Data Protection & Privacy Notice

1. Data Controller and Regulatory Commitment

ARB Apex Bank PLC ("Apex Bank"), incorporated under the laws of Ghana and licensed by the Bank of Ghana, operates as the Data Controller in respect of personal and institutional data processed within the Microfinance Industry Information System (MIIS).

Apex Bank is committed to upholding the privacy rights of individuals and complying fully with the Data Protection Act, 2012 (Act 843), the Bank of Ghana Cyber and Information Security Directive, and international financial data protection best practices.

2. Categories of Personal Data Collected and Processed

MIIS collects and maintains data strictly necessary to fulfill regulatory oversight, inter-bank technical support, and personnel management for participating institutions:

3. Lawful Bases for Processing

Apex Bank processes personal data through MIIS under the following lawful legal bases:

• Legal & Regulatory Obligation: Compliance with mandatory provisions of the Banks and Specialised Deposit-Taking Institutions Act, 2016 (Act 930) and statutory reporting to the Bank of Ghana.
• Contractual Performance: Execution of operational agreements, shared banking infrastructure contracts, and ICT services provided to affiliated financial institutions.
• Public & Industry Interest: Preservation of financial system stability, systemic fraud mitigation, and compliance with anti-money laundering regulations.

4. Data Isolation and Multi-Tenant Privacy Safeguards

The architecture of MIIS includes strict multi-tenant boundary isolation. Personnel data belonging to a participating institution is isolated such that:

• Local users cannot query, view, export, or correlate personnel records of other participating institutions.
• Apex Bank personnel receive access strictly proportionate to their authorized administrative or support responsibilities (CSC, Apex HR, Super Admin).
• Dual control prevents unauthorized unilateral updates or bypass of managerial oversight.

5. Third-Party Disclosures and Transfers

Personal data held in MIIS is never monetized, leased, sold, or shared for commercial marketing. Disclosures are restricted exclusively to:

• The Bank of Ghana for prudential supervision, statutory audits, and industry statistics.
• The Financial Intelligence Centre (FIC) pursuant to anti-money laundering reporting requirements under Act 1044.
• Judicial authorities pursuant to lawful court orders, subpoenas, or statutory investigations.

6. Data Retention and Archival Schedule

Personnel records are maintained in active status throughout the duration of employment. Following separation (Resignation, Retirement, or Dismissal), records are retained in compliance with Bank of Ghana prudential guidelines for a statutory minimum of six (6) years to facilitate regulatory inquiries, dispute reconciliation, and institutional clearance.

Audit trails and system event logs are retained indefinitely in secure, immutable storage to preserve legal non-repudiation and forensic audit integrity.

7. Technical and Organizational Security Measures

Apex Bank deploys enterprise-grade security controls to protect data stored within MIIS against loss, unauthorized access, destruction, and alteration:

• Cryptographic protection: TLS 1.3 transport encryption for all web sessions and AES-256 encrypted database backups.
• Automated Credential Revocation: Immediate generation of application deactivation tasks upon managerial sign-off of staff separation.
• Password hashing: Industry-standard Bcrypt algorithm with salted individual hashes.
• Strict Role-Based Access Control (RBAC) preventing unauthorized privilege escalation.

8. Rights of Data Subjects

In accordance with Sections 32 through 43 of the Data Protection Act, 2012 (Act 843), registered personnel have the right to:

• Request access to their personal data stored within the system via their institutional Local HR.
• Request rectification of inaccurate, incomplete, or obsolete personal information.
• Object to processing that exceeds statutory regulatory mandates.
• Lodge formal complaints with the Data Protection Commission (DPC) of Ghana.

9. Data Protection Officer and Contact Details

For data protection inquiries, subject access requests, or regulatory disclosures, please contact the designated Data Protection Officer: