holders about material changes by email or in the dashboard.