Privacy Policy

1. Who is responsible for your data #

The data controller is Noir Community, operating as Noir, an unincorporated association, established in Ghana, of University of Ghana, Legon, Accra, Ghana.

For anything in this policy, contact info@noirgh.com.

2. What we collect #

What we hold depends on how you use the platform. We have listed it by role so you can find yours. Nothing here is collected "just in case" - each group exists to make a specific feature work.

Everyone with an account

• Username, email address, and a securely hashed password (we never store your password itself).
• Your role or roles, account status, and the dates you registered and last updated your account.
• Notification preferences.

Creatives and members

• Full name and, if you choose one, a nickname and a public username.
• Phone number.
• Institution, year of study, hall or area, and region.
• Skills, experience level, available days and working hours.
• Biography, profile photograph, and a CV file if you upload one.
• Ratings, reviews received, and number of completed jobs.
• Gallery work - images, showreel links, titles and captions.
• Social handles you choose to add - Instagram, TikTok, X, LinkedIn, Behance, YouTube, Facebook, and a website address. Optional, and public on your profile.

Trainees

Training programmes are run in person and in cohorts, so enrolment collects more than the rest of the platform:

• Full name, phone number, and profile photograph.
• Date of birth - to confirm eligibility and, for applicants aged 16 or 17, to apply the guardian-consent rule.
• Gender - used for cohort planning and for reporting participation to programme funders, always in aggregate.
• Occupation status and education level.
• Region, area of residence, and Ghana Post GPS address.
• Emergency contact - name, phone number and relationship to you. Used only if something happens to you during a programme.
• Application answers, lesson progress, assessment submissions and results.

Employers

• Company name, contact person, phone number, industry, website and description.
• Company logo.
• Job listings, applications received, bookings, engagements, invoices and payment records.

Sellers in Uni Market

• Shop name, tagline, description, logo and banner.
• WhatsApp number - this is shown publicly on your shop as a contact button.
• Campus, region, area, and Ghana Post GPS address, from which we derive approximate coordinates.
• Delivery, pickup and returns terms you write.
• Mobile money name, number and network - used to pay you. Never shown publicly.
• Your products, prices, options, stock and images.

Buyers in Uni Market

• Name and phone number for the order.
• Delivery address, or your choice of pickup.
• Any note you add to the order.
• Order contents, prices, and payment reference from Paystack. We never receive or store your full card number.
• Reviews you leave, which are public and shown with your display name.

Donations

• Donor name, email address, amount, and any message. You can choose to donate anonymously, in which case your name is not displayed publicly - but we still hold it against the payment record.

Session bookings (graduation and matriculation)

You can book a photo session without creating an account. For those bookings we hold:

• Your name, phone number, email address and institution, the package you chose, and any notes you add for us.
• The day and time you said you would prefer, and the payment record for the booking.
• If you paid us in person, the receipt code you were given, so we can reconcile the cash against our receipt book.
• A private access link for your booking. Anyone holding that link can see the booking, so treat it like a password.
• The time you start and end your session, if you tap to record it from your booking page.
• Photos of yourself that you choose to upload, used to pick you out of the photographs from your ceremony. This is explained in the next heading.

Photographs and face matching

A ceremony produces thousands of photographs of hundreds of people wearing near-identical gowns. To work out which of them are of you, we compare faces.

• This is optional and it is your choice. Uploading a photo of yourself, and recording your session time, both help us find your photographs faster. If you do neither, we sort your photographs by hand instead. Nothing about your booking, your price or your delivery depends on it.
• When you upload a photo of yourself, we derive a mathematical description of your face from it (a "face template") and compare it against the faces in the photographs from your ceremony. A face template is biometric data, and under the Data Protection Act, 2012 (Act 843) that is sensitive personal data. We process it only with your consent, given by choosing to upload the photo.
• The comparison is run by our own team on our own equipment, for your booking only. We do not use a third-party face recognition service, we do not use your photographs or your face template to train any model, and we never use them to identify you anywhere other than in the photographs from the ceremony you booked.
• The time you record for your session is used the same way: it narrows the search to the photographs taken while you were actually in front of the camera.
• You can remove an uploaded photo of yourself at any time from your booking page, and it is deleted from the live platform immediately along with any face template derived from it.
• We do not use face matching anywhere else on the platform, and never for security, access control or monitoring.

