Introduction & Controller Statement

CalBank PLC, alongside its subsidiaries and affiliate companies, recognizes that our customers expect all personal data entrusted to us to be treated with the highest standard of privacy, confidentiality, and integrity. As part of our ongoing commitment to transparency and legal compliance, this Privacy Notice sets out the principles and practices governing our collection, use, disclosure, storage, and protection of your personal information.

CalBank PLC operates as a registered Data Controller under the Data Protection Act, 2012 (Act 843) with the Data Protection Commission (DPC) of Ghana. Where our processing operations touch upon individuals located within the European Union or European Economic Area, we also align our practices with the relevant provisions of the General Data Protection Regulation (GDPR). This document explains your rights, our lawful obligations, and the measures we employ to safeguard your data.

DATA PROTECTION GOVERNANCE FRAMEWORK (ACT 843)

THE 8 KEY PRINCIPLES OF DATA PROTECTION

In accordance with the Data Protection Act, 2012 (Act 843), CalBank PLC adheres to the eight (8) foundational principles that govern the collection, handling, and processing of all personal data across our operations:

1. Accountability: CalBank PLC assumes full responsibility for ensuring that all personal data under our control is handled in strict compliance with the provisions of Act 843. We establish clear governance structures, policies, and operational controls to demonstrate continuous compliance.

2. Lawfulness of Processing: We collect and process personal data without infringing on your constitutional right to privacy. Data is processed only through fair, lawful, and reasonable methods tied to recognized legal justifications.

3. Specification of Purpose: Before or at the time of collecting personal information, we explicitly define the specific, legitimate operational or legal purpose for which the data is required. We do not collect personal data arbitrarily.

4. Compatibility of Further Processing: Personal data will not be processed for any secondary purpose that is incompatible with the original purpose of collection, unless mandated by statutory law, required for crime prevention, or authorized by your prior explicit consent.

5. Quality of Information (Section 17e & Section 26): We maintain reasonable and active processes to ensure that all personal data collected and retained is accurate, complete, updated, and not misleading, taking into account the purposes for which it was collected.

6. Openness (Section 17f & Section 23): We maintain complete transparency regarding our data processing policies, practices, and systems. We ensure that individuals are fully informed of the identity of the Data Controller, the reasons for data collection, and their statutory rights.

7. Data Security Safeguards (Section 17g & Section 28): We deploy technical and organizational security controls to safeguard personal data against loss, destruction, unauthorized access, illegal modification, or accidental disclosure.

8. Data Subject Participation (Section 17h & Sections 32–35): We guarantee individuals the right to confirm if we hold their personal information, request access to their data, and request the correction or erasure of inaccurate or unlawfully processed records.

CalBank PLC operates as a registered Data Controller under the Data Protection Act, 2012 (Act 843) with the Data Protection Commission (DPC) of Ghana. Where our processing operations touch upon individuals located within the European Union or European Economic Area, we also align our practices with the relevant provisions of the General Data Protection Regulation (GDPR). This document explains your rights, our lawful obligations, and the measures we employ to safeguard your data.

WHAT THIS POLICY COVERS

This Privacy Notice explains how CalBank PLC, alongside its subsidiaries and affiliate companies, collects, uses, shares, stores, and protects your personal information. CalBank PLC recognizes that our customers expect all personal data entrusted to us to be treated with the highest standard of privacy, confidentiality, and integrity. As part of our ongoing commitment to transparency and legal compliance, this document sets out the principles and practices governing our processing operations. CalBank PLC operates as a registered Data Controller under the Data Protection Act, 2012 (Act 843) with the Data Protection Commission (DPC) of Ghana. Where our processing operations touch upon individuals located within the European Union or European Economic Area, we also align our practices with the relevant provisions of the General Data Protection Regulation (GDPR).

The scope of this policy applies comprehensively across all delivery channels, operational units, and touchpoints within our banking environment. In physical environments, this Notice governs data collected during in-person visits to our branch network, physical paper application forms, image and video footage captured by Closed-Circuit Television (CCTV) surveillance systems operating on and around Bank premises, and biometric identification data processed during verification procedures. In digital environments, it encompasses our digital ecosystem, including online banking portals, mobile applications, web services, Automated Teller Machines (ATMs), and Point of Sale (POS) card services. Furthermore, this policy governs back-office operations and customer support interactions, including customer care call center voice recordings, live web chat logs, email correspondence, and data processed through authorized third-party agency networks, intermediaries, and strategic service partners.

HOW WE COLLECT INFORMATION ABOUT YOU

We collect information about you through both direct and indirect channels to deliver safe, efficient, and compliant financial services.

•  Information Provided Directly

We collect personal data directly from you whenever you open an account, apply for credit or financial facilities, subscribe to digital banking platforms, complete surveys, or communicate with our support teams. This direct collection includes identity and demographic details such as your full legal name, date of birth, gender, nationality, residential address, email address, phone numbers, and official government-issued identification numbers (such as your Ghana Card or Passport details). In addition, we gather detailed financial and professional information, including employment details, job title, annual income, source of funds, transactional history, financial goals, and specific transactional instructions. We also retain records of your correspondence with us, including live chat transcripts, email messages, feedback forms, and call center voice recordings.

Security Notice – Anti-Phishing Commitment: CalBank PLC will never contact you via email, SMS, phone call, or unsolicited link requesting your confidential Personal Identification Numbers (PINs), online banking passwords, or card security codes (CVV/CVC). Protecting your authentication credentials is a shared security responsibility, and you should never disclose these credentials to anyone.

•  Information Collected Indirectly from Third Parties

To fulfill regulatory mandates and evaluate financial risk, CalBank PLC receives personal data from verified third-party sources without direct involvement from you at the point of collection. This includes credit performance records, debt histories, and credit scores obtained from licensed Credit Reference Bureaus. We also collect background screening data from international sanctions watchlists, politically exposed person (PEP) databases, public business registries such as the Registrar General’s Department, and government tax databases to fulfill our Know-Your-Customer (KYC) obligations.

•  Information Collected Automatically via Cookies and Digital Tools

When you navigate our website and digital channels, we automatically collect technical metadata to ensure platform functionality, stability, and security. This technical data includes your Internet Protocol (IP) address, browser type and version, device operating system, hardware specifications, pages visited, timestamps of your visits, and referral web addresses. We manage website tracking through a transparent cookie policy. Essential cookies are deployed automatically to secure user sessions and enable core site navigation under our legitimate interest. Non-essential cookies, including analytical and performance cookies, are deactivated by default and are deployed only after you grant explicit consent via our Cookie Consent Banner. You retain complete control to adjust your cookie preferences or decline tracking through your web browser or our platform consent management tool.

•  Processing of Sensitive Personal Data

CalBank PLC generally avoids collecting sensitive personal data unless strictly required by statutory regulations or explicitly consented to by you. Sensitive data includes information regarding health conditions, criminal records, trade union membership, or biometric data. Where biometric information (such as fingerprint scans or facial recognition) is utilized for account authentication or identity verification, it is processed under strict confidentiality standards, robust encryption protocols, and explicit legal bases in full compliance with the Data Protection Act, 2012.

 HOW WE USE YOUR INFORMATION

To remain fully compliant with data protection laws, CalBank PLC processes your personal data only when an established lawful basis exists under the Data Protection Act, 2012 (Act 843) and international standards. We do not engage in blanket or arbitrary processing; every processing activity is tied directly to a specific legal justification.

•  Contractual Necessity

We process personal data that is strictly required to enter, execute, or manage a contractual relationship with you. This includes evaluating account opening applications, executing daily financial transfers, issuing debit and credit cards, managing loan agreements, issuing bank statements, and delivering customer service communications requested by you.

•  Legal and Regulatory Obligations

As a licensed financial institution, CalBank PLC is subject to extensive statutory requirements. We process personal data to fulfill mandatory obligations under Ghanaian financial laws, Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) frameworks, tax reporting laws, court orders, and binding directives issued by the Bank of Ghana (BoG), the Cyber Security Authority (CSA), the Data Protection Commission (DPC), and other regulatory authorities.

•  Legitimate Business Interests

We process personal data where necessary to pursue our legitimate business interests, provided these interests are not overridden by your fundamental privacy rights. Legitimate interests include detecting and preventing financial fraud, ensuring network and information security, operating CCTV systems for physical security across premises, performing internal risk assessments and audits, and continuously evaluating and improving our financial products and services.

•  Explicit Consent

In circumstances where processing falls outside contractual or statutory duties, we rely on your freely given, specific, and informed consent. This applies to activities such as sending opt-in promotional marketing materials, offering third-party financial products, or deploying non-essential website tracking technologies. You maintain the right to withdraw your consent for these specific activities at any time without impacting on your core banking services

WHEN WE SHARE YOUR INFORMATION

CalBank PLC strictly limits the sharing of your non-public personal information. We do not sell, rent, or lease customer data to third parties for commercial gain. Disclosures are made only under clearly defined legal and operational conditions.

