🔐 Privacy Policy
Ghana Traffic Offence Management System

1. Data Controller & Contact

The data controller responsible for your personal data is:

Any questions about this Privacy Policy or your data subject rights should be directed to the Data Protection Officer (DPO) using the contact details above.

2. Information We Collect

To issue, manage, and resolve traffic offences efficiently, GH-TOMS collects the following categories of personal and vehicle-related data:

We do not knowingly collect sensitive personal data (e.g., biometric, health, political opinions) unless strictly required for legal proceedings, and we will obtain explicit consent where necessary.

3. How We Use Your Personal Data

GH-TOMS processes your data exclusively for legitimate traffic management and law enforcement purposes, including:

• Fine issuance and administration: Recording, storing, and tracking traffic offences and associated fines.
• Payment processing & reconciliation: Verifying payments, issuing digital receipts, and calculating late payment interest.
• Appeals adjudication: Reviewing appeals, corresponding with appellants, and maintaining audit trails.
• Law enforcement and judicial cooperation: Sharing data with the Ghana Police Service, DVLA, and courts when required by law or for enforcement of penalties.
• System improvement & analytics: Aggregated anonymized data to improve enforcement patterns and user experience (no individual identification).
• Security & fraud prevention: Detecting unauthorized access, duplicate payments, or misuse of the System.
• Legal compliance: Fulfilling obligations under the Data Protection Act, Road Traffic Act, and other statutory mandates.

4. Legal Basis for Processing

Under the Data Protection Act, 2012 (Act 843), we process your data based on one or more of the following grounds:

• Public duty / statutory function: Processing is necessary for the performance of a task carried out in the public interest (traffic law enforcement).
• Legal obligation: Compliance with Ghanaian laws such as the Road Traffic Act and court orders.
• Contractual necessity: Where you enter into a payment transaction or appeal submission.
• Legitimate interests: To maintain system security, prevent fraud, and improve service delivery, provided your fundamental rights are not overridden.
• Consent: For optional features such as voluntary appeal evidence or future contact regarding service updates (you may withdraw consent at any time).

5. Data Sharing and Recipients

We only share your personal data with authorized recipients under strict confidentiality and lawful purpose. These include:

• Government Agencies: Driver and Vehicle Licensing Authority (DVLA), Ghana Police Service (Motor Traffic and Transport Department), Courts of Judicature.
• Payment Service Providers: Licensed banks, mobile money operators, and payment gateways (e.g., Ghana Interbank Payment and Settlement Systems – GhIPSS). They process data only for transaction execution and are bound by data protection agreements.
• IT and cloud hosting partners: Secure infrastructure providers (only within jurisdictions with adequate data protection levels or binding contractual clauses).
• Legal and audit authorities: When required by law, subpoena, or government audit.

We do not authorise third parties to use your data for their own purposes. Any onward transfer is governed by data processing agreements that comply with Act 843.

6. International Data Transfers

GH-TOMS primarily stores and processes data within Ghana’s national data centres. However, certain technical operations (e.g., cloud-based security monitoring) may involve transfer to countries with data protection laws equivalent to Ghana’s standards. Where such transfers occur, we ensure appropriate safeguards, such as standard contractual clauses approved by the Data Protection Commission, to secure your information.

7. Data Retention and Deletion

We retain your personal data only as long as necessary to fulfil the purposes outlined in this Policy and to comply with legal obligations. The retention periods are:

• Fine records and payment history: Seven (7) years from the date of final resolution (payment, appeal dismissal, or court judgement), in line with financial and legal record-keeping requirements.
• Appeal documentation: Five (5) years after final decision, to allow for audit or review.
• Vehicle/driver identification data (in absence of active fine): Up to three (3) years from last interaction, unless required for ongoing enforcement.
• Technical logs (IP addresses, access logs): 12 months, after which they are anonymized or deleted.

After retention expiry, your data will be securely deleted or anonymised so that it can no longer be associated with you.

8. Your Rights Under Ghana's Data Protection Act

You have the following rights regarding your personal data, which you may exercise free of charge:

• Right of Access: Obtain confirmation whether your data is processed and request a copy (subject to reasonable limitations for law enforcement).
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data where it is no longer necessary for legal or statutory purposes (exceptions apply, e.g., ongoing fine or court order).
• Right to Restriction of Processing: Limit processing while we verify the accuracy of your data or the lawfulness of processing.
• Right to Object: Object to processing based on legitimate interests, unless we demonstrate compelling grounds.
• Right to Data Portability: Receive your data in a structured, commonly used format (where processing is based on consent or contract).
• Right to Lodge a Complaint: File a complaint with the Data Protection Commission of Ghana if you believe your rights are violated.

To exercise any right, submit a written request to our DPO at dpo@ghtoms.gov.gh. We will respond within 30 days. Identity verification may be required.

9. Security of Your Information

GH-TOMS implements industry-standard security measures, including:

• Encryption: Data in transit (TLS 1.3) and at rest (AES-256).
• Access controls: Role-based authentication, multi-factor authentication for authorized personnel, and strict logging of all data access.
• Regular audits & penetration testing: Conducted by independent cybersecurity firms approved by the National Cyber Security Authority.
• Incident response protocol: Immediate containment and notification to affected users and the Data Protection Commission in case of a breach (within 72 hours).

While we strive for maximum security, no electronic transmission is entirely risk-free. You are responsible for maintaining confidentiality of your login credentials and payment methods.

10. Cookies and Similar Technologies

The GH-TOMS web portal uses essential cookies for authentication, session management, and security purposes. We do not use marketing or advertising cookies. You may configure your browser to reject cookies, but some System features (e.g., payment, appeals) may not function properly. Detailed cookie information is available in our Cookie Notice (accessible from the website footer).

11. Data of Minors

GH-TOMS does not knowingly collect data from individuals under the age of 18, except where a minor is involved in a traffic offence under applicable juvenile procedures. In such cases, the data is processed with heightened safeguards and only shared with legal guardians and authorised juvenile authorities. If we become aware of unauthorised collection, we will delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or system functionality. The "Effective Date" at the top of the page indicates when the latest version was published. Material changes will be notified via the System dashboard, email (if registered), or SMS. Your continued use of GH-TOMS after the effective date constitutes acceptance of the revised Policy.

13. Right to Complain to the Data Protection Commission

If you believe we have infringed your data protection rights, you have the right to lodge a complaint with the supervisory authority in Ghana:

We encourage you to first contact our DPO to resolve any issue before escalating to the DPC.