GDPR Compliance

Overview

At Sporafind, we are deeply committed to protecting the privacy and personal data of our users. This page explains how we comply with the General Data Protection Regulation (GDPR) — the European Union's comprehensive data protection framework — and what that means for you as a data subject. We process personal data lawfully, fairly, and transparently, and we have designed our platform with privacy at its core.

This GDPR Compliance page applies to all users of the Sporafind platform, website visitors, and individuals whose data may appear in our diaspora intelligence datasets. It describes our role as both data controller and data processor, the legal bases we rely on, the rights you hold, and the measures we take to safeguard your information.

Data Controller Information

Sporafind is a product of Gabochie Intelligence Ltd, a Ghanaian company headquartered in Accra, Ghana. We act as the data controller for the personal data we collect directly from our users and platform visitors.

Data Protection Officer

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing our data protection strategy and ensuring our compliance with GDPR requirements. The DPO serves as the primary point of contact for data subjects and supervisory authorities.

Legal Basis for Processing

Under the GDPR, we are required to establish a lawful basis for any processing of personal data. Sporafind relies on the following legal bases depending on the context of processing:

• Contractual necessity (Article 6(1)(b)) — We process personal data as necessary to deliver the services you have requested under our Terms of Service. This includes account creation, authentication, billing, and platform access management.
• Legitimate interests (Article 6(1)(f)) — We process certain data for our legitimate business interests, including platform security, fraud prevention, product improvement, analytics, and direct marketing of similar services, provided these interests are not overridden by your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests.
• Consent (Article 6(1)(a)) — Where we rely on your consent, we will obtain it through a clear affirmative action before processing begins. You have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. This applies to non-essential cookies, certain marketing communications, and optional data collection programmes.
• Legal obligation (Article 6(1)(c)) — We may process personal data where necessary to comply with a legal or regulatory obligation to which we are subject, including tax, anti-money laundering, and record-keeping requirements.

Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR. We have designed our systems and processes to enable you to exercise these rights freely and without hindrance.

Data We Collect and Why

We collect and process only the personal data that is necessary for the specific purposes for which it was obtained. Below is a summary of the categories of data we process and the purposes of processing:

• Account data — Name, email address, organisation name, billing details, and password hash. Collected for account creation, authentication, service delivery, billing, and customer support.
• Usage data — IP address, browser type, device information, session timestamps, feature interactions, and page views. Collected to maintain platform security, improve user experience, and analyse product usage patterns.
• Profile and search data — Search queries, filters applied, bookmarked profiles, exported datasets, and CRM sync activity. Collected to deliver the core diaspora intelligence service, improve AI model accuracy, and provide personalised recommendations.
• Communication data — Email correspondence, support ticket content, and survey responses. Collected to provide customer support, respond to enquiries, and improve our services based on user feedback.
• Payment data — Credit card information is processed directly by our PCI-DSS compliant payment processor (Stripe). We do not store full card numbers on our servers. Billing address and transaction history are retained for accounting and tax compliance.

We do not process special categories of personal data (sensitive data such as race, religion, health, or political opinions) unless you have explicitly provided such information in a support communication. Where we do, we will seek your explicit consent.

Data Retention Periods

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our retention schedules are as follows:

• Account data — Retained for the duration of your account's active status plus 12 months following account deletion to allow for reinstatement and to satisfy legal obligations.
• Usage data — Aggregated analytics retained indefinitely in de-identified form. Raw usage logs retained for 24 months.
• Communication data — Support correspondence retained for 36 months following resolution of the enquiry.
• Billing and payment data — Transaction records retained for 7 years to comply with tax and accounting regulations.
• Diaspora intelligence data — Publicly sourced intelligence data is periodically refreshed. Data associated with your searches and exports is retained for the duration of your subscription plus 90 days.

When retention periods expire, personal data is securely deleted or anonymised so that it can no longer be attributed to an identifiable individual.

International Data Transfers

Sporafind operates globally, and your personal data may be transferred to and processed in countries outside the European Economic Area (EEA). Where we transfer personal data from the EEA to countries not deemed adequate by the European Commission, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission as an appropriate safeguard under Article 46 of the GDPR.

Our primary infrastructure is hosted in the United States through Google Cloud Platform and Amazon Web Services. Both providers are certified under the EU-US Data Privacy Framework and have executed SCCs with us. We conduct Transfer Impact Assessments (TIAs) for all international data flows to ensure an equivalent level of protection is maintained.

If you would like a copy of the relevant SCCs or further information about our transfer safeguards, please contact our DPO at dpo@sporafind.com.

Security Measures

We implement a comprehensive set of technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and access. Our security programme includes:

• Encryption — All data in transit is encrypted using TLS 1.3. Data at rest is encrypted using AES-256 encryption. Database backups are also encrypted.
• Access controls — Role-based access control (RBAC) with least-privilege principles. Multi-factor authentication (MFA) is enforced for all team members with administrative access. Access logs are reviewed quarterly.
• Regular assessments — We conduct quarterly vulnerability scans and annual penetration tests by independent third-party security firms. Our application is subject to regular code review and dependency scanning.
• Employee training — All employees complete mandatory data protection and information security training upon onboarding and annually thereafter. We maintain a culture of privacy by design and default.
• Incident response — We maintain a documented Incident Response Plan (IRP) that includes containment, eradication, recovery, and post-incident review procedures. Our team is trained to respond within 24 hours of detection.

Subprocessors

We engage trusted third-party service providers (subprocessors) to assist in delivering the Sporafind platform. Each subprocessor is subject to a Data Processing Agreement (DPA) that reflects the requirements of Article 28 of the GDPR. Current subprocessors include:

• Google Cloud Platform (GCP) — Cloud infrastructure, compute, storage, and database services. DPA via Google's GDPR-compliant data processing terms. Subprocessing of account and usage data.
• Amazon Web Services (AWS) — Cloud infrastructure, CDN, and ancillary computing services. DPA via AWS GDPR-compliant terms. Subprocessing of account and usage data.
• Cloudflare — Content delivery network (CDN), DDoS protection, and DNS services. Edge-cached static assets only; no personal data processed at the edge layer.
• MongoDB Atlas — Managed database platform. Subprocessing of application data including user accounts, metadata, and intelligence dataset indices.
• Stripe — Payment processing. Subprocessing of billing data. PCI-DSS Level 1 certified. We do not store full card numbers.
• SendGrid (Twilio) — Transactional email delivery (account verification, notifications, password resets). Subprocessing of email addresses and message metadata.
• HubSpot — CRM and customer support platform. Subprocessing of contact data and support correspondence.

We review our subprocessor list at least annually. If we engage a new subprocessor that processes personal data, we will update this page and notify affected users via email or in-app notification at least 30 days prior to engagement.

Data Breach Notification Process

Sporafind has implemented a robust data breach detection, investigation, and notification process that complies with Articles 33 and 34 of the GDPR. In the unlikely event of a personal data breach:

• Detection and assessment — Our security monitoring systems and team are trained to detect and assess potential breaches. Upon confirmation, we classify the breach by severity, data types involved, affected data subjects, and risk level.
• Internal escalation — The incident response team is activated immediately. The DPO is informed within 4 hours of confirmed breach. A containment and remediation plan is executed.
• Regulatory notification — Where the breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33.
• Data subject notification — Where the breach is likely to result in a high risk to your rights and freedoms (Article 34), we will communicate the nature of the breach, contact details of our DPO, likely consequences, and measures taken or proposed to address the breach directly to affected data subjects without undue delay.
• Documentation — All breaches, regardless of notification requirement, are documented internally including facts, effects, and remedial actions taken, as required by Article 33(5).

How to Exercise Your Rights

You may exercise any of your GDPR rights by submitting a request through the form below or by contacting our DPO directly:

When submitting a request, we may need to verify your identity before processing your request. This is a security measure to ensure that personal data is not disclosed to unauthorised persons. We may ask for additional information reasonably necessary to confirm your identity.

Please be as specific as possible in your request to help us process it efficiently. If you are requesting access to or deletion of data that appears in our diaspora intelligence datasets, please provide sufficient identifying information (such as name, approximate location, and professional context) so that we can accurately locate and process your data.

Complaints

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, particularly in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

We encourage you to contact our DPO first so that we may address your concerns directly and resolve any issues promptly. You may also contact the Ghana Data Protection Commission (DPC) as our lead supervisory authority in Ghana, or the data protection authority in your country of residence if you are located in the European Union.