How Privacy and Data Protection Work

This guide explains how it all fits together. For one job at a time, the short articles in this topic have the exact steps.

Data Protection

How Agoo fits Ghana's Data Protection Act, 2012 (Act 843), who is responsible for what, where data is hosted and who processes it.

Agoo holds names, phone numbers, photos and sometimes ID numbers. This page explains who is responsible for that data under Ghana's Data Protection Act, 2012 (Act 843), and how Agoo helps you meet your duties.

Who Is Responsible for What

As controller of your visitor and staff data, your organisation decides what to collect, why, and how long to keep it. Nkonso processes it only on your instructions, which include your settings in Agoo.

The Data Processing Agreement

Nkonso signs a data processing agreement (DPA) with every customer. It covers:

• processing only on your instructions;
• confidentiality for Nkonso's staff and sub-processors;
• the security measures described on our security page;
• telling you within 72 hours of becoming aware of a personal data breach affecting your data;
• helping you answer requests from people and from the Data Protection Commission;
• letting you export your data at any time, including a full export of every record on any plan, and deleting it within 30 days when you ask for your organisation to be deleted or the agreement ends. Copies in encrypted backups expire within a further 30 days and aren't restored in the meantime except to recover from an incident.

These documents are in force from 1 October 2026, on the Agoo website:

• Privacy notice
• Terms of service
• Data processing agreement
• Sub-processors
• Acceptable use policy

Registration with the Data Protection Commission

Act 843 requires data controllers to register with the Data Protection Commission (DPC).

• Your organisation should be registered as the controller of your visitor and staff data. Add your DPC registration number in Console → Settings → Organisation, and Agoo shows it on the privacy notice visitors see at check-in.
• Nkonso's registration with the DPC, as controller of its own data and processor for customers, is in progress.

Where Your Data Is Hosted

Agoo's database, API and web apps are hosted in the United Kingdom, with daily encrypted backups. Uploaded files, such as visitor photos and signatures, are stored in Western Europe, and web pages are delivered through global edge networks. When data leaves Ghana, Nkonso relies on written contracts and safeguards with each provider to protect it to a standard consistent with Act 843.

Sub-Processors

Nkonso uses a small number of service providers, called sub-processors, to run Agoo, such as providers for hosting, email, SMS and WhatsApp delivery, payments, error and crash reports, and AI features when your organisation turns them on. The sub-processors page sets out each kind of provider, the data it can receive, its country and when it applies.

Owners and Admins see each provider by name, with what it receives, where it processes data and when, in Settings → Data & privacy → Our providers. That named list is the one the DPA refers to; anyone else can ask Agoo's team for it.

Nkonso gives at least 30 days' notice of any new sub-processor, and you can object on reasonable grounds.

Reading parcel labels with AI sends the photo of a parcel's label to Agoo's AI provider only when your organisation turns it on in the deliveries settings; the rest of the parcel, the rider's details and your directory are never sent. See Reading parcel labels.

Apple Wallet and Google Wallet receive a pass's details only when a visitor chooses to add their pass to their Wallet, and handle them under the visitor's own terms with Apple or Google; updates to that pass reach the phone through them too. Nothing goes to Apple or Google for visitors who don't add their pass. See Wallet passes.

How Agoo Protects Data

• Encryption in transit (TLS) and at rest (AES-256), with ID numbers encrypted individually.
• Tenant isolation: every record belongs to one organisation, and isolation is enforced at the data layer, not only in the app.
• Roles by site, so people see only what their job needs. See Roles and permissions.
• A tamper-evident audit trail of views, exports and changes.
• Retention rules that delete data on schedule, with every deletion logged. See Retention and deletion.
• ID numbers sealed, with only the type and last four shown, and ID photos opened only by Owners, Admins and Security leads and deleted on your schedule (1 day by default, 30 days at most).
• Signatures you can rely on: each published document version is fixed and fingerprinted, and Agoo keeps who signed which version, when and how, with a PDF copy for the visitor. See Documents to sign.
• Signed passes: a pass's QR code holds its dates, hours and gates, signed with your organisation's own key, and never the visitor's name or contact details. See Signed passes.
• Collection codes for parcels are seen only by the person or team a parcel is for, never by reception; label photos, riders' phone numbers and signatures go 90 days after the parcel is collected unless you choose otherwise. See Deliveries.
• Codes for visit requests are kept only in scrambled form and deleted within a day. See Request a visit.
• No face matching: Agoo's kiosks and apps don't match faces, and Agoo holds no face templates, for staff or visitors.

Ghana Cards and L.I. 2523

The National Identity Register (Amendment) Regulations, 2026 (L.I. 2523) came into force on 9 June 2026 and are enforced from 2 November 2026. They say an organisation mustn't rely on looking at a Ghana Card, or request, rely on or reproduce a photocopy, scan or image of one, to check who someone is; identity is checked biometrically through the National Identification Authority. Agoo is built to that rule:

• A Ghana Card is never photographed. The Agoo Kiosk app reads its number on the device and lets the picture go at once, or the visitor types it; no image of a Ghana Card is saved, uploaded or kept anywhere, and Agoo refuses one wherever it's sent. If you'd rather no camera is used at all, set the question to Typed. See ID documents.
• Agoo records an ID; it doesn't check who a visitor is. The number is what the visitor gave, sealed, with only the last four shown. Nobody compares the card with the person. If you must verify someone's identity, do it through the National Identification Authority's verification service.
• Don't ask for a copy of a Ghana Card anywhere else in Agoo, such as a file question on a form, a document or a message, to check someone's identity.

Update every kiosk to the latest Agoo Kiosk app. If an older version still sends a photo of a Ghana Card, Agoo keeps the number, destroys the photo and lets the check-in through.

Special Personal Data

Some organisations hold data that Act 843 treats as special. Church attendance can reveal religious belief; a hospital visit can suggest something about a patient's health. Limit who can see it, collect as little as you can, and keep it no longer than you need.

Your Checklist

1. Register with the DPC and add your number in Console → Settings → Organisation.
2. Write your privacy notice and publish it in Console → Settings → Documents (every plan). Visitors accept it before they check in, on their pass, at the kiosk and when they ask to visit, and Agoo keeps which version each accepted. See Your privacy notice.
3. Collect only the fields you need. Mark personal and sensitive fields in Forms and fields.
4. Set retention periods for visits, photos, ID photos and parcel photos.
5. Decide who handles requests from visitors and staff.

• Retention and deletion: How long data is kept and how it's deleted.
• Data subject requests: Answer access and erasure requests.
• Audit trail: Evidence for your auditors.

Retention and Deletion

Choose how long Agoo keeps visits, photos, ID images and other data, and how deletion, legal hold and exports work.

Act 843 expects you to keep personal data only as long as you need it. In Agoo, you set how long each kind of data is kept, and deletion then happens automatically, on schedule, with every deletion logged.

Set retention in Console → Settings → Data & privacy.

How Long You Can Keep Visitor Data

Your plan sets the longest retention period you can choose for visitor data. You can always choose a shorter period.

On Free, the console shows the last 3 months of visit history. Older records aren't deleted: they're kept, hidden, and come back when you move to a paid plan.

After a move to a lower plan

Moving to a lower plan never deletes data by itself. That's true for a move to Free, whether after a trial, a missed payment or cancelling, and for a move to a cheaper paid plan, such as from Pro to Starter.

• What you see follows the new plan. Its visitor history decides what the console, exports and the API's lists show. Older records are kept, hidden, and come back when you move to a plan with a longer history.
• Your retention settings don't change. If one is longer than the new plan's maximum, for example 5 years after a move from Pro to Starter's 12 months, it keeps working as before: it only ever deletes records older than the period you chose. Console → Settings → Data & privacy shows that older records are hidden by your plan.
• New settings stay within the plan. To change a period, choose one up to the new plan's maximum.
• Requests from individuals are complete. Data subject requests and erasure cover hidden records too.
• You can still take everything with you. A full organisation export includes hidden records, on every plan.

Data is deleted only by your own retention settings, by an Owner's request to delete it, or when the organisation is deleted.

The audit trail has its own retention: 7 days on Free, 90 days on Starter, 1 year on Growth, 3 years on Pro and up to 7 years on Enterprise. See Audit trail.

Set Retention by Kind of Data

Different data deserves different periods. A visit record may be useful for a year; a photo of someone's ID rarely is.

Two kinds of booking data aren't set here, because they're never worth keeping: places on a booking waitlist are removed once the day they were waiting for has passed, and the one-time codes that confirm a booking are kept only in scrambled form and deleted within a day.

1. 1

   Open Console → Settings → Data & privacy

   You need to be an Owner or Admin.

2. 2

   Choose Change next to a kind of data

   Pick a period. Your plan's maximum is shown for visitor data, and longer periods aren't offered.

3. 3

   Check what it deletes, then save

   Before you save a shorter period, Agoo counts the records it would delete at the next run, within the hour. If there are any, tick the box to confirm, then Save and delete.

The new periods apply to all existing data as well as new data. A longer period keeps what's still there; it can't bring back what's already gone.

How Deletion Works

• Automatic, every hour. Deletion runs on its own; nobody has to remember.
• Logged. Each run is recorded in the audit trail with how many records of each kind went, and listed under Deleted on schedule in Data & privacy, so you can show auditors your rules are working.
• Complete. A visit goes with its timeline, consents and photos; personal details in audit entries about it are blanked, and the chain stays valid. A visitor's own record goes once they have no visits, bookings or watchlist matches left.
• Staff photos follow the person. A profile photo that's replaced or removed is deleted within the hour, and a person's photo is deleted when they're deactivated. Legal holds apply.
• Permanent. Deleted data can't be recovered from Agoo. Copies in encrypted backups expire within a further 30 days and aren't restored in the meantime except to recover from an incident.

Legal Hold (Enterprise)

When you're involved in an investigation, dispute or regulatory request, a legal hold stops scheduled deletion and erasure of the records you place it on until you lift it.

In Console → Settings → Data & privacy → Legal holds, choose Place a legal hold, then what it covers: the whole organisation, a site, a person in your directory or a visitor, and a reason. Owners and Admins can see the reason. Placing and lifting a hold are recorded in the audit trail.

When you lift a hold, scheduled deletion covers what it kept from the next run. A hold placed before a move to another plan stays until you lift it.

Export Your Data

You can export your data at any time, on any plan. That includes after you cancel: your organisation moves to the Free plan with its data kept.

• Reports and lists export from the console to CSV, Excel or PDF. Exports follow role-based masking, so personal data someone isn't allowed to see stays masked, and cover the visitor history your plan shows.
• A full organisation export contains every record Agoo keeps for your organisation, including records hidden by your plan's history. Owners and Admins request it on any plan, Free included, with Export everything in Console → Settings → Data & privacy. It's always available: before you ask for your organisation to be deleted, after you cancel, and for 30 days after the agreement ends.
• It's a ZIP file: one CSV file per kind of record (spreadsheets open them), the photos, signatures and documents still kept, and a guide to what's inside.
• It leaves out passwords, keys and other secrets, and full ID numbers, staff statutory numbers and pay account numbers, which never leave Agoo; their last four characters are included. Clock-in badges, PINs, NFC cards and API keys are listed (whose, what kind, when they were issued, used and revoked), never the code or key itself.
• It includes your pay codes, payroll layouts and every payroll file's details, people and lines, and lists the kept payroll files among the files.
• It leaves out people's unsaved drafts: they're each person's own unfinished work, not your organisation's records, and expire within 30 days.
• Agoo emails you when it's ready. The download is in the console, so you sign in to take it, and it's there for 7 days. One export is prepared at a time.
• Every export is recorded in the audit trail.
• For one person, use a data subject request to gather everything held about them.

Deleting Your Organisation

Cancelling your subscription doesn't delete your data. To delete the whole organisation, the Owner asks for it at the bottom of Console → Settings → Billing or in writing, for example by email to support@agoohq.com. We confirm the request with the Owner first.

• We complete the deletion within 30 days of the request.
• We keep only what the law requires us to keep, such as invoices and tax records, and a record that the deletion took place.
• Copies in encrypted backups expire within a further 30 days.

Request a full organisation export before you ask: it includes records hidden by your plan. Deletion can't be undone.

• Data protection: Act 843, roles and sub-processors.
• Data subject requests: Access and erasure requests.
• ID and document scan: How ID numbers are masked and images deleted.

Data Subject Requests

How visitors and staff ask to see, correct or delete their data, and how your Owners and Admins answer them in the Console.

Under the Data Protection Act, 2012 (Act 843), people can ask what personal data you hold about them, ask you to correct it or delete it, and object to how you use it. These are data subject requests. Your organisation, as controller, answers them. Agoo gives you a page where people ask, an inbox with a due date for each request, and the record that you answered. It's on every plan, Free included.

How Someone Makes a Request

A visitor, contractor or member of staff can ask in two ways:

1. Online, from Your data in the footer of every one of your visitor pages (https://{your address}/privacy). They choose See my data, Correct my data, Delete my data or Stop a use of my data, say how they know you, and give their name and email (their phone is optional). They confirm the email with a six-digit code we send it, and the request arrives in your inbox. They're emailed a reference and the date you'll answer by.
2. Through your organisation, by email, letter, phone or at the front desk, using the contact details in your privacy notice. Record these in the inbox with Record a request, so every request has a due date and a record.

Put the page's link in your privacy notice: Console → Settings → Data & privacy → Data requests shows it with a Copy link button. If someone asks Agoo about data your organisation holds (Agoo has its own request page, at agoohq.com/legal/privacy/request), we pass the request to you and help you answer.

When It's Due

Each request gets its due date when it arrives:

The inbox puts open requests first, soonest due, and marks the overdue ones.

Reminders

So nothing runs late:

• The bell in the Console counts the open requests that are overdue or due within seven days, and Data & privacy in the menu shows how many are open.
• Seven days before a request is due, whoever it's assigned to is emailed. When nobody has it, the Owners and Admins are.
• Once it's overdue, the Owners and Admins and whoever it's assigned to are emailed, once.

Each person chooses these emails in Account → Notifications, under Data requests: A data request arrived, A data request is due soon and A data request is overdue. Turning them off stops the email only; the bell still counts.

Answer a Request

1. 1

   Open Console → Settings → Data & privacy → Data requests

   Owners and Admins are emailed when a request arrives online. Owners, Admins and Auditors can read the inbox; Owners and Admins act on it. Assign a request to whoever will answer it.

2. 2

   Check who they are

   A code to their email proves the address, not the person. Before you share or change anything, check who they are with details you already hold: call back the number on their visits or staff record, reply from the contact details you already had, or see them in person. Ask for no more than you need. Record how you checked in Identity: a request can't be completed until you have.

3. 3

   Find their data

   The request links to their visits in Visitors → History (by their email or phone) and to the directory for a member of staff. People with the same name may be different people: match the email or phone.

4. 4

   Act on it

   • Access: in History, filter to their visits and choose Export, with their form answers and any signed copies, and send it to them.
   • Correction: change the details that are wrong where they're kept, then tell them what you changed.
   • Erasure: delete what you're no longer entitled to keep. Once you've checked who they are, the request's page shows Erase their records: the visitor records with the request's email or phone, exactly (names alone never match), with how many visits each has. Choose the ones that are theirs, choose Erase the chosen records and confirm. Owners and Admins erase. A visitor who's on site now, or whose records are under a legal hold, can't be erased until they leave or the hold is lifted. Each erasure is noted in the request's trail.
   • Members of staff who match are listed too, but aren't erased from here: you keep their records while they work for you, and their attendance, leave and payroll for as long as employment and tax law require. Once they've left, deactivate them in People, and your retention schedule deletes the rest.
   • Objection: stop the use they object to, unless you have a stronger reason to carry on, which you tell them.

   Use Email it to them to reply from the request: it goes from your organisation, with the reference, and is kept in the request's trail. Add a note keeps a note for your team.

5. 5

   Close the request

   Choose Completed with what you did, or Refused with why. They're emailed the outcome. Every step, note and reply is in the request's trail and in the audit trail.

What Erasure Does and Doesn't Remove

• Removed: their name, phone number, email, photos, ID details and form answers, and, from the documents they accepted or signed, the name they typed, their signature, and the IP address and browser they used.
• Kept as a record: the audit trail notes that an erasure took place and who carried it out, and each document they agreed to keeps the record that a version was agreed to, and when. Its copy then shows "The visitor (erased on request)" in place of their name and signature.
• Not removed while a legal hold applies (Enterprise). Records under a hold stay until it's lifted.

If you must keep some data by law, such as a signed contractor agreement or a watchlist entry after a serious incident, say what you're keeping and why in the outcome.

How Long Requests Are Kept

A request and its trail are kept for two years after it's closed, as your record that you answered, and then deleted. They're in your full organisation export.

For Developers

If you handle requests in your own systems, on Pro and Enterprise you can erase a visitor through the API with DELETE /visitors/{visitor_id}, which needs the visitors:delete scope, and listen for the visitor.erased webhook event to update other systems. See the developer platform and webhooks.

• Data protection: Act 843, roles and sub-processors.
• Retention and deletion: Automatic deletion and legal hold.
• Developers: The Agoo API and erasure endpoint.