General Data Privacy Policy(V1.0)
- Associated Consultants Limited is committed to protecting personal data and respecting the
privacy of its clients, employees, consultants, subcontractors, suppliers, project stakeholders
and members of the public who interact with it.
This Privacy Notice explains how Associated Consultants Limited collects, uses, stores,
discloses and protects personal data while providing engineering consultancy services,
including feasibility studies, design services, environmental and social assessments, project
supervision, contract administration, stakeholder engagement, health, safety and environmental
monitoring, procurement support and related advisory services.
This Privacy Notice is issued in accordance with applicable data protection laws of Ghana,
including the Data Protection Act, 2012 (Act 843), and any other applicable legal, regulatory
and contractual requirements. - Data Controller
Associated Consultants Limited is the data controller responsible for the personal data that it
collects and processes under this Privacy Notice.
Company Name: Associated Consultants Limited
Address: Associated Consultants Limited,
33 Royalt Castle Road, Kokomlemle,
Accra, Ghana
Email: info@acon.com.gh
Telephone: +233-(0)30 223 7528-9
For privacy-related enquiries, requests or complaints, please contact us using the official
company contact details set out above. - Personal Data We Collect
We may collect and process the following categories of personal data, depending on the nature
of our relationship with you and the services being provided.
3.1 Contact Information
This may include names, email addresses, telephone numbers, postal addresses, organisation
names and other contact details.
3.2 Professional and Employment Information
This may include job titles, company details, professional qualifications, curriculum vitae,
employment history, institutional affiliation, project roles, professional licences, certificates
and areas of expertise.
3.3 Client, Supplier and Contract Information
This may include client records, supplier and subconsultants’ details, contact information,
payment and billing details, tender information, procurement records and correspondence.
3.4 Project and Stakeholder Information
While engineering consultancy assignments, we may collect project-related personal data,
including:
- stakeholder registers;
- attendance records;
- meeting minutes;
- consultation records;
- survey responses;
- grievance records;
- landowner or affected person information;
- community engagement records;
- photographs, videos and audio records, where necessary;
- site access records;
- contractor and subcontractor records;
- project correspondence and reporting information.
3.5 Environmental, Social, Health and Safety Information
For environmental and social assessments, resettlement-related studies, project supervision,
HSE monitoring and compliance assignments, we may collect information relating to
occupational health and safety incidents, site accidents or near misses, and the following
categories of records: - worker records relevant to site access or safety;
- community health and safety concerns;
- vulnerable persons or affected groups, where relevant to the assignment;
- grievance and complaints management;
- environmental and social monitoring records.
Where sensitive personal data is collected, we will only collect what is necessary for the
specific assignment and will apply appropriate safeguards.
3.6 Technical and Website Data
Where you use our website or digital platforms, we may collect technical data such as your IP
address, browser type, operating system, device information, website usage data, cookies and
similar tracking information.
3.7 Other Information Provided to Us
We may also process any other information that you voluntarily provide to us through
correspondence, meetings, forms, interviews, surveys, consultations, workshops or project-
related activities.
- How We Use Personal Data
We process personal data for lawful purposes connected with our business operations and the
delivery of engineering consultancy services. These purposes may include:
the provision of engineering consultancy services, including the following activities:
- preparing feasibility studies, designs, reports, assessments and technical documentation;
- undertaking environmental and social impact assessments;
- conducting stakeholder consultations and community engagements;
- managing grievances and project related complaints;
- supervising construction and infrastructure projects;
- monitoring environmental, social, health and safety compliance;
- managing contracts, procurement and project administration;
- communicating with clients, consultants, contractors, regulators and stakeholders;
- preparing reports for clients, project owners, financiers, regulators and other authorised
parties; - processing payments, invoices and financial records;
- managing employment, consultancy and subcontractor relationships;
- complying with legal, regulatory, professional and contractual obligations;
- improving our internal procedures, services, quality management systems and business
operations; - protecting the rights, property, safety and legitimate interests of Associated Consultants
Limited, our clients, personnel, stakeholders and the public.
- Legal Basis for Processing Personal Data
We process personal data on one or more of the following legal bases:
5.1 Contractual Necessity
Where processing is necessary for the performance of a contract to which we are a party, or in
order to take steps at the request of a data subject or counterparty prior to entering into a
contract.
5.2 Legal and Regulatory Obligation
Where processing is necessary to comply with applicable laws, regulations, professional duties,
tax requirements, environmental requirements, labour requirements, health and safety
obligations, procurement rules or lawful regulatory instructions.
5.3 Legitimate Interests
Where processing is necessary for our legitimate interests, including project delivery, quality
assurance, risk management, business administration, security, internal reporting and service
improvement, provided that those interests are not overridden by the rights and freedoms of
the data subject.
5.4 Consent
Where required by law, or where otherwise appropriate in the circumstances, we may rely on
consent, including in relation to optional stakeholder information, photographs, testimonials,
marketing communications or other specific purposes.
5.5 Public Interest or Protection of Vital Interests
In limited circumstances, we may process personal data where necessary to protect health,
safety, life, property, the environment or the public interest, particularly in relation to HSE
incidents, emergencies, environmental risks or community safety concerns.
- Data Sharing and Disclosure
We may share personal data where this is necessary for project delivery, legal compliance,
contractual performance or legitimate business purposes.
Personal data may be shared with:
- clients and project owners;
- government ministries, departments and agencies;
- regulatory authorities, including permitting and environmental authorities;
- funding agencies, lenders and development partners;
- partner consultants and technical specialists;
- subcontractors, surveyors, laboratories and service providers;
- contractors and supervising engineers;
- auditors, insurers, legal advisers and professional advisers;
- IT support providers and data hosting service providers;
- law enforcement agencies or legal authorities where required by law;
- other parties where disclosure is necessary for project implementation, reporting,
compliance, dispute resolution, safety or protection of rights.
Where third parties process personal data on our behalf, we require them to implement
appropriate confidentiality, security and data protection measures and to process personal data
only on our documented instructions, except where otherwise required by law.
- International Transfers
Some of our assignments may involve international clients, development partners, lenders,
consultants, cloud-based systems or project reporting requirements. Where personal data is
transferred outside Ghana, we will take reasonable steps to ensure that the transfer is made
subject to appropriate safeguards, confidentiality obligations and security measures, and is
otherwise carried out in accordance with applicable law, regulatory guidance and contractual
requirements. - Data Security
We implement appropriate technical and organisational measures to protect personal data
against unauthorised or unlawful access, loss, misuse, alteration, disclosure or destruction.
These measures may include:
- access controls;
- password protection;
- secure storage of physical and electronic records;
- restricted access to project files;
- confidentiality obligations for employees, consultants and subcontractors;
- secure transmission of documents where appropriate;
- backup and recovery procedures;
- staff awareness and internal data handling procedures;
- secure disposal of records that are no longer required.
Where there are reasonable grounds to believe that personal data has been accessed or acquired
by an unauthorised person, we will take such steps as may be required under applicable law
and our internal incident response procedures.
- Data Retention
We retain personal data only for as long as is necessary to fulfil the purposes for which it was
collected, unless a longer retention period is required or permitted by law, contract, regulatory
obligation, professional obligation, audit requirement, claims management, project closure
requirements or legitimate business needs.
Retention periods may vary according to the nature of the data and the relevant assignment.
For example, project records may be retained for contractual, regulatory, audit, professional
liability, evidentiary or project reference purposes.
When personal data is no longer required, we will securely delete, destroy, anonymise or
archive it in accordance with our records management procedures. - Rights of Data Subjects
Subject to applicable law, individuals have rights in relation to their personal data. These may
include the right to:
- request access to personal data held about them;
- request correction of inaccurate or incomplete personal data;
- request deletion of personal data, where applicable;
- request restriction of processing in certain circumstances;
- object to certain types of processing;
- withdraw consent where processing is based on consent;
- prevent processing for direct marketing;
- request transfer of personal data, where applicable;
- lodge a complaint about the handling of their personal data.
Requests relating to personal data should be submitted using the contact details provided in
this Privacy Notice. We may request information reasonably necessary to verify the identity of
the requester before responding.
Under the Data Protection Act, 2012 (Act 843), a data controller is required to respond to an
access request promptly and, in any event, within forty (40) days of receipt of the request,
subject to applicable conditions and exemptions.
- Cookies and Tracking Technologies
Our website may use cookies and similar technologies to improve user experience, support
website functionality, analyse website usage and enhance our services.
Users may adjust their browser settings to refuse or manage cookies. However, certain parts of
the website may not function properly if cookies are disabled.
Where required, we will provide additional information through a Cookie Policy or cookie
notice.
- Photographs, Videos and Publicity
During project activities, meetings, consultations, training sessions, workshops, conferences or
site visits, photographs, videos or audio recordings may be taken for documentation, reporting,
training, communication or project records.
Where such media will be used for publicity, marketing or external communication, consent
will be obtained where required by law or otherwise appropriate. We will avoid using images
or personal details in a manner that is misleading, intrusive, unsafe or inconsistent with
applicable data protection requirements. - Sensitive Personal Data and Vulnerable Persons
In certain assignments, particularly environmental and social studies, resettlement-related work,
grievance management, community engagement or HSE investigations, we may encounter
sensitive personal data.
This may include information relating to health, disability, vulnerability, livelihood, household
circumstances, children, affected persons or community concerns.
We will process such information only where necessary for the relevant assignment, legal
obligation, safety requirement or legitimate project purpose, and we will apply additional
safeguards, including restricted access, confidentiality, data minimisation and careful reporting.
Where information relates to children or other vulnerable persons, we will apply appropriate
safeguards and a heightened standard of care in the collection, use and disclosure of such
information. - Direct Marketing and Communications
We may use contact details to send business-related communications, invitations, professional
updates, proposals or information about our services were permitted by law.
Where consent is required for direct marketing, we will obtain that consent before sending such
communications. Individuals may opt out of marketing communications at any time by
contacting us. - Responsibilities of Employees, Consultants and Subconsultants
Employees, consultants, subcontractors and other persons working with or on behalf of
Associated Consultants Limited are required to handle personal data responsibly, lawfully and
confidentially.
They must only access, use, disclose or retain personal data where necessary for authorised
work purposes and in accordance with company procedures, contractual obligations and
applicable law. - Changes to This Privacy Notice
We may amend or update this Privacy Notice from time to time to reflect changes in our
services, legal requirements, regulatory guidance, project operations or internal procedures.
The current version of this Privacy Notice will indicate the effective date and revision number.
Where material changes are made, we will take reasonable steps to bring those changes to the
attention of affected persons, where appropriate.
- Complaints and Enquiries
If you have any questions, concerns or complaints about this Privacy Notice or our handling of
personal data, please contact:
Associated Consultants Limited
33 Royalt Castle Road, Kokomlemle, Accra, Ghana
Email: info@acon.com.gh
Telephone: +233-(0)30 223 7528-9
Where a concern is not resolved to your satisfaction, you may lodge a complaint with the Data
Protection Commission of Ghana, which is the statutory regulator responsible for enforcing the
Data Protection Act, 2012 (Act 843).