Data protection
How Agoo fits Ghana's Data Protection Act, 2012 (Act 843), who is responsible for what, where data is hosted and who processes it.
Agoo is in early access. This page describes the feature as it ships to early-access organisations; screens are illustrative.
Agoo holds names, phone numbers, photos and sometimes ID numbers. This page explains who is responsible for that data under Ghana's Data Protection Act, 2012 (Act 843), and how Agoo helps you meet your duties.
Who is responsible for what
| Data | Controller (decides why and how) | Processor (handles it on the controller's behalf) |
|---|---|---|
| Your visitors, staff, contractors and contacts, entered into Agoo | Your organisation | Nkonso (Nkonso Technologies Ltd), which runs Agoo |
| Your account and billing details, and enquiries made to Nkonso | Nkonso | Nkonso's service providers |
As controller of your visitor and staff data, your organisation decides what to collect, why, and how long to keep it. Nkonso processes it only on your instructions, which include your settings in Agoo.
The data processing agreement
Nkonso signs a data processing agreement (DPA) with every customer. It covers:
- processing only on your instructions;
- confidentiality for Nkonso's staff and sub-processors;
- the security measures described on our security page;
- telling you within 72 hours of becoming aware of a personal data breach affecting your data;
- helping you answer requests from people and from the Data Protection Commission;
- letting you export your data at any time, including a full export of every record on any plan, and deleting it within 30 days when you ask for your organisation to be deleted or the agreement ends. Copies in encrypted backups expire within a further 30 days and aren't restored in the meantime except to recover from an incident.
These documents are in force from 1 October 2026, on the Agoo website:
Registration with the Data Protection Commission
Act 843 requires data controllers to register with the Data Protection Commission (DPC).
- Your organisation should be registered as the controller of your visitor and staff data. Add your DPC registration number in Console → Settings → Organisation, and Agoo shows it on the privacy notice visitors see at check-in.
- Nkonso's registration with the DPC, as controller of its own data and processor for customers, is in progress.
Where your data is hosted
Agoo's database, API and web apps are hosted in the United Kingdom, with daily encrypted backups. Uploaded files, such as visitor photos and signatures, are stored in Western Europe, and web pages are delivered through global edge networks. When data leaves Ghana, Nkonso relies on written contracts and safeguards with each provider to protect it to a standard consistent with Act 843.
Sub-processors
Nkonso uses a small number of service providers, called sub-processors, to run Agoo, such as providers for hosting, email, SMS and WhatsApp delivery, payments, and AI features when your organisation turns them on. Each one, with its purpose, the data it can receive and its country, is on the sub-processors page.
The authoritative list, with what each provider receives, where it processes data and when, is the sub-processor list on the Agoo website. The DPA and our security page use the same list.
Nkonso gives at least 30 days' notice of any new sub-processor, and you can object on reasonable grounds.
Reading parcel labels with AI sends the photo of a parcel's label to Anthropic, Agoo's AI provider, only when your organisation turns it on in the deliveries settings; the rest of the parcel, the rider's details and your directory are never sent. See Reading parcel labels.
Apple Wallet and Google Wallet receive a pass's details only when a visitor chooses to add their pass to their Wallet, and handle them under the visitor's own terms with Apple or Google; updates to that pass reach the phone through them too. Nothing goes to Apple or Google for visitors who don't add their pass. See Wallet passes.
How Agoo protects data
- Encryption in transit (TLS) and at rest (AES-256), with ID numbers encrypted individually.
- Tenant isolation: every record belongs to one organisation, and isolation is enforced at the data layer, not only in the app.
- Roles by site, so people see only what their job needs. See Roles and permissions.
- A tamper-evident audit trail of views, exports and changes.
- Retention rules that delete data on schedule, with every deletion logged. See Retention and deletion.
- ID numbers sealed, with only the type and last four shown, and ID photos opened only by Owners, Admins and Security leads and deleted on your schedule (1 day by default, 30 days at most).
- Signatures you can rely on: each published document version is fixed and fingerprinted, and Agoo keeps who signed which version, when and how, with a PDF copy for the visitor. See Documents to sign.
- Signed passes: a pass's QR code holds its dates, hours and gates, signed with your organisation's own key, and never the visitor's name or contact details. See Signed passes.
- Collection codes for parcels are seen only by the person or team a parcel is for, never by reception; label photos, riders' phone numbers and signatures go 90 days after the parcel is collected unless you choose otherwise. See Deliveries.
- Codes for visit requests are kept only in scrambled form and deleted within a day. See Request a visit.
- Face matching for staff only, on a basis your organisation records (required under its legal basis, or consent), with a notice employees see, and never for visitors. See Face clock-in.
Ghana Cards and L.I. 2523
The National Identity Register (Amendment) Regulations, 2026 (L.I. 2523) came into force on 9 June 2026 and are enforced from 2 November 2026. They say an organisation mustn't rely on looking at a Ghana Card, or request, rely on or reproduce a photocopy, scan or image of one, to check who someone is; identity is checked biometrically through the National Identification Authority. Agoo is built to that rule:
- A Ghana Card is never photographed. The Agoo Kiosk app reads its number on the device and lets the picture go at once, or the visitor types it; no image of a Ghana Card is saved, uploaded or kept anywhere, and Agoo refuses one wherever it's sent. If you'd rather no camera is used at all, set the question to Typed. See ID documents.
- Agoo records an ID; it doesn't check who a visitor is. The number is what the visitor gave, sealed, with only the last four shown. Nobody compares the card with the person. If you must verify someone's identity, do it through the National Identification Authority's verification service.
- Don't ask for a copy of a Ghana Card anywhere else in Agoo, such as a file question on a form, a document or a message, to check someone's identity.
Update every kiosk to the latest Agoo Kiosk app. If an older version still sends a photo of a Ghana Card, Agoo keeps the number, destroys the photo and lets the check-in through.
Special personal data
Some organisations hold data that Act 843 treats as special. Church attendance can reveal religious belief; a hospital visit can suggest something about a patient's health. Limit who can see it, collect as little as you can, and keep it no longer than you need. The church and hospital guides cover this in more detail.
Your checklist
- Register with the DPC and add your number in Console → Settings → Organisation.
- Write your privacy notice and publish it in Console → Settings → Documents (every plan). Visitors accept it before they check in, on their pass, at the kiosk and when they ask to visit, and Agoo keeps which version each accepted. See Your privacy notice.
- Collect only the fields you need. Mark personal and sensitive fields in Forms and fields.
- Set retention periods for visits, photos, ID photos and parcel photos.
- Decide who handles requests from visitors and staff.