•  Statutory Disclosures Required by Law

We disclose personal data to state agencies, regulatory bodies, and judicial entities where mandated by law. This includes mandatory disclosures to the Bank of Ghana (BoG), the Data Protection Commission (DPC), the Ghana Revenue Authority (GRA), law enforcement agencies, and courts of competent jurisdiction. We also share data with licensed Credit Reference Bureaus and established fraud prevention networks to fulfill statutory credit reporting and financial crime prevention duties.

•  Service Providers and Operational Partners

To deliver seamless banking operations, we share data on a strict need-to-know basis with vetted third-party service providers acting as Data Processors. These include IT infrastructure providers, payment card processing networks (such as Visa and Mastercard), cloud hosting platforms, statement printing vendors, core banking software vendors, and communication channel providers. All such vendors are bound by legally enforceable Data Processing Agreements requiring them to maintain strict security standards matching our own.

•  Disclosures Requiring Explicit Consent

Where we offer joint products alongside co-branded partners or third-party financial institutions, disclosures are strictly limited to necessary operational data and require your explicit prior authorization. Non-public personal information will never be shared with external companies for their independent marketing or promotional purposes without obtaining your explicit opt-in consent.

HOW LONG WE KEEP YOUR INFORMATION

In accordance with the storage limitation principle, CalBank PLC retains your personal data only for as long as necessary to fulfill the operational purposes for which it was gathered, or as mandated by statutory, regulatory, and tax laws governing financial institutions.

Customer identification records, Know-Your-Customer (KYC) verification documentation, and general account agreements are retained for a mandatory period of seven (7) years following the closure of your account or the formal termination of our business relationship, in compliance with national AML/CFT legislation and Bank of Ghana directives. Transactional financial records are likewise maintained for a minimum of seven (7) years from the transaction date to satisfy statutory accounting and audit obligations.

Customer care voice recordings and digital live chat transcripts are typically retained for up to one (1) year for quality assurance and dispute management before being permanently purged, unless required longer for ongoing legal proceedings. Closed-Circuit Television (CCTV) footage recorded on Bank property is routinely overwritten within XX-to-XX days, unless flagged for active security investigations. General email communications are managed under strict lifecycle retention policies that qualify and eliminate indefinite storage practices. Upon the expiration of mandatory retention periods, physical records are securely shredded, and electronic data is permanently deleted or anonymized.

 HOW WE SECURE YOUR INFORMATION

CalBank PLC maintains a robust, multi-layered security infrastructure engineered to protect your personal data against unauthorized access, destruction, loss, alteration, or unlawful disclosure. Access to customer data is strictly restricted to authorized employees and verified service providers who require it to deliver products and services to you.

•  International Security Certifications

To demonstrate our adherence to international best practices, CalBank PLC holds active certifications for ISO/IEC 27001:2022 (Information Security Management System) and the Payment Card Industry Data Security Standard (PCI DSS). These independent certifications provide continuous assurance that our technical controls, physical facilities, and administrative procedures meet rigorous international security standards.

•  Incident Management and Breach Notification

In the event of a personal data security incident or breach that poses a high risk to your rights, freedoms, or financial security, CalBank PLC will activate its formal Breach Response Protocol. We commit to notifying the Data Protection Commission (DPC) of statutory timeframes and promptly informing affected customers. Our notification will outline the nature of the breach, the potential impact, and the corrective measures implemented by the Bank to contain and mitigate the risk.

•  Internet Transmission Risk Notice

While CalBank PLC implements advanced encryption protocols and firewalls to protect all internal systems, data transmitted over the open internet via unencrypted emails or third-party web channels carries inherent security risks. Data transmitted to us online is done at your own risk until it reaches our secure network infrastructure. However, this disclaimer applies strictly to data in transit across public networks and does not limit, diminish, or exclude CalBank PLC’s statutory duties, legal liabilities, or regulatory obligations to safeguard your personal information once received and stored within our systems.

8. CHILDREN USING OUR SERVICE

CalBank PLC’s core financial services, digital portals, and website are directed primarily at adult individuals aged eighteen (18) years and above. We do not knowingly collect or process personal data directly from minors without appropriate legal authorization.

Where special savings products or trust accounts are established for minors under 18 years of age, processing operations are conducted strictly with the explicit consent and under the direct supervision of a verified parent or legally appointed guardian.

YOUR RIGHTS & CHOICES

Under the Ghana Data Protection Act, 2012 (Act 843), you have several rights regarding the personal information that we collect and process about you. We are committed to respecting these rights and providing you with appropriate assistance when you choose to exercise them.

1. Right to be Informed: You have the right to be informed about how we collect, use, store, disclose and protect your personal information. This includes being informed about the purpose for collecting your data, the legal basis for processing it, who it may be shared with, and how long it will be retained.

2. Right to Give and Withdraw Consent: Where the processing of your personal information is based on your consent, you have the right to give your consent voluntarily and to withdraw it at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before the consent was withdrawn.

3. Right of Access: You have the right to request confirmation as to whether we hold your personal information and to obtain access to that information. Upon request, we will provide you with a copy of your personal data together with information about how it is being processed, subject to applicable legal and regulatory requirements.

4. Right to Rectification: You have the right to request the correction or updating of any inaccurate, incomplete or outdated personal information that we hold about you. We will take reasonable steps to ensure that your personal information remains accurate and up to date.

5. Right to Object: You have the right to object to the processing of your personal information where there are legitimate grounds relating to your circumstances. We will review your request and cease processing where required by law unless we have compelling legitimate grounds or a legal obligation to continue processing.

6. Right to Restrict Processing: You have the right to request that we temporarily restrict the processing of your personal information in certain circumstances, such as where you contest the accuracy of the information or where you have objected to its processing while we assess your request.

7. Right to Freedom from Automated Decision-Making and Profiling: You have the right not to be subject to a decision based solely on automated processing, including profiling, where such a decision significantly affects your legal rights or interests, unless permitted by law. Where automated processing is used, you may request human intervention, express your views, and contest the decision.

8. Right to Prevent Processing for Direct Marketing: You have the right to request that we stop using your personal information for direct marketing purposes. Upon receiving your request, we will cease sending marketing communications unless you subsequently choose to opt in again.

9. Right to Compensation: If you suffer damage, loss or distress because of the unlawful processing of your personal information or our failure to comply with the Ghana Data Protection Act, 2012 (Act 843), you may be entitled to seek compensation in accordance with the law.

10. Right to Complain: If you believe that we have not handled your personal information in accordance with the Ghana Data Protection Act, 2012 (Act 843), you have the right to lodge a complaint with us. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Commission (DPC) of Ghana, which is responsible for enforcing data protection laws in Ghana.

Exercising Your Rights

To exercise any of the rights described above, please complete our Data Subject Rights Request Form or contact our Data Protection Supervisor (DPS) using the contact details provided in this Privacy Policy. We may request proof of identity before processing your request to protect your personal information from unauthorized access or disclosure.

We will acknowledge your request promptly and respond within the timelines prescribed under the Ghana Data Protection Act, 2012 (Act 843), or any other applicable legal or regulatory requirements.

INTERNET TRANSMISSION

While CalBank PLC implements appropriate technical and organizational measures, including encryption, secure network infrastructure, firewalls, and continuous security monitoring, no method of transmitting information over the Internet or electronic means of communication can be guaranteed to be completely secure.

Where you choose to communicate with us through electronic channels, we encourage you to use our secure banking platforms and avoid sending sensitive personal or financial information through unsecured email or other unencrypted communication methods.

Once your personal information is received through our authorized systems, CalBank PLC applies appropriate safeguards to protect it against unauthorized access, disclosure, alteration, loss, or destruction in accordance with the Ghana Data Protection Act, 2012 (Act 843), applicable banking regulations, and our internal information security policies.

POLICY UPDATES, CONTACT US & COMPLAINTS

Changes to This Privacy Notice

CalBank PLC reserves the right to update this Privacy Notice periodically to reflect changes in regulatory requirements, banking technology, or operational practices. For any material changes that affect how your personal data is handled or rights exercised, we will provide advance notification at least thirty (30) days prior to the effective date. These notices will be communicated through direct email, SMS broadcasts, bank statement inserts, or prominent announcements on our website and mobile applications.

Contact Information

If you have questions regarding this Privacy Notice, wish to exercise your data subject rights, or have concerns about how your data is being managed, please contact our dedicated Data Protection Supervisor:

Data Protection Supervisor

• CalBank PLC – Head Office
  23 Independence Avenue, Ridge, Accra, Ghana
• Email: customercare@calbank.net / privacy@calbank.net
• Telephone: +233 (0) 302 680 081 / +233 (0) 302 680 082

External Complaint Escalation Route

If you are dissatisfied with our response to a privacy request, or if you believe your personal data is being processed in violation of the Data Protection Act, 2012 (Act 843), you have the legal right to escalate the matter to the regulatory authority:

Data Protection Commission (DPC) – Ghana
Website: www.dataprotection.org.gh
Email: info@dataprotection.org.gh