PRIVACY NOTICE

1. WHAT INFORMATION DO WE COLLECT?

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

• Client Corporate Registration Data: To clear onboarding review procedures, we collect company names, legal business registration strings, coordinator names, business email channels, point-of-contact telephone addresses, physical operational addresses, Ghana Post Digital Addresses, and corporate verification document graphics (such as PDF, JPG, or PNG certificates).
• End Customer Shipment Records: When client shipping companies utilize our manifest parsing systems, we extract and log underlying customer profiles containing full names, structured WhatsApp contact numbers (with country code headers), unique tracking or package IDs, and brief line item text descriptions.
• Interactive Chatbot & Media Inputs: We ingest text strings, media pictures, language tags, and delivery specifications shared directly by end recipients during live conversation sessions with our automated conversational interface.

Sensitive Information

When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information:

• Official Corporate Registration Certificates uploaded for fraud screening and system verification.
• Securely salted and hashed user password strings required to govern authentication endpoints.
• Proof of Delivery (POD) items, including graphic images of hand-signed physical receipts or captured digital signature profiles.
• Precise device-derived GPS location coordinates captured exclusively during delivery confirmation steps.

Payment Data

We collect data necessary to process your subscription tiers and underlying overage charges (supporting both USD and GHS currencies). All direct credit card handling or digital mobile wallet processing (such as MTN MoMo, Telecel Cash, and AT Money rails) is handled via an integrated third-party billing gateway.

Social Media Login Data

Social logins are not supported or integrated into the Notify framework. All validation requirements run exclusively through dedicated internal corporate email and password modules.

2. HOW DO WE PROCESS YOUR INFORMATION?

We utilize personal information across several key operational scopes:

• To facilitate account creation and authentication: Processing corporate sign-up applications, managing background document verification, and running user access control configurations.
• To deliver and facilitate delivery of services to the user: Automatically parsing uploaded manifest lists using AI text-extraction tools, and staging template variables into automated outbound notifications.
• To respond to user inquiries and offer support: Maintaining 24/7 automated NLP chatbot sequences to address common questions (such as operating hours, customs requirements, and location guides), and escalating complex tickets to human desks.
• To execute billing and subscription controls: Tracking monthly notification quotas, identifying overage thresholds, generating automated invoices, and tracking payment status.
• To collect transaction proof and logistics metrics: Saving delivery date/time preferences, branch routing selections, package verification photos, and feedback scores (1 to 5) left by recipients.
• To protect our Services: Enforcing inactivity timeout blocks, monitoring system abuse metrics, and checking administrative audit paths.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

If you are operating within the Republic of Ghana, our data handling procedures are structured to comply with the Ghana Data Protection Act (Act 843, 2012). If you interact with our platform from the EU, UK, or other global areas, our procedures align with the General Data Protection Regulation (GDPR) guidelines.

As outlined in Notify_SRS_v1.0.docx, Synthx OS acts primarily as a Data Processor concerning end-customer package manifest files uploaded by our clients. The registered shipping companies act as the primary Data Controllers. Under our Data Processing Agreements, client companies must verify that they have secured explicit customer consent before initiating bulk notifications.

• Consent: Where explicit permission has been provided for specific messaging features or opt-in procedures.
• Performance of a Contract: Processing information to fulfill core subscription functionalities, calculate billing data, and deliver expected notifications.
• Legal Obligations: Where processing is required to comply with tracking and verification controls governed by the National Communications Authority (NCA) of Ghana or regional tax guidelines.
• Legitimate Interests: To maintain multi-tenant security barriers, mitigate system fraud, and generate platform analytics.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We share processed information matrices only with the following sub-processor categories to maintain stable service functionality:

• Cloud Computing and Infrastructure Providers: Enterprise cloud database and storage layers configured to maintain isolated tenant environments.
• Communication Platforms: Meta’s official WhatsApp Business API gateway infrastructure to transmit template elements and receive text responses.
• AI/ML Service Processors: Secure text-extraction services and Natural Language Processing (NLP) endpoints utilized to process customer manifests and power chatbot intents.
• Payment Gateways: Integrated billing networks processing platform subscription packages and overage metrics via credit cards or mobile money providers (such as MTN MoMo, Telecel Cash, and AT Money).
• Regulatory & Government Entities: Sharing data if explicitly requested under legal mandates to comply with auditing directives from the National Communications Authority (NCA).

5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

Our dashboards or automated chatbot flows may contain reference markers or hyperlinks leading to third-party domains or external tools. We cannot warrant the data collection policies of unaffiliated third parties. Any information you share outside our multi-tenant application boundaries is governed entirely by the external entity's own privacy notices.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

We use essential technical cookies within our web browser dashboard to securely manage user login states, track active web sessions, enforce our 30-minute inactivity timeouts, and power real-time screen refreshes.

7. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

All administrative access or operator workspace controls require explicit corporate email registration and password hashes validated through our secure multi-tenant identity filters.

8. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

Our platform systems are provisioned through global cloud infrastructures. If you utilize our Services from within Ghana or neighboring regions, please note that elements of your data may be stored or processed in external regions where our primary cloud infrastructure providers operate.

We take all necessary measures to protect personal data by executing structural data processing boundaries, ensuring strict tenant isolation rules, and applying system-wide encryption safeguards.

9. HOW LONG DO WE KEEP YOUR INFORMATION?

To ensure privacy compliance and reduce data footprint risks, Notify implements the following automated deletion policies:

• Uploaded Customer Manifest Lists & Parsing Tables: Automatically and permanently purged from server storage layers 7 days after upload.
• Package Verification Photos: Automatically deleted from cloud storage assets exactly 7 days after a delivery status is marked complete.
• Proof of Delivery (POD) Documentation: Maintained for a minimum of 90 days to support client dispute resolution before archival cleanup.
• System Access and Audit Logs: Maintained for a minimum of 12 months to meet system security and compliance guidelines.

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

We have implemented rigorous technical safeguards to secure processed information:

• Data Encryption: All underlying tenant databases and historical log items are encrypted at rest via AES-256 standard parameters, and all data transmissions are wrapped in TLS 1.2 or higher over secure HTTPS connections.
• Strict Multi-Tenant Separation: Application layers enforce strict logical multi-tenant isolation, ensuring client personnel can never access or view data belonging to another tenant database.
• Application Hardening: The platform uses automated filters to prevent common vulnerabilities like SQL Injection (SQLi) and Cross-Site Scripting (XSS) attacks.
• Masking and Access Controls: Sensitive details within standard system logs are automatically masked. Administrative platform access is restricted via the principle of least privilege and requires Two-Factor Authentication (2FA).

11. DO WE COLLECT INFORMATION FROM MINORS?

Our services are provisioned strictly for commercial logistics and business entities. If we discover that customer manifest records contain data elements from individuals under the age of 18 without appropriate verification, we will remove those specific records from our active database tables.

12. WHAT ARE YOUR PRIVACY RIGHTS?

Under regional frameworks like the Ghana Data Protection Act, you possess specific rights regarding your personal information:

• Automated Unsubscribe System (Opt-Out): End customers can instantly opt out of automated messaging loops by replying with any of our designated case-insensitive keywords: STOP, UNSUBSCRIBE, CANCEL, or OPT-OUT. Our compliance engine will immediately flag the phone number in our platform suppression registry and hard-block future automated notifications. The system will send a confirmation reply: "You have been unsubscribed. Reply START to resume notifications."
• Data Portability Options: In alignment with global standards, client administrators can trigger a comprehensive Export All Data action from their dashboard settings panel. The platform compiles all historical customer profiles, message records, and conversation strings into a compressed ZIP file containing structured CSV and JSON formats. The generated secure download links automatically expire after 48 hours.

13. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems include a Do-Not-Track (DNT) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.

14. DO WE MAKE UPDATES TO THIS NOTICE?

We may update this privacy notice over time to reflect changes in our service features or relevant data laws. Revised updates will be indicated by a new Last updated date at the top of this notice. If we make material modifications, we may alert client administrators through dashboard banners or direct email updates. We encourage you to review this notice periodically to stay informed on how we safeguard your data.

15. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions, comments, or technical clarifications regarding our platform processing practices, please contact us at:

Synthx OS Data Privacy Office

Email: info@synthxos.com

Contact Page: https://www.synthxos.com/contact

16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on applicable laws, you may have the right to request access to the personal information we collect from you, change that information, or delete it in some circumstances. To request to review, update, or delete your personal information, please submit a request to our support team at info@synthxos.com or via our online interface at https://www.synthxos.com/contact. We will evaluate and process your request in accordance with the Ghana Data Protection Act and our platform multi-tenant safety guidelines.