Privacy Policy

1. Introduction

Amentem PLC (“Amentem,” “we,” “our,” or “us”) is committed to handling personal information responsibly, transparently, and securely. This Privacy Policy explains how we collect, use, disclose, transfer, retain, and protect personal information in connection with our website, digital platforms, professional engagements, communications, events, and services.

This Policy applies to clients, prospective clients, website visitors, candidates, employees, contractors, suppliers, business partners, trainees, event participants, and other individuals whose information we process.

2. Company Information

Amentem PLC
Accra, Ghana
PO Box AC 104, Accra, Ghana
Privacy contact: privacy@amentem.com

Depending on the engagement, Amentem PLC may act as a data controller, joint controller, or data processor. Where we process information solely on a client’s documented instructions, the relevant client agreement or data-processing terms may also apply.

3. Scope of This Policy

This Policy applies to information collected through our corporate website, client portals, online forms, booking systems, email, telephone, WhatsApp, recruitment channels, training platforms, events, surveys, professional engagements, and other authorized communication or service channels.

This Policy does not govern independent third-party websites, government systems, insurers, banks, payment providers, professional advisers, or other entities that determine their own processing purposes.

4. Definitions

Personal information means information relating to an identified or identifiable individual. Sensitive personal information may include financial, health, biometric, tax, identity, immigration, criminal-record, or other specially protected data. Processing includes collection, recording, organization, storage, retrieval, use, disclosure, transfer, restriction, deletion, or destruction.

Controller means the person or organization that determines the purposes and means of processing. Processor means a service provider that processes personal information on behalf of a controller.

5. Legal Bases for Processing

We process personal information only where permitted by applicable law. Legal bases may include performance of a contract, steps requested before entering into a contract, compliance with legal or regulatory obligations, legitimate interests that do not override individual rights, consent, protection of vital interests, or another lawful basis recognized by the relevant jurisdiction.

Where consent is relied upon, it may be withdrawn at any time. Withdrawal does not affect processing lawfully completed before the withdrawal.

6. Categories of Information We Collect

We may collect names, contact details, identification documents, account credentials, business records, professional history, resumes, references, financial and billing information, tax information, insurance information, immigration records, correspondence, appointment details, service preferences, transaction records, training records, and supporting documents.

We seek to collect only information that is reasonably necessary, relevant, and proportionate to the service or purpose involved.

7. Information Collected Automatically

When you access our website or digital services, we may collect IP address, browser type, operating system, device identifiers, referral source, pages viewed, date and time of access, approximate location, cookies, usage logs, and security-event information.

This information supports website operation, analytics, fraud prevention, cybersecurity, service improvement, and compliance.

8. Sensitive Personal Information

Some services may require sensitive personal information, including tax identification numbers, financial statements, passports, immigration records, insurance or health information, background information, or other legally protected data.

We process sensitive information only where necessary and lawful, and we apply additional access controls and security safeguards.

9. Sources of Information

We may collect information directly from individuals and from authorized representatives, clients, employers, candidates, referees, insurers, financial institutions, government agencies, public records, professional databases, service providers, cookies, and other lawful sources.

If you provide personal information about another person, you must have authority to do so and must provide any notice or obtain any consent required by law.

10. Purposes of Processing

We may process personal information to provide services; verify identity; communicate with clients and users; prepare applications, filings, reports, assessments, proposals, and recommendations; manage appointments; process payments; conduct recruitment; perform due diligence; deliver training; operate AI and digital transformation projects; protect systems; prevent fraud; comply with law; and establish, exercise, or defend legal rights.

We do not materially expand the purpose of processing without a lawful basis.

11. Service-Specific Processing

Business consulting and corporate advisory: organizational, operational, financial, governance, market, and stakeholder information may be processed to deliver advisory services.

Tax preparation and advisory: income, expense, payroll, ownership, identification, and supporting tax records may be processed to prepare, review, or advise on tax matters.

Insurance services: identity, underwriting, payment, risk, policy, and claims information may be shared with relevant insurers or intermediaries.

Immigration consulting: passport, travel, employment, education, family, financial, and government-application information may be processed to support immigration matters.

Recruitment and executive search: resumes, qualifications, references, compensation expectations, interview records, and assessments may be processed for hiring-related purposes.

AI and digital transformation: workflow information, prompts, outputs, system logs, operational data, and technical documentation may be processed under agreed safeguards.

12. Artificial Intelligence and Automated Processing

We may use AI-assisted tools for research, drafting support, workflow automation, analytics, candidate matching, document classification, quality control, and service improvement. AI-generated output may be incomplete or inaccurate and is subject to appropriate human review.

We do not knowingly submit confidential or sensitive client information to publicly accessible AI systems without authorization or suitable contractual and technical safeguards.

Where applicable law provides rights concerning decisions based solely on automated processing, we will provide applicable safeguards and review mechanisms.

13. Cookies and Similar Technologies

Our website may use cookies, pixels, local storage, analytics technologies, and similar tools to maintain functionality, remember preferences, measure usage, improve performance, protect security, and support communications or marketing.

Where required, non-essential cookies are activated only after consent. Additional details are provided in the Amentem PLC Cookie Policy.

14. Marketing Communications

We may send newsletters, event invitations, service updates, or promotional communications where permitted by law. You may unsubscribe through the message or by contacting privacy@amentem.com.

Operational, security, billing, legal, and account-related messages may still be sent where necessary.

15. Disclosure of Information

We may disclose personal information to employees, contractors, affiliated entities, professional advisers, technology providers, cloud hosts, payment processors, booking platforms, insurers, recruitment partners, auditors, regulators, courts, law-enforcement bodies, government agencies, and other parties where disclosure is necessary and lawful.

We do not sell personal information for monetary consideration. Where a law defines certain digital advertising disclosures as a sale or sharing, applicable opt-out rights will be honored.

16. Service Providers and Processors

Service providers may process personal information on our behalf for hosting, cybersecurity, communications, analytics, payments, document management, scheduling, customer support, recruitment, AI tools, and other operational functions.

We seek to engage providers that maintain appropriate contractual, organizational, and technical safeguards.

17. International Data Transfers

Because our clients, service providers, and business partners may operate in multiple countries, personal information may be transferred outside Ghana or the country where it was collected.

Where required, we use lawful transfer mechanisms and safeguards such as contractual clauses, adequacy decisions, consent, contractual necessity, or other measures recognized by applicable law.

18. Data Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

Measures may include authentication, access controls, encryption, backups, logging, staff confidentiality duties, vendor reviews, secure disposal, incident-response procedures, and business-continuity controls.

No system is completely secure. Users should protect credentials and promptly report suspected compromise.

19. Data Retention

We retain personal information only for as long as reasonably necessary to provide services, meet contractual requirements, satisfy legal, tax, regulatory, insurance, audit, and professional obligations, resolve disputes, enforce agreements, and preserve legitimate business records.

When information is no longer required, it is securely deleted, destroyed, or anonymized where practicable.

20. Data Accuracy and Confidentiality

We take reasonable steps to maintain accurate and current information. Individuals should notify us when relevant information changes.

Personnel and contractors with access to personal information are expected to maintain confidentiality and use information only for authorized purposes. These obligations may continue after employment or engagement ends.

21. Individual Privacy Rights

Subject to applicable law, individuals may have rights to request access, correction, completion, deletion, restriction, objection, portability, withdrawal of consent, information about disclosures, and review of certain automated decisions.

Rights may be limited where processing or retention is required by law, professional duty, contract, public interest, fraud prevention, legal privilege, or the rights of others.

22. Ghana Data Protection Rights

Where Ghana’s Data Protection Act, 2012 (Act 843) applies, individuals may request information about the processing of their personal data, seek access or correction, object to certain processing, and raise concerns regarding compliance.

Requests may be sent to privacy@amentem.com. We may verify identity before responding.

23. International Privacy Rights

Where the EU GDPR or UK GDPR applies, individuals may have rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent, complaint to a competent supervisory authority, and protection from certain solely automated decisions.

Residents of certain U.S. states or other jurisdictions may have additional rights to know, access, correct, delete, obtain a copy of, or opt out of certain processing of personal information. We will not unlawfully discriminate against individuals for exercising applicable rights.

24. Children’s Privacy

Our general website and professional services are not directed to children. We do not knowingly collect personal information from children without appropriate authorization or another lawful basis.

If we learn that a child’s information was collected improperly, we will take reasonable steps to delete or otherwise address it.

25. Third-Party Links and Platforms

Our website or communications may include links to third-party websites, social media platforms, payment systems, or government portals. We are not responsible for the privacy practices, security, or content of independent third parties.

Users should review the privacy notices of those services before submitting information.

26. Data Breach and Incident Response

If a security incident affects personal information, we will investigate, contain, remediate, document, and issue notifications to regulators, clients, or affected individuals where required by law.

Notifications may describe the nature of the incident, information affected, likely consequences, measures taken, and recommended protective steps.

27. Complaints, Questions, and Rights Requests

Privacy questions, complaints, and rights requests should be sent to privacy@amentem.com or by post to Amentem PLC, PO Box AC 104, Accra, Ghana.

Please provide enough information to identify the relevant records and request. We may require identity verification and will respond within the timeframe required by applicable law.

28. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in law, technology, services, or business practices. The revised version will be posted with an updated effective date.

Material changes may also be communicated through the website, email, client portal, or another appropriate channel.