Client Confidentiality and Case-Material Handling Policy

1. Purpose and authorised access

Client information may be used only for the agreed work and any necessary, documented legal purpose. We do not sell it, publish it, use it in public demonstrations or reuse it for marketing.

Before processing personal data, we must establish the lawful basis, purpose and required notices, use only necessary information and take reasonable steps to maintain its accuracy. Special personal data must meet the additional conditions in section 37 of Act 843.

Access must be limited to named people authorised for the particular engagement. Human viewing must be limited to what is necessary to perform, verify or explain the work. External specialists must have a documented purpose, authorisation and appropriate confidentiality obligations before receiving material. Confidentiality continues after the engagement ends.

2. Automated and AI-assisted work

Automated or AI tools may assist with sorting, searching and analysing information. Their results are provisional and require appropriate supervision and verification. Using AI does not mean that no person reviews the work.

Before a tool receives client material, we must minimise the input, confirm the client’s authorisation and check the provider’s access, retention, training and data-transfer terms and settings. Material processing arrangements must be explained to the client. AI-assisted work is not necessarily wholly local: a provider may process information outside our equipment or outside Ghana.

Where a provider processes personal data on our behalf, written terms must require confidentiality and appropriate security. Overseas processing must meet the applicable Ghanaian requirements under section 30 of Act 843.

We do not create AI training datasets from client materials or use them for unrelated purposes. Provider arrangements must be checked separately; a tool’s use alone is not evidence that training is disabled or that provider-held records have been deleted.

3. Storage and transfer

Project material must be kept in access-controlled storage, with encryption appropriate to its sensitivity. Copies must be limited to those needed for the agreed work, verification and justified preservation.

Transfers must be approved and logged with the intended recipient and method. Passwords or decryption keys must be communicated separately from the material. Any agreed exception involving unencrypted media must be clearly disclosed and recorded, with suitable handling restrictions.

Sensitive material should be clearly flagged for authorised recipients. A viewing warning is a discretion reminder; it is not authentication or encryption and does not prevent someone with file access from opening or copying the material.

4. Completion, retention and disposal

At completion of the agreed work, case materials must be returned or securely deleted under documented closure instructions. Contractual deadlines apply. Retention beyond completion is permitted only for a recorded necessary purpose or a legal preservation requirement, with a responsible owner and review date. Material must not be kept indefinitely “just in case”.

The disposal review must inventory supplied originals, working copies, exports, stills, previews, transcripts, reports, archives, backups, synchronised copies, and relevant application or AI records. Supplied originals must be returned or disposed of only as authorised. Any retained exception must identify the limited material, purpose and next review date.

Deletion or sanitisation must be appropriate to the storage medium and verified. Moving files to Trash is not proof of destruction. Service-provider records and backups must be handled through the provider’s available processes and applicable retention terms; we must not certify their deletion without evidence.

A disposal record must state the completion date, scope, method and any remaining exceptions. Contract, invoice and disposal administration records may be retained only where necessary, without private imagery or unnecessary personal detail. These limited records do not justify retaining the underlying case media.

5. Requests from affected individuals

An affected individual may contact us privately to ask for an explanation or request access, correction or deletion. We verify identity proportionately and agree a suitable private channel. Please do not send private recordings or identity documents to our ordinary contact email unless we have first agreed that they are necessary and how to share them.

Where appropriate, direct disclosure is coordinated with the client so that it respects confidentiality and does not compromise the rights of other people. This does not restrict an individual’s legal rights. Our privacy policy explains the privacy-request and complaint routes.

6. Concerns and security incidents

Suspected loss, unauthorised access or disclosure must be promptly assessed, contained where possible and documented. Where there are reasonable grounds to believe personal data has been accessed or acquired by an unauthorised person, notification to the Data Protection Commission and affected individuals must follow section 31 of Act 843, as soon as reasonably practicable. Notification to an affected individual may be delayed only as permitted by section 31(4). Relevant clients must also be informed as required by the engagement’s terms.

These requirements reduce risk; they do not guarantee that a security incident can never occur. This policy is not a certification or accreditation claim.

7. Contact and accountability

Mina Logic Ltd is responsible for implementing this policy. The company director must assign responsibility for each engagement and review any retention exceptions.

The director must verify and maintain required Data Protection Commission registration and renewals, keep evidence of compliance and review this policy when applicable law or regulatory requirements change. Publishing this policy does not establish registration or independent certification.

Use “Confidentiality enquiry” in the subject and provide only enough information for us to arrange a private response. For the company website and ordinary enquiry handling, see our privacy policy.

8. Legal references

Constitution of the Republic of Ghana, 1992, article 18(2): protection of privacy, subject to the lawful limitations stated in that article. Official constitutional text.

Data Protection Act, 2012 (Act 843): sections 17–20 and 22–27 (processing principles, lawful use, purpose, retention, accuracy and notices); sections 28–30 (security and processor confidentiality); section 31 (security-compromise notifications); sections 32–35 and 39 (individual access, correction and objection rights); section 37 (special personal data); and sections 27(1), 50 and 53 (registration and renewal). Official Act.

Data Protection Commission, Guidelines to Demonstrate Data Protection Compliance: regulatory guidance on implementing Act 843, including registration, accountability and organisational policies. This guidance is distinct from legislation. Official guidelines.