1. Introduction
Cauta Solutions Group Limited ("we", "us", or "our"), a company incorporated in Ghana with its registered office in Accra, Ghana, operates the CautaManage serviced-apartment management platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, website, and mobile applications.
This Privacy Policy is drafted in accordance with the Data Protection Act, 2012 (Act 843) of the Republic of Ghana and is subject to the oversight of the Ghana Data Protection Commission (DPC). It also reflects the obligations of accommodation operators under the Immigration Act, 2000 (Act 573) and the operational guidance of the Ghana Immigration Service (GIS) regarding the maintenance and disclosure of foreign-guest registers.
By accessing or using CautaManage, you agree to this Privacy Policy. If you do not agree, please discontinue use of our services.
1.1 Data Controller and Processor
The serviced-apartment facility (the property operator) that subscribes to CautaManage is the data controller — it determines the purposes and means of processing personal data of its guests, staff, and investor-owners. Cauta Solutions Group Limited acts as a data processor, processing personal data on behalf of and under the instructions of the facility operator, in accordance with Section 1 of Act 843.
Cauta Solutions Group Limited is registered with the Ghana Data Protection Commission as a data processor. Facility operators (data controllers) are responsible for registering their own data processing activities with the DPC where required under Section 46 of Act 843, and for ensuring that data entered into the platform — including guest passport details, identification numbers, and contact records — is collected and used in compliance with applicable data protection laws.
1.2 Data Protection Supervisor
Cauta Solutions Group Limited has designated a Data Protection Supervisor responsible for overseeing compliance with Act 843 and coordinating with the Ghana Data Protection Commission. For data protection inquiries or complaints, contact our Data Protection Supervisor at privacy@cautamanage.com.
2. Information We Collect
2.1 Information You Provide
- Account information: name, email address, phone number, and password when you (operator, investor, or staff) create an account.
- Facility data: property name, address, unit details, rate plans, and configuration settings.
- Guest records: guest names, nationalities, identification document types and numbers, dates of birth, and primary-guest flags entered by the facility operator during check-in. Identification numbers (passport / Ghana Card / driver's licence) are encrypted at rest the moment they are saved and are surfaced in cleartext only through the audited GIS foreign-guest register export (see section 5.2).
- Booking data: check-in and check-out dates, unit assignment, rate plan applied, total charged, payment status, and guest contact details for stay-related notifications.
- Financial data: billing accounts, charges, payment records, invoicing details, and per-investor commission entries (gross amount, operator share, investor share, paid / pending status).
- Smart-lock data: per-stay PIN values are encrypted at rest; the cleartext PIN is shown to the operator exactly once at issue and never recoverable thereafter. The encrypted PIN is decrypted only at the moment of being pushed to the smart-lock hardware adapter.
- Communications: messages sent through automated stay communications (pre-arrival, check-in, post-checkout), broadcast features, support tickets, and contact form submissions.
- Channel-manager data: iCal feed URLs (for inbound OTA imports) and capability tokens (for outbound OTA exports). Outbound tokens are stored only as SHA-256 hashes; the cleartext is shown to the operator exactly once at creation.
2.2 Information Collected Automatically
- Usage data: pages visited, features used, and actions taken within the platform.
- Device information: browser type, operating system, device type, and screen resolution.
- Log data: IP addresses, access times, and referring URLs.
- Audit log entries: every significant action — including views of the GIS foreign-guest register, downloads of investor-yield reports, smart-lock PIN issuance and revocation, and changes to rate plans — is recorded with the actor, timestamp, and target object identifier for compliance and forensic purposes.
- Cookies and similar technologies: session cookies for authentication and preferences.
3. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the CautaManage platform.
- Process bookings, manage billing accounts, and compute per-investor commission entries.
- Issue, push, and revoke smart-lock PINs against integrated hardware (Dahua / Hikvision / ZKTeco).
- Generate the GIS foreign-guest register CSV for compliance with the Immigration Act, 2000 (Act 573).
- Synchronise availability with OTA channel partners (Airbnb, Booking.com, etc.) via iCal — strictly limited to BUSY/BLOCKED date ranges; no guest personal data is included in outbound iCal feeds.
- Send stay-related notifications via email, SMS, Telegram, and push notifications.
- Provide customer support and respond to inquiries.
- Monitor and analyze usage to improve our services.
- Detect, prevent, and address security issues and fraud.
- Comply with legal obligations.
3.1 Legal Basis for Processing
Under Act 843, we process personal data on the following lawful bases (Sections 18–20):
- Performance of a contract: processing necessary to provide the CautaManage platform as agreed in the subscription terms (e.g., booking management, PIN issuance, payment recording).
- Consent: where explicitly obtained — for example, when a guest opts in to Telegram notifications during check-in, or when an investor-owner accepts a read-only invitation to view their unit's calendar.
- Legitimate interest: processing necessary for security monitoring, fraud prevention, audit logging, and platform improvement, where such interests are not overridden by the data subject's rights.
- Legal obligation: processing required to comply with applicable Ghanaian laws, including the foreign-guest register obligation under the Immigration Act, 2000 (Act 573).
3.2 Sensitive Personal Data
The platform processes certain categories of sensitive personal data as defined under Section 37 of Act 843, including:
- National identification numbers (Ghana Card, passport, driver's licence) — collected during guest check-in for identity verification and GIS register compliance. Stored encrypted at rest using authenticated encryption; never displayed in cleartext through any read endpoint other than the audited GIS export (section 5.2).
- Nationality and date of birth — collected during guest check-in for GIS foreign-guest register compliance.
- Smart-lock PIN values — treated as authentication secrets. Encrypted at rest using authenticated encryption; cleartext shown to the operator exactly once at issue and never recoverable thereafter.
This data is processed only with the data subject's knowledge and for the specific purpose of facility operation and statutory compliance. Facility operators are responsible for displaying appropriate consent and notice to guests at the point of data collection.
4. Data Sharing and Disclosure
We do not sell your personal information. We may share data in the following circumstances:
- Within your facility: Facility operators can view and manage data for users and guests within their property as required for serviced-apartment operations.
- With investor-owners: When a facility operator invites an investor as a read-only user of their unit, that investor sees their unit's calendar (BUSY/BLOCKED date ranges only) and their per-owner Investor Yield statement. Guest personal data is never exposed to investor-owner accounts.
- With Ghana Immigration Service (GIS): The foreign-guest register CSV produced by the platform is provided to the facility operator (data controller). The operator is responsible for submitting it to GIS in accordance with the Immigration Act. CautaManage facilitates the data preparation but does not transmit data to GIS directly.
- With OTA channel partners (Airbnb, Booking.com, VRBO, etc.): Only BUSY/BLOCKED date ranges are shared via outbound iCal feeds. No guest names, contact details, or identification data are ever included in iCal exports. Inbound iCal sync from OTAs imports only date-range data; we do not retrieve guest details from OTA APIs.
- Service providers: We use third-party services for email delivery (SMTP), SMS, Telegram messaging, payment processing (Paystack, Hubtel, MTN MoMo), and push notifications (Firebase). These providers only receive the data necessary to perform their services.
- Smart-lock hardware: Decrypted per-stay PINs are transmitted to the configured smart-lock controller (Dahua / Hikvision / ZKTeco) over the operator's local network or vendor cloud, depending on configuration. Only the PIN value and validity window are transmitted; no guest personal data is sent to lock hardware.
- Legal requirements: We may disclose information if required by law, regulation, or legal process.
5. Data Storage and Security
Your data is stored on secure servers. We implement industry-standard security measures including:
- Encryption in transit (TLS/HTTPS) for all communications.
- Authenticated encryption at rest for sensitive PII (guest ID numbers, smart-lock PINs, channel-export capability tokens).
- Industry-standard password hashing algorithms.
- Secure session management with encrypted, HTTP-only cookies.
- Cross-site request forgery (CSRF) protection on all state-changing operations.
- Role-based access control to limit data access; investor-owners are limited to their unit's data only.
- Rate limiting and brute-force protection.
- Input validation and sanitisation to prevent injection attacks.
- SSRF guards on all outbound HTTP fetches (iCal sync from OTA partners).
- Automated daily database backups; backups are encrypted at rest via asymmetric encryption with the decryption key held offline.
- Comprehensive audit logging of all significant actions — including every view of the GIS register and every smart-lock PIN issue.
- Webhook signature verification for all third-party integrations (payment gateways, lock hardware).
5.1 Data Breach Notification
In the event of a data breach that affects your personal data, we will notify affected facility operators without undue delay, and no later than 72 hours after becoming aware of the breach. The notification will include the nature of the breach, the categories and approximate number of records affected, and the measures taken or proposed to address the breach. Facility operators are responsible for notifying affected guests, investors, and the Ghana Data Protection Commission as required by Section 30 of Act 843.
5.2 GIS Foreign-Guest Register
The platform produces a Ghana Immigration Service foreign-guest register on demand, in CSV format, listing non-Ghanaian guests of stays in a chosen date window. The CSV contains decrypted identification numbers required by the Immigration Act, 2000 (Act 573). Every download of this register is recorded in the audit log with the operator's identity, the date range, and the row count. Only operators with mgmt-level access to the Rentals module may generate this export. The cleartext PII contained in the CSV file becomes the responsibility of the facility operator the moment it is downloaded; we recommend operators encrypt the CSV at rest and transmit it to GIS only through secure channels.
6. Data Retention
We retain your data for as long as your account is active or as needed to provide services. Specific retention windows:
- Active account data — retained for the duration of the subscription. Facility operators may delete records within the platform.
- GIS foreign-guest register data — guest records are retained for 90 days after the last day of a guest's stay, after which the encrypted identification data is automatically purged from the live database. The decryption keys for purged records are no longer usable to recover the original values. Backup archives may retain historical encrypted snapshots for longer per the operator's backup retention policy.
- Smart-lock PIN history — the encrypted-at-rest PIN values are deleted at PIN revocation (manual or automatic at stay checkout). Only the metadata (issue time, revoke time, push status) is retained for the audit trail.
- Audit log entries — retained for the lifetime of the subscription; not user-deletable.
- Backup archives — retained per the operator's configured backup policy (default 90 days rolling), encrypted at rest.
Upon account termination, we will delete or anonymize live-database data within 90 days. Encrypted backup archives may persist for the operator's specified retention window unless the operator requests earlier purge.
7. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data.
- Object to or restrict certain processing.
- Export your data in a portable format.
- Withdraw consent where processing is based on consent.
Under Section 34 of Act 843, you also have the right to compensation for damage suffered as a result of unlawful processing of your personal data.
To exercise these rights, contact our Data Protection Supervisor at privacy@cautamanage.com. Note that requests to delete guest records held under statutory obligation (e.g. foreign-guest data within the GIS retention window) may be limited by the operator's legal duties under the Immigration Act. If you are not satisfied with our response, you have the right to lodge a complaint with the Ghana Data Protection Commission:
8. Cookies
We use essential cookies for authentication and session management. These cookies are strictly necessary for the platform to function and cannot be disabled. We do not use advertising or tracking cookies. The marketing site at cautamanage.com uses only Cloudflare Insights for aggregate, anonymised traffic analytics.
9. Third-Party Services
Our platform integrates with the following third-party services, each of which receives only the data necessary to perform its function:
- Paystack — for online payment processing.
- Hubtel — for mobile money payment processing.
- MTN MoMo — for direct mobile money settlement.
- Telegram — for Telegram bot notifications and guest comms.
- SMS providers — for SMS notifications.
- Firebase (Google) — for push notifications.
- OTA channel partners (Airbnb, Booking.com, VRBO, etc.) — via iCal date-range exchange only; no guest PII.
- Smart-lock vendors (Dahua, Hikvision, ZKTeco) — receive PIN value + validity window during stay activation.
Each service has its own privacy policy. We encourage you to review their policies.
10. Children's Privacy
CautaManage is not intended for direct use by individuals under the age of 18. Where minors are recorded as part of a guest party (a family checking into a serviced apartment), the responsible parent or guardian is the data subject of record; the minor's name and date of birth are processed strictly for occupancy and statutory purposes under the explicit instruction of the booking guest and the facility operator.
11. International Data Transfers
Your data may be processed in countries other than your country of residence. Specifically:
- Push notifications (Firebase/Google) — notification tokens and delivery metadata may be processed in the United States and other countries where Google operates data centres.
- Payment processing (Paystack, Hubtel, MTN MoMo) — transaction data is processed within their respective infrastructure.
- OTA channels (Airbnb, Booking.com, etc.) — iCal date-range data exchanged with their servers, typically located outside Ghana.
In accordance with Act 843, we ensure that each third-party processor provides a level of protection for personal data that is adequate and consistent with Ghana's data protection standards. We achieve this through contractual obligations, selecting processors with industry-standard security certifications (SOC 2, ISO 27001, or equivalent), and limiting transferred data to the minimum necessary.
Where a sub-processor is not domiciled in Ghana, Cauta Solutions Group Limited ensures that the sub-processor complies with the relevