Effective date: 08 August 2026 · Governed by the Ghana Data Protection Act, 2012 (Act 843)
1 About This Policy
Paywell is a cloud-based payroll management platform. This Privacy Policy describes how we collect,
process, store, and protect personal and payroll data when Paywell is used by an organisation
to manage employee compensation, statutory deductions, and payroll compliance in Ghana.
As a data processor acting on behalf of subscribing organisations (the data controllers),
and as a data controller for our own operational data, we comply fully with the
Ghana Data Protection Act, 2012 (Act 843).
2 Data We Process
GM Pay processes the following categories of personal and payroll data:
Category
Data Points
Employee Identity
Full name, staff number, department, project site, employment date
HR/Finance user name, email, role, login timestamps, IP address, audit trail entries
Payroll data is classified as sensitive personal data under Act 843. It is processed only to the extent
necessary to fulfil payroll, statutory, and reporting obligations.
3 Purposes of Processing
Computing monthly payroll, including gross pay, statutory deductions (SSNIT, PAYE), and net pay
Generating employee payslips and distributing them via email or SMS notification
Producing statutory filing schedules for the Ghana Revenue Authority (GRA) — PAYE returns
Producing SSNIT Tier 1 and Tier 2 remittance schedules
Generating bank payment schedules for transfer to financial institutions
Maintaining an approval workflow (HR → Finance → Operations) for payroll authorisation
Generating payroll journals for integration with accounting systems
Maintaining an audit trail of all payroll approvals, rejections, and changes
Sending salary notification SMS to employees upon payroll approval
4 Legal Basis for Processing
Contractual necessity — processing is required to calculate and pay employee compensation under the contract of employment
Legal obligation — PAYE deduction and remittance to GRA is required under the Income Tax Act, 2015 (Act 896); SSNIT contributions are required under the National Pensions Act, 2008 (Act 766)
Legitimate interest — maintaining payroll records, audit trails, and payslip archives for operational continuity and dispute resolution
5 Who We Share Data With
Ghana Revenue Authority (GRA) — PAYE schedules generated by the platform are submitted by the employer for statutory tax filing
SSNIT and Tier 2 trustees — remittance schedules are produced for submission by the employer
Banks — bank payment schedule files are generated for upload by the employer; Paywell does not transmit directly to banks
SMS provider — employee phone numbers and salary notification messages are passed to our messaging provider solely to deliver payslip notifications
Authorised HR and Finance personnel — access is role-restricted within the subscribing organisation
Paywell does not sell, license, or otherwise disclose employee payroll data to any third party for commercial purposes.
6 Data Retention
Payroll run data and payslips are retained for a minimum of 7 years in line with Ghana's statutory payroll record-keeping requirements
Employee records are retained for the duration of employment plus 7 years after termination
System audit logs are retained for 3 years
SMS notification logs are retained for 12 months
On written request from the data controller (the employing organisation), data may be exported and deleted subject to statutory retention obligations
7 Data Security
We implement the following controls to protect payroll data:
HTTPS encryption for all data in transit
Role-based access controls — HR, Finance, and Operations roles have distinct, limited permissions
Full audit trail logging of every approval, rejection, lock, and data change
Payroll runs are locked after approval to prevent retrospective modification
Passwords stored using one-way hashing (bcrypt); no plain-text credentials stored
Regular backups managed by the hosting provider
8 Employee Rights
As a data subject, you have the following rights under the Ghana Data Protection Act, 2012 (Act 843):
Right of access — request a copy of your payroll and personal data held on the system
Right to correction — request correction of inaccurate salary, deduction, or personal details
Right to object — object to processing not required by law or contract
Right to deletion — request deletion of data no longer required, subject to statutory retention obligations
Right to complain — lodge a complaint with the Data Protection Commission of Ghana
To exercise your rights, contact your employer's HR department, who acts as the data controller for your payroll records.
9 Cookies and Session Data
Paywell uses session cookies strictly necessary for user authentication and CSRF protection.
No third-party tracking cookies, advertising cookies, or analytics scripts are used on this platform.
10 Changes to This Policy
We may revise this Privacy Policy periodically to reflect changes in the platform or applicable law.
The effective date at the top of this page indicates the date of the most recent update.
Organisations using Paywell will be notified of material changes.
11 Contact
For privacy enquiries, data subject access requests, or to report a data concern: