RooMates is the data controller responsible for your personal information and processes it under the Data Protection Act, 2012 (Act 843) and the right to privacy guaranteed by Article 18(2) of the 1992 Constitution of Ghana. This policy explains what we collect, the legal basis and reasons we collect it, who we share it with, how long we keep it, and the rights you have, following the Act's eight data-protection principles.
01About this policy
- Who we are
- RooMates is the data controller responsible for the personal data described here. You can reach our privacy team using the contact details at the end of this policy.
- The law we follow
- We comply with the Data Protection Act, 2012 (Act 843) and the right to privacy under Article 18(2) of the 1992 Constitution of Ghana, and give effect to the Act's eight principles: accountability, lawfulness, purpose specification, compatible use, data quality, openness, security, and your participation.
- Our legal basis
- We process your personal data where it is necessary to provide a service you ask for (such as a booking), where you have consented, where we must meet a legal obligation, or for our legitimate interest in running and securing the platform, always balanced against your privacy.
02Information we collect
- Personal identification
- Name, email address, phone number, and student ID when you register or book a hostel through RooMates.
- Academic information
- University name and student status used solely to match you with eligible hostels near your campus.
- Booking & payment information
- The hostel and room you book, and the payment reference and status returned by the gateway. RooMates never stores your card or mobile-money credentials.
- Usage data
- Pages visited, search queries, device type, and IP address collected automatically to run, secure, and improve the platform.
- Communications
- Messages, booking requests, and complaints you submit through our platform, kept for service continuity and dispute resolution.
03How we use your information
- Service delivery
- To match you with suitable hostels, process bookings, and manage your reservation through our platform.
- Identity verification
- To confirm your student status and eligibility where a hostel requires it.
- Communication
- To send you transactional updates about your booking, payment status, and complaints. These are not marketing (see 'Marketing' below).
- Platform improvement
- We use aggregated and de-identified usage data, which does not identify you, to improve the RooMates experience, including search and recommendations.
04Data sharing
- Hostel owners
- Relevant booking details are shared with the hostel you book, and only after your booking is confirmed, so the hostel can host you.
- Payment gateways
- Payment is processed by the gateway your hostel uses (Hubtel or Paystack). We share only what is needed to take payment; RooMates never stores card or mobile-money credentials.
- Service providers
- We use trusted providers to run the platform: hosting, storage, email and SMS delivery, analytics, and error monitoring. Our current sub-processor list is available on request from our privacy team.
- International transfers
- Some of those providers process data outside Ghana. Where they do, we take steps consistent with Act 843 to ensure your data remains protected to a comparable standard.
- Legal obligations
- We disclose data to authorities only when required by Ghanaian law or a valid court order.
- No sale of your data
- We will never sell your personal data. Selling personal data is also an offence under Act 843.
05Data security & retention
- Encryption
- All data in transit is protected using TLS. Sensitive records at rest are encrypted using industry-standard protocols.
- Access control
- Only authorised RooMates staff with a legitimate need can access your personal information.
- Retention
- We keep your data for as long as your account is active and for a limited period after closure to meet legal, tax, and dispute-resolution requirements, after which it is deleted or anonymised.
- Breach notification
- If a personal-data breach occurs, we will notify the Data Protection Commission and affected users as soon as reasonably practicable, as Act 843 requires, and take steps to restore the security of the affected systems.
06Marketing
- Consent first
- We only send you marketing messages with your prior consent, as Act 843 requires, and you can withdraw that consent at any time.
- Transactional messages
- Messages about your own booking (confirmations, receipts, reminders) are not marketing and are part of the service you asked for.
07Your rights
- Access
- Request a copy of the personal data we hold about you.
- Correction
- Ask us to correct inaccurate or incomplete information.
- Object & restrict
- Ask us to stop or limit certain processing of your data, and withdraw any consent you have given.
- Deletion
- Request deletion of your data, subject to retention we are legally required to keep.
- Portability
- Receive your data in a structured, machine-readable format to move to another service.
- Complain to the regulator
- If you are unhappy with how we handle your data, you can complain to Ghana's Data Protection Commission (dataprotection.org.gh).
We also use cookies and similar tracking technologies. See our Cookie Policy for the full list and how to manage them.