1. Overview and commitment to privacy
AxisFlow Solutions ("AxisFlow", "we", "us", or "our"), registered in Ghana (Registration Number: BN708350626, TIN: P002462294X), with principal operations at Otumfuo Osei Tutu II Blvd, Ayigya, Kumasi, Ashanti Region, Ghana, is dedicated to upholding the highest standards of data security and confidentiality for all organizations and individuals interacting with the NexusOne enterprise platform ("NexusOne", "Service").
This Privacy Policy outlines our procedures concerning the collection, storage, processing, and protection of personal data. NexusOne's security, privacy, and encryption controls are strictly built and operated in full accordance and alignment with the principles of the Data Protection Act 2012 (Act 843) of the Republic of Ghana, the African Union Convention on Cyber Security and Personal Data Protection, and international data protection standards.
2. Information we collect and process
Depending on how your organization configures and interacts with NexusOne, we process the following categories of information:
- Account and administrative credentials: Names, business email addresses, telephone numbers, encrypted passwords, session cookies, and multi-factor authentication metadata.
- Organization operational records: Company profile, corporate registration numbers, tax identification numbers (TIN), branch physical locations, and currency preferences.
- Workforce and employee records (Data Controller data): Staff names, dates of birth, identification numbers (Ghana Card), bank account disbursement details, SSNIT numbers, leave logs, and payroll deductions.
- Commercial transaction records: General ledger entries, sales receipts, customer invoices, purchase orders, inventory counts, and digital vault uploads.
- Telemetry and audit trail data: Timestamped IP addresses, browser user-agents, authentication event logs, and API request latency metrics.
3. Multi-tenant row isolation and architectural data separation
In addition to relational isolation, digital files stored in our Electronic Document Management System (EDMS) vault are encrypted at rest using AES-256 with tenant-specific encryption keys. All communication between client browsers and NexusOne servers is secured with TLS 1.3 encryption.
4. Payment information and Paystack PCI-DSS compliance
When you subscribe to NexusOne or settle invoices via Debit Card, Credit Card, or Mobile Money:
- Your financial credentials are submitted directly to Paystack's encrypted vault via secure modal frames.
- NexusOne servers never receive, log, or maintain full credit/debit card numbers, PINs, or CVV security codes.
- Paystack returns a secure cryptographic payment token and transaction reference that NexusOne records for recurring billing and financial audit trails.
5. Lawful basis for data processing
In accordance with Section 18 of the Data Protection Act 2012 (Act 843), AxisFlow Solutions processes personal data solely on legitimate grounds:
- Contractual performance: Processing essential to provisioning your workspace, executing accounting calculations, running payroll, and fulfilling subscription orders.
- Legal and statutory compliance: Complying with mandatory reporting requirements under Ghanaian tax law (GRA PAYE), pension regulations (SSNIT Tier 1 & Tier 2), and anti-money laundering mandates.
- Legitimate business interests: Maintaining platform stability, blocking unauthorized intrusions, preventing fraud, and optimizing user workflows.
- Consent: Explicit user opt-in for newsletters, product announcements, and non-essential analytical cookies.
6. Data subject rights under Ghana Act 843
As a data subject or authorized organizational representative under the Data Protection Act 2012 (Act 843), you are entitled to exercise the following rights:
| Right | Statutory basis | Application within NexusOne |
|---|---|---|
| Right to Access | Act 843, Section 32 | Request a complete export of personal data held within your tenant workspace. |
| Right to Rectification | Act 843, Section 33 | Directly correct or update inaccurate employee, customer, or profile records. |
| Right to Object | Act 843, Section 35 | Object to processing for marketing or non-statutory automated profiling. |
| Right to Erasure | Act 843, Section 33 | Request deletion of personal data upon contract termination, subject to GRA statutory audit retention. |
7. Cookies and tracking technologies
NexusOne employs strictly necessary and functional cookies essential for platform security and navigation:
- Session authentication cookies: Secure HTTP-only cookies verifying your logged-in administrator or employee session.
- Tenant contextual state: Retaining your selected branch, active ledger fiscal year, and interface theme.
- Security & CSRF protection: Cryptographic tokens preventing cross-site request forgery attacks.
We do not utilize invasive third-party cross-site advertising cookies or behavioral tracking networks.
8. Data retention and account termination
Customer data is maintained for the active duration of your paid subscription. Upon subscription termination or cancellation, your tenant data is archived for thirty (30) calendar days to permit voluntary data export or renewal.
Following thirty (30) days, tenant databases and digital vaults are irreversibly purged from active storage clusters, except where retention of specific transactional logs is required to satisfy statutory tax obligations under the Ghana Revenue Authority (GRA) six-year ledger record rule.
9. Contact and privacy inquiries
If you have questions regarding this Privacy Policy, wish to exercise statutory data rights under Act 843, or seek to report a privacy or security inquiry, please contact our team: