IHR Limited Company Data Privacy & Data Retention Statement

1. Personal Data

IHR as an organisation recognises the importance of protecting the privacy and personal data of client organisations and individuals. This Data Privacy and Data Retention Statement explains how IHR collects, uses, stores, retains, discloses and protects confidential data in the course of providing services.

This Statement applies to personal data collected from job applicants, prospective candidates, client organisations, employees, associate consultants, business contacts and other individuals who interact with IHR, including individuals who submit their information through our Careers page, website, recruitment platforms, email, telephone or other communication channels.

For purposes of this Statement, personal data means information relating to an identified or identifiable individual and organisations. Depending on the nature of the engagement, this may include a person’s name, contact details, CV or résumé, educational and professional history, employment history, qualifications, skills, references, interview and assessment information, salary expectations, professional interests and other information reasonably required for recruitment or the provision of our services. Where relevant and required by law, IHR may also process information that constitutes special personal data under the Data Protection Act, 2012 (Act 843), such as information relating to health, medical or mental health conditions, religious beliefs, ethnic or tribal origin, political opinions, sexual orientation or criminal proceedings. Such information will only be collected or processed where there is a lawful and appropriate basis for doing so and where it is necessary for the relevant purpose. IHR will treat personal data confidentially and handle it in accordance with the Data Protection Act, 2012 (Act 843) and applicable requirements of the Data Protection Commission of Ghana (“DPC”).

2. Purpose for Collection and Processing

IHR collects and processes personal data only for specific, lawful and legitimate purposes connected with our business activities. In relation to applicants and candidates, these purposes may include:

• Receiving and reviewing applications for advertised vacancies.
• Assessing candidates against job requirements and selection criteria.
• Communicating with candidates regarding applications, interviews, assessments and recruitment outcomes.
• Conducting interviews, reference checks, background checks and other assessments where appropriate.
• Presenting candidate profiles to IHR’s clients for potential employment opportunities.
• Facilitating introductions, interviews, offers and successful placements.
• Maintaining candidate records for future opportunities where the candidate has agreed to such continued consideration.
• Responding to enquiries and providing recruitment and talent advisory services.
• Administering and improving our recruitment and talent services.
• Complying with contractual, legal, regulatory or professional obligations.
• Preventing, detecting and addressing fraud, misuse or other unlawful activity and
• Conducting legitimate research, reporting and statistical analysis, preferably using anonymised or aggregated information where individual identification is not required.

IHR will seek to ensure that personal data collected is relevant, necessary and not excessive in relation to the purpose for which it is being processed. This reflects the principles of minimality and purpose specification under Act 843.

3. How IHR Collects Personal Data

IHR will, wherever reasonably practicable, collect personal data directly from the individual to whom it relates.

This may occur when an individual:

• Applies through the IHR Careers page.
• Uploads a CV, résumé, cover letter or other supporting document.
• Completes an application or candidate information form.
• Communicates with an IHR consultant by email, telephone or other communication channel.
• Participates in an interview, assessment or recruitment process.
• Provides information for reference or background checks or
• Otherwise engages with IHR in connection with employment or talent opportunities.

IHR may also receive personal data from third parties where this is necessary and lawful for the relevant purpose. Such sources may include referees, previous employers, professional references, recruitment platforms, clients, professional networks, publicly available professional sources and other authorised parties. Where personal data is obtained from a third party, IHR will take appropriate steps to ensure that the processing is lawful and that the individual is provided with the information required under applicable data protection requirements.

Website Enquiries

The Contact page of IHR’s website has two forms: one to request a consultation and one to send a general message. They ask for a name, an email address and a message and, depending on the form, an organisation, the service of interest and an optional telephone number. IHR uses this information to respond to the enquiry and to follow it up.

Each enquiry is sent to IHR by email through an email delivery service provider. The website itself does not keep a copy. Enquiries received by email are retained in accordance with Section 7.

4. Disclosure of Personal Data

IHR will only disclose personal data where there is a lawful and legitimate basis for doing so and where the disclosure is relevant to the purpose for which the information was collected. For recruitment purposes, this may include sharing relevant candidate information with IHR clients, prospective employers, referees, assessment providers, background-check providers, professional advisers, technology or service providers and other parties involved in delivering the relevant service.

For example, where an applicant applies for a position being managed by IHR, relevant information contained in the applicant’s CV and application may be shared with the prospective employer for the purpose of evaluating the applicant for that position. IHR will take reasonable steps to ensure that third parties receiving personal data use it only for the authorised purpose and maintain appropriate confidentiality and security safeguards.

Where IHR engages third-party service providers to process personal data on its behalf, IHR will take appropriate measures to ensure that such processors act within the authority provided to them and maintain appropriate confidentiality and security measures, consistent with Sections 29 and 30 of Act 843.

Where personal data is required to be disclosed to a public authority, regulator, court or other authorised body, IHR may disclose the information where required or permitted by law.

5. Withdrawal of Consent

Where IHR relies on consent as the lawful basis for a particular processing activity, the individual may withdraw that consent by contacting IHR using the contact details provided on the website. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

Please note that withdrawal of consent may not always result in the immediate deletion of personal data where IHR has another lawful basis or legal obligation permitting or requiring it to retain or process the information. For example, information may need to be retained where necessary for the establishment, exercise or defence of legal claims, compliance with a legal obligation, fulfilment of a contractual requirement or another lawful purpose recognised under Act 843.

Requests to withdraw consent, or to have personal data deleted, are handled by Rosemary Amarh-Kwantreng. Please send them to ask@ihrgh.com.

6. Ensuring Personal Data is Current and Accurate

IHR seeks to ensure that personal data in its possession is accurate, complete, relevant and up to date for the purpose for which it is being processed. Candidates and other data subjects are encouraged to notify IHR where information previously provided has changed or is inaccurate. Where appropriate, IHR may contact candidates to verify or update information, particularly where the information is being considered for a current or future opportunity.

7. Data Retention

IHR will retain personal data only for as long as is reasonably necessary to fulfil the purpose for which it was collected and processed, unless a longer retention period is required or permitted by law, necessary for a lawful business purpose, required by contract, or otherwise authorised with the individual’s consent. This approach is consistent with Section 24 of the Data Protection Act, 2012 (Act 843), which provides that personal data should not be retained longer than necessary to achieve the purpose for which it was collected and processed, subject to specified exceptions.

Recruitment and Candidate Data

For applicants who apply for a specific vacancy, IHR will generally retain application and recruitment records for the period reasonably necessary to:

• Complete the recruitment and selection process;
• Communicate the outcome to applicants;
• Administer the placement where a candidate is successful;
• Address reasonable queries or complaints relating to the recruitment process;
• Comply with applicable legal, contractual or regulatory obligations; and
• Establish, exercise or defend legitimate legal claims where necessary.

Where IHR wishes to retain an unsuccessful applicant’s information for consideration for future vacancies or talent opportunities, IHR will provide appropriate notice and, where consent is the applicable basis for such continued retention, obtain the individual’s consent.

IHR will retain application records and CVs for as long as reasonably necessary for the purpose for which they were collected, taking into account the recruitment process, applicable legal/regulatory requirements and legitimate business needs.

For candidates who opt in to be considered for future opportunities, IHR may retain their information for as long as it remains relevant to this purpose, subject to periodic review. Information that is no longer required will be securely deleted, destroyed or anonymised.

Rosemary Amarh-Kwantreng is responsible for data protection at IHR, including reviewing records and their secure disposal when they are no longer required. She can be contacted at rosemary@ihrgh.com.

9. Access to Personal Data

Individuals have rights under the Data Protection Act, 2012 (Act 843) in relation to personal data held about them by IHR. Subject to applicable legal limitations, a data subject may request:

• Confirmation as to whether IHR holds personal data relating to them.
• Information about the personal data held.
• Information about the purposes for which it is being processed.
• Information concerning relevant recipients or categories of recipients.
• Correction of inaccurate or incomplete information and
• Deletion or destruction of personal data that IHR is no longer authorised to retain.

IHR may require reasonable information to verify the identity of the person making a request before providing access to personal data. The rights of access and correction are expressly provided for under Sections 32 and 33 of Act 843.

10. Security of Personal Data

IHR takes reasonable and appropriate technical, organisational and administrative measures to protect personal data against:

• Unauthorised access.
• Unlawful processing.
• Accidental or unlawful destruction.
• Loss.
• Alteration.
• Misuse and
• Unauthorised disclosure.

Access to candidate and client information will be restricted to persons who require access for legitimate business purposes. IHR will also take reasonable steps to ensure that its systems, devices, records, applications and third-party service providers are appropriately secured. These measures may include access controls, password protection, restricted permissions, secure storage, confidentiality obligations, system safeguards, physical security and appropriate data disposal procedures.

IHR will periodically review its security measures to address reasonably foreseeable risks and changes in technology or business operations, consistent with Section 28 of Act 843. Where IHR becomes aware of a personal data security incident or breach, it will take appropriate steps to contain, investigate and address the incident and make any notifications required under applicable law.

11. Data Transfers and Third-Party Processing

IHR may use third-party technology providers and service providers in connection with its recruitment and advisory operations. This may include recruitment platforms, applicant tracking systems, cloud storage providers, assessment platforms, communication systems and other technology providers.

Where such providers process personal data on IHR’s behalf, IHR will take reasonable steps to ensure that appropriate contractual, technical and organisational safeguards are in place. Where personal data is transferred outside Ghana or made accessible to recipients located outside Ghana, IHR will take appropriate steps to ensure that the transfer and subsequent processing are undertaken in accordance with applicable data protection requirements.

12. Resolving Privacy Concerns

IHR is committed to handling personal data responsibly and transparently. If an individual believes that IHR has collected, used, disclosed, retained or otherwise processed their personal data in a manner inconsistent with this Statement or applicable law, they may contact IHR using the contact details provided below.

IHR will review and respond to privacy concerns within a reasonable period and take appropriate steps to address any substantiated concerns.

13. Changes to this Statement

IHR may update this Data Privacy and Data Retention Statement from time to time to reflect changes in its business activities, technology, data processing practices or applicable legal and regulatory requirements. Where material changes are made, IHR will take reasonable steps to make the updated Statement available to individuals through its website or other appropriate communication channels. The effective date of the most recent version will be indicated on the Statement.

Contact

Email ask@ihrgh.com
Call 057 000 2616

Withdrawal of consent and deletion requests: Rosemary Amarh-Kwantreng, ask@ihrgh.com
Data protection: Rosemary Amarh-Kwantreng, rosemary@ihrgh.com

Office: HNo. 359/1 Nii Nortey Omaboe St., Osu, Accra, Ghana
Post: PO Box CO.406, Tema, Ghana