At CediDrop, safeguarding your personal data is a core priority
Last Updated: June 17, 2026
OSASCO TECHNOLOGY LTD ("we", "us", or "our") is the operator of the CediDrop mobile application, available to users in Ghana. We respect your privacy and are dedicated to keeping your personal data confidential and secure. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and when it may be disclosed while you access our lending services through CediDrop.
We follow a data-minimisation approach and only gather information that is reasonably required to deliver, operate, and improve our services. Personal data is encrypted in transit and protected at rest using recognised industry security standards. We do not sell, rent, or trade your personal information to third parties for marketing or other commercial gain.
By downloading, registering for, or continuing to use CediDrop, you confirm that you have read and understood this Privacy Policy and agree to its terms. If you do not accept this policy, please discontinue use of the application and related services.
Depending on how you use CediDrop and the permissions you grant on your device, we may collect the categories of information described below. These disclosures are consistent with the permission explanations shown within the CediDrop application. All information is encrypted and securely transmitted to our servers over protected channels, then stored on secured infrastructure.
During registration and loan application, you may provide the following details for identity checks, credit review, approval decisions, and account administration:
Each item above is processed only for the purposes stated, transferred through encrypted channels, and safeguarded using appropriate technical and organisational controls.
We process your personal information solely for defined and legitimate purposes related to the operation of CediDrop and the delivery of our lending services in Ghana. Our use of your data is guided by the principles of purpose limitation and data minimisation, and is carried out in accordance with applicable privacy and data-protection requirements, including the Data Protection Act, 2012 (Act 843).
We use your information to create and maintain your CediDrop account, authenticate your identity during login, manage your profile settings, and process loan applications from submission through approval, disbursement, and ongoing account servicing.
We process identity documents, facial images, and related verification data to confirm that you are who you claim to be, satisfy Know Your Customer (KYC) obligations, and comply with anti-money laundering and fraud-prevention requirements applicable to financial services in Ghana.
We analyse information you provide together with relevant device, application, and financial signals — including permitted SMS data — to evaluate your credit profile, repayment capacity, and overall lending risk, and to determine whether you qualify for a loan and under what terms.
We use personal and technical data to detect suspicious activity, prevent duplicate or fraudulent applications, identify anomalous device or location patterns, and protect both individual users and the integrity of the CediDrop platform from misuse or unauthorised access.
We process your bank or mobile-wallet account details and transaction-related information to transfer approved loan amounts to your nominated account, track repayment schedules, send payment reminders, and manage collections in accordance with your loan agreement.
We use your contact information and account records to respond to enquiries, resolve complaints, provide technical assistance, and send service-related notifications that are necessary for the proper functioning of your account and our lending services.
We may analyse aggregated usage patterns and performance data to troubleshoot technical issues, improve app stability, refine user experience, and enhance the quality and reliability of CediDrop's features and lending processes.
We process and retain certain information as necessary to comply with obligations under Ghanaian law, respond to lawful requests from regulators and government authorities, enforce our terms of service, and defend our legal rights in connection with disputes or investigations.
Automated Decision-Making
Certain aspects of the loan review process may involve automated systems, including credit-scoring models and risk algorithms. These systems may be used to:
Assess your financial profile and determine whether you meet the eligibility criteria for a loan based on the information and signals available at the time of application.
Calculate appropriate loan amounts, interest rates, fees, and repayment schedules based on your assessed risk profile and our internal lending policies.
Identify applications that exhibit patterns consistent with potential fraud, identity misuse, or other high-risk behaviour, triggering further review or rejection where warranted.
Automated processing enables us to evaluate applications efficiently and consistently. If you disagree with an outcome produced by automated means, you may contact us using the details in Section 9 — Contact and Data Requests to request a manual review where applicable under Ghanaian law.
Limited Collection Principle: We collect and use only the personal data that is relevant, necessary, and proportionate to the services we provide. We also take reasonable steps to ensure that the information we hold remains accurate and up to date throughout the processing lifecycle.
OSASCO TECHNOLOGY LTD does not sell, rent, or commercially trade your personal information. We only share data in narrow circumstances where disclosure is necessary and permitted.
We may disclose information when required by applicable laws in Ghana, valid court orders, regulatory instructions, or lawful requests from authorised government or law-enforcement bodies.
We may share limited information where reasonably needed to investigate fraud, enforce our terms, protect CediDrop users, or defend our legal rights and platform security.
Except for the situations above, we do not disclose your personal information to unrelated third parties for independent commercial use.
Protecting your personal information is fundamental to how we operate CediDrop. We maintain a layered security framework that combines administrative policies, technical controls, and operational procedures designed to reduce the risk of unauthorised access, accidental loss, misuse, disclosure, or alteration of your data throughout its lifecycle.
Whenever personal information travels between your device and our servers — whether during registration, loan applications, identity verification, or account management — it is protected using industry-standard TLS encryption. This helps guard against interception, eavesdropping, and tampering while data is in transit across networks.
Personal data is hosted on controlled, access-restricted infrastructure and protected with AES-256 encryption where appropriate. By encrypting stored information, we aim to ensure that even in the unlikely event of unauthorised system access, the data remains difficult to read or exploit without proper decryption keys.
Access to personal information is limited to authorised employees, contractors, and partners who require such access to perform their duties. We apply role-based access principles, maintain activity logs, and review access patterns to detect and respond to inappropriate or unauthorised use of customer data.
We employ secure authentication and session management mechanisms to help verify user identity and protect accounts from unauthorised login attempts. These measures are designed to reduce the risk of account takeover and to ensure that sensitive actions within CediDrop are performed by the legitimate account holder.
Our security posture is maintained through ongoing monitoring, periodic risk assessments, penetration testing, and vulnerability scanning. When potential weaknesses are identified, we take reasonable steps to investigate, remediate, and strengthen our systems in a timely manner.
We retain personal information only for as long as it remains necessary to fulfil the purposes for which it was collected, including providing lending services, meeting regulatory obligations, resolving disputes, and enforcing our agreements. Retention periods may vary depending on the type of data and the reason it was processed, unless a longer period is required or permitted under applicable law in Ghana.
For as long as you maintain an active CediDrop account or continue to use our services, we retain the personal information needed to manage your profile, process loan applications, facilitate disbursements and repayments, communicate with you, and maintain the security and integrity of our platform. You may request account closure at any time, subject to applicable legal and contractual requirements.
Once your account is closed, we generally initiate deletion or anonymisation of personal data within 30 days, unless we are legally required or reasonably permitted to retain certain records for longer. Examples of extended retention may include information needed for tax reporting, financial audits, fraud investigations, dispute resolution, or compliance with regulatory obligations.
In some circumstances, we must keep specific categories of data for extended periods to comply with Ghanaian laws, directives from regulatory authorities, valid court orders, or formal requests from government agencies. When such retention applies, we limit the data to what is strictly necessary and protect it with appropriate security measures for the duration of the legal requirement.
We conduct periodic reviews of the information we store to determine whether it remains relevant, accurate, and necessary for our business operations and legal obligations. Data that is no longer required is securely deleted or anonymised using methods designed to make recovery impractical, while ensuring that essential records are preserved where retention is mandated by law.
As a user of CediDrop in Ghana, you are entitled to certain rights over your personal information under applicable data protection legislation, including the Data Protection Act, 2012 (Act 843). These rights are designed to give you greater transparency and control over how your data is collected, used, and managed. The following outlines the principal rights that may apply to you:
You have the right to request confirmation of whether we process your personal information and, where we do, to obtain meaningful details about the categories of data held, the purposes of processing, the recipients or categories of recipients, and the retention period, subject to applicable legal limitations and identity verification requirements.
If you believe that any personal information we hold about you is inaccurate, incomplete, or no longer up to date, you may request that we correct or supplement the relevant records. We will review your request and take reasonable steps to update the information where appropriate and permitted by law.
In certain circumstances, you may request the deletion of your personal information — for example, where the data is no longer necessary for the purposes for which it was collected, where you withdraw consent and no other legal basis applies, or where the processing is found to be unlawful. Deletion requests may be subject to exceptions where retention is required by law or for legitimate business purposes such as fraud prevention. Registered CediDrop users may also submit an account closure request after identity verification.
Where processing is based on legitimate interests or certain other legal grounds, you may have the right to object to specific processing activities based on your particular situation. We will assess such objections in accordance with applicable law and inform you of the outcome, including whether we are required or permitted to continue processing your data.
Please be aware that withdrawing certain app permissions or restricting the provision of particular data may affect your ability to use some CediDrop features, including identity verification, credit assessment, loan application submission, and approval workflows. This is because such features depend on the information and permissions necessary to operate safely and in compliance with regulatory requirements.
To exercise any of the rights described above, please submit a written request to us using the contact details provided in Section 9 — Contact and Data Requests. We may need to verify your identity before processing your request. We aim to respond within the timeframes prescribed by applicable law. If you are dissatisfied with our response, you have the right to lodge a complaint with the Data Protection Commission of Ghana or seek other remedies available under Ghanaian law.
We maintain a current version of this Privacy Policy so you can understand how CediDrop handles your information before and during use of our services.
You may view this policy at any time through the following channels:
From time to time, we may update this policy to reflect changes in our services, technology, or legal obligations in Ghana. When updates are made, we will publish the revised version online and update the "Last Updated" date shown at the beginning of this policy. Where appropriate, we may also notify you through in-app messages or other reasonable communication methods.
If you continue using CediDrop after an updated policy takes effect, your continued use will be treated as acceptance of the revised terms. We recommend checking this page occasionally to stay informed.
CediDrop provides financial services intended only for individuals who are at least 18 years old. Our products, loan applications, and account features are not designed for children or teenagers.
We do not knowingly request, collect, or process personal data from persons under 18 years of age. If you are a parent or guardian and believe a minor has submitted information through CediDrop, please contact us immediately. Upon verification, we will take appropriate steps to remove the relevant data from our records, subject to any legal retention requirements.
If you have questions about this Privacy Policy, wish to exercise your data protection rights, or need help with a privacy-related matter, you may contact OSASCO TECHNOLOGY LTD using the details below.
When contacting us, please include sufficient information to verify your identity and describe your request clearly. We aim to respond within a reasonable timeframe in accordance with applicable law.