Messages and community activity

• Direct messages, channel messages, comments and likes, including who sent what and when.

Technical information

• Standard server logs kept by our hosting provider, which include IP addresses, for security and troubleshooting.
• Session and authentication cookies (see section 9).
• If you enable push notifications: a browser push endpoint and its encryption keys. This identifies a browser, not you personally.
• If you connect Google Calendar: an access token and refresh token held so we can write engagement events to your calendar.
• For likes left by visitors who are not signed in, we store a one-way SHA-256 hash of the IP address - enough to stop the same visitor liking twice, not enough to identify them.

What we do not collect

We do not collect Ghana Card or passport numbers, bank account numbers, health data, or information about your religion, ethnicity, political opinions or sexual orientation. We do not run advertising trackers or sell data to data brokers.

The one exception on biometric data is the optional face matching described above, which applies only to photo-session bookings, only to photographs you upload yourself, only with your consent, and only for finding your own photographs from your own ceremony. There is no other biometric processing anywhere on the platform.

3. Why we use it, and our lawful basis #

Under the Data Protection Act, 2012 (Act 843) we must have a proper reason for every use. Ours are:

Where we rely on your consent - for example to publish an optional profile field, to send marketing, to enable push notifications, or to match your face to your photographs - you can withdraw it at any time without affecting anything we did before you did. For face matching, withdrawing consent means removing the uploaded photo from your booking page, which deletes it and anything derived from it; we then sort your photographs by hand.

4. What is public, and what is not #

This is the section people most often want, so it is set out plainly. "Public" means visible to anyone on the internet and possibly indexed by search engines.

Public on a Creative profile

Name or nickname, username, profile photograph, institution, year of study, region, skills, experience level, available days and working hours, biography, rating, number of completed jobs, verification marker, your gallery, and any social handles you add.

Social handles are entirely optional and you can remove them at any time from the Profile tab of your dashboard. Adding one is a decision to link your Noir profile to that account publicly - anyone who finds you here can follow the link, and search engines may index the connection.

Public on a shop or product page

Shop name, tagline, description, logo and banner, WhatsApp number, campus, region and area, delivery and returns terms, all product details and images, ratings, and reviews with the reviewer's display name.

Shop location is published as an approximate point. We deliberately round the coordinates to two decimal places - roughly a 1.1 km square - so proximity search works without publishing where you live. Your full Ghana Post GPS address is never shown publicly.

Never public

Email address, phone number (other than a Seller's WhatsApp number, above), CV file and CV text, date of birth, gender, exact home address and GPS address, emergency contact details, mobile money name, number and network, buyer delivery addresses, order notes, direct messages, assessment results, and invoices.

Shared with specific people, not the public

When you apply for a job, the Employer sees your application and CV. When you place an order, the Seller sees your name, phone number and delivery details so they can fulfil it - and you see theirs. When you are booked, the Employer sees the contact details needed to work with you.

You can ask us to unlist you from the public Talent Directory at any time while keeping your account - email info@noirgh.com or use the Profile tab in your dashboard.

5. Who else sees your data #

We do not sell your personal data and we never will. We share it only in these situations:

Other users

As described in section 4 - Employers see applicants, Sellers and Buyers see each other's order details.

Service providers

Where a link opens WhatsApp or LinkedIn, that is a normal outbound link - those services then apply their own policies.

Programme funders and partners

We report on training programmes to the organisations that fund them. These reports are aggregated - counts and percentages, not names - unless you have separately agreed to be named in a case study.

Legal

We may disclose data where the law requires it, where a court or regulator orders it, or where it is necessary to establish or defend a legal claim or to prevent serious harm.

Business transfer

If Noir is restructured, merged or acquired, data may transfer to the new entity. Your rights under this policy travel with it, and we will tell you if it happens.

6. How we protect it #

We take the security measures required by Act 843, including:

• encrypted connections (HTTPS) across the whole site;
• passwords stored only as salted hashes - we cannot read yours, and neither can an attacker who obtains the database;
• parameterised database queries throughout, so that data submitted through forms cannot be used to reach data it should not;
• every action that changes data protected against cross-site request forgery;
• role-based access, so staff see only what their role requires; and
• output escaping on user-supplied content to prevent script injection.

No system is perfectly secure. If a breach occurs that is likely to put you at risk, we will notify you and the Data Protection Commission without undue delay, and tell you what happened and what to do.

You can help: use a password you do not use elsewhere, and tell us at info@noirgh.com if you think your account has been accessed by someone else.

7. How long we keep it #

We keep personal data only as long as we need it.

Deleting something removes it from the live platform straight away; it may persist in a backup until that backup rotates out.

8. Your rights #

Under the Data Protection Act, 2012 (Act 843) you have the right to:

• Be told whether we hold data about you, and get a copy of it;
• Correct anything inaccurate or incomplete - most of this you can do yourself in your dashboard;
• Ask us to delete data, or to stop or restrict a particular use;
• Object to processing that relies on our legitimate interests, including profiling;
• Stop direct marketing at any time, with no reason needed;
• Withdraw consent you previously gave; and
• Complain to the Data Protection Commission.

Some rights have limits. We cannot delete a record we are legally required to keep - a completed order stays in the financial record even if you close your account, though we can disconnect it from your public identity. If we cannot do what you ask, we will tell you why.

How to exercise a right: email info@noirgh.com and tell us what you want. We may need to confirm your identity first, so that nobody else can request your data. We will respond within 30 days. There is no charge, unless a request is clearly excessive or repetitive.

If you are unhappy with our response, you can complain to the Data Protection Commission of Ghana, which regulates how organisations handle personal data. Please give us a chance to fix it first - it is usually much quicker.

9. Cookies and similar technologies #

We keep cookies to a minimum. We do not use advertising or cross-site tracking cookies.

These are strictly necessary for the platform to work, so they are set without a consent banner. You can block cookies in your browser, but you will not be able to sign in.

Embedded YouTube and Vimeo players may set their own storage when you play a video. We use YouTube's no-cookie domain to limit this, but playing a video does contact those services.

The hashed IP address described in section 2 is not a cookie, but it serves a similar purpose for visitors who are not signed in.

10. Notifications and marketing #

Service messages - order updates, application outcomes, booking reminders, password resets - are part of the service. You cannot opt out of these while your account is open, because they are how the platform tells you something happened.

Marketing and community updates are optional. You can turn them off in your dashboard notification settings or by using the unsubscribe link in any such email.

Push notifications are off until you enable them, and you can revoke permission in your browser at any time.

11. Data outside Ghana #

Some of our providers process data outside Ghana - Paystack, Google, and our hosting and email providers operate internationally.

Where data leaves Ghana we rely on the provider's contractual data protection commitments and, where applicable, recognised transfer safeguards. We choose providers that publish a data processing agreement and a security posture we can check.

12. Children #

The platform is intended for people aged 18 and over, except for training programmes open to applicants aged 16 and 17, who may only enrol with a parent or guardian's consent.

Under-18s cannot open a shop, receive payouts, or be booked for paid engagements.

We do not knowingly collect data from anyone under 16. If you believe a child under 16 has given us personal data, contact info@noirgh.com and we will delete it and close the account.

A parent or guardian may ask to see, correct or delete their child's data at any time on the same terms as in section 8.

13. Changes to this policy #

We will update this policy as the platform changes. The version and date at the top always show the current one.

If we make a change that materially affects how we use your data, we will tell you by email or an in-platform notice before it takes effect, and where the law requires consent we will ask for it again.

14. Contact us #

Privacy questions, requests and complaints:
info@noirgh.com
Noir Community, University of Ghana, Legon, Accra, Ghana

We aim to acknowledge within 2 working days and to respond fully within 30 days.