This website is a pre-launch website. The only personal data you can give us through it is an email address, and the only reason we want it is to tell you when HYRO opens.
This notice explains that in full, because the law requires it and because you are entitled to know before you type anything.
Who this notice is from
HYRO Exchange Ghana Ltd ("HYRO", "we", "us", "our") is a company incorporated in Ghana with its office at Accra, Ghana. We are the data controller for personal data collected through hyro.to and any subdomain of it.
We process personal data in accordance with the Data Protection Act, 2012 (Act 843) and the directions of the Data Protection Commission of Ghana. You can reach us about anything in this notice at privacy@hyro.to.
What this notice covers, and what it does not
This notice covers this website: the pages you read, the waitlist form, and any message you send us using the addresses published here.
HYRO is not live. There is no trading on this website, no account to open, no deposit to make, no wallet, and no identity verification. We do not collect Ghana Card numbers, identity documents, selfies, bank details, card numbers, mobile money numbers, wallet addresses, seed phrases or private keys through this website, and there is no circumstance in which we would ask you for any of them here.
If anybody asks you for identity documents, money, crypto, a seed phrase or a private key in the name of HYRO today, it is not us. Please report it to security@hyro.to and do not respond to it.
When the platform launches it will carry its own privacy notice covering verification, transactions and custody, and you will be asked to read and accept that notice before you can use it. Nothing in this document describes the platform, and nothing in it should be read as a description of how the platform will work.
The personal data we collect
- Your email address
- Collected only if you submit the waitlist form. It is the single field on that form and it is entirely voluntary. If you would rather not give it to us, do not submit the form: the whole website remains readable without it.
- Anything you send us
- If you email us, we hold your address, whatever name your mail client sends, and the contents of your message and our reply.
- Usage and device data
- We use Google Analytics 4 to understand how the site is used. It records pages viewed, approximate location derived from your IP address at country and city level, device type, browser, operating system, language, the site that referred you, and how long pages are open. We see this in aggregate. It does not tell us your name.
- Technical logs
- Our hosting and content delivery provider records IP addresses, user agent strings, requested URLs, response codes and timestamps as part of serving and protecting the site. We use these for availability, troubleshooting and abuse investigation only.
- Cookies and similar storage
- Set out in full in our Cookie Policy. The only cookies we set ourselves are a theme cookie and a locale cookie, which remember how you prefer the site to look.
We do not knowingly collect special categories of personal data through this website, including data about health, religion, ethnicity, political opinion, trade union membership, sexual life, biometrics or criminal records. Please do not send us any. If you do, we will delete it.
This website is intended for adults. We do not direct it at children, we do not knowingly collect data from anybody under 18, and if we discover that we hold a child’s personal data we will delete it without delay.
What we do not do with it
- We do not sell personal data, rent it, trade it, or make it available to advertisers, data brokers or list resellers. There is no arrangement of that kind and we are not looking for one.
- We run no advertising, retargeting or social media tracking pixels on this website.
- We do not profile you for automated decisions, and nothing on this website makes a decision about you by automated means.
- We do not pass your data to the market data providers whose numbers appear on the site. Prices and exchange rates are requested by our own server, so your browser never contacts those providers and they never receive your IP address.
- Our typefaces are compiled into the site and served from our own domain, so no font provider is told that you visited.
Why we process it, and on what lawful basis
| Purpose | Data used | Basis under Data Protection Act, 2012 (Act 843) |
|---|---|---|
| Adding you to the waitlist and telling you when HYRO opens | Email address | Your consent, given when you submit the form |
| Launch updates, product news and educational material | Email address | Your consent, which you may withdraw at any time |
| Understanding how the site is used so that we can improve it | Usage and device data | Our legitimate interest in operating and improving our own website, which is why this data is kept aggregate and is not used to identify you |
| Keeping the site available, and investigating abuse or attack | Technical logs | Our legitimate interest in the security of our own systems, and compliance with applicable law |
| Replying to you | Correspondence | Your consent and our legitimate interest in answering a person who has written to us |
| Meeting legal obligations and responding to lawful requests | Any of the above | Compliance with a legal obligation |
We will not use your email address for a new and unrelated purpose without telling you first and, where the law requires it, asking your consent again.
Who else sees it
- The waitlist form posts to a Google hosted script, and the addresses are stored in a spreadsheet inside our own Google workspace. Google Analytics is also Google. Google processes this data on our instructions and under its own data processing terms.
- Microsoft
- Email on the hyro.to domain runs on Microsoft 365, so any message you send us is stored there.
- Our hosting and content delivery provider
- It serves the site to you and keeps the short lived technical logs described above.
- Our professional advisers
- Lawyers, auditors and accountants, where they need it to advise us, and always under a duty of confidence.
- Regulators, courts and law enforcement
- Where they are legally entitled to it. Where the law prevents us from telling you that a request was made, we cannot tell you. That restriction is imposed on us, it is not a choice we are making.
- A buyer or successor
- If HYRO is sold, merged, reorganized, or raises capital, the data may pass to the counterparty and its advisers under confidentiality obligations. We would require them to continue honoring this notice.
Nobody else.
Processing outside Ghana
Google and Microsoft operate on infrastructure located outside Ghana, including in the United States and the European Union. That means your email address and the technical data described above are stored and processed outside Ghana.
By submitting the waitlist form you consent to that transfer for the purposes set out in this notice, as permitted by the Data Protection Act, 2012 (Act 843). We rely on the contractual data protection terms those providers make available to their customers, and we do not authorize them to use your data for their own purposes.
If you would prefer that your data not leave Ghana, do not submit the waitlist form. You can read every page of this website without giving us anything.
How long we keep it
- Waitlist email addresses: until 24 months after launch, or until you ask us to remove you, whichever comes first.
- If we decide not to launch, we delete the waitlist within 90 days of that decision.
- If you unsubscribe, we keep a minimal suppression record of your address so that we do not email you again by mistake. That record exists to protect you and we keep it for as long as we send email at all.
- Correspondence: 24 months from the last message in the exchange.
- Analytics data: for the retention period set in Google Analytics, which is a maximum of 14 months for event level data.
- Technical logs: for the short period set by our provider, normally 30 days or less.
- Anything subject to a legal hold, a regulatory request or an actual or threatened claim: until that matter is finally resolved.
Deletion takes effect in our live systems immediately. Encrypted backups age out on their own cycle, so a deleted record can persist in backup for up to 90 days before it is overwritten. We do not restore deleted records from backup except to recover from a failure.
Security, stated honestly
We apply measures appropriate to the small amount of data we hold: encryption in transit over HTTPS, access restricted to the people who need it, multi factor authentication on the accounts that can reach the waitlist, and logging of access.
We also have to be honest with you about the limits of that. No system is perfectly secure and no transmission over the internet can be guaranteed secure. We do not guarantee it and nobody credibly can. To the maximum extent permitted by law we are not liable for interception, loss or unauthorized access that occurs despite measures that were reasonable in the circumstances.
The strongest protection here is structural: an email address is all this website holds about you, and that is deliberate.
Your rights, and how to use them
Under the Data Protection Act, 2012 (Act 843) you may ask us to:
- confirm whether we hold personal data about you, and give you a copy of it;
- correct personal data that is inaccurate or incomplete;
- delete or block personal data where we no longer have a lawful reason to hold it;
- stop using your data for direct marketing, which we will do on request and without argument;
- stop relying on consent you have withdrawn.
Write to privacy@hyro.to. We need to be reasonably satisfied that the request comes from you, which for a waitlist address normally means sending it from that address. We respond within 30 days. If a request is complex we will tell you within that period and explain how much longer we need.
We may decline a request, or charge a reasonable fee, where it is repetitive or manifestly excessive, and we will tell you why. We may also redact material that would reveal another person’s personal data, or that is legally privileged or commercially confidential.
Complaints
Please come to us first at privacy@hyro.to, because most things can be fixed quickly. If you are not satisfied with how we have handled it, you may complain to the Data Protection Commission of Ghana, which supervises compliance with the Data Protection Act, 2012 (Act 843). Complaining to us does not take away your right to go to the Commission at any time.
Changes to this notice
We may update this notice as the business develops, and we will certainly replace it when the platform launches. The version in force is always the one published on this page, with the date at the top.
Where a change materially reduces the protection you have under this notice, we will say so plainly on this page and, where the law requires it, notify waitlist members by email. Continuing to use the website after a change takes effect means you accept the updated notice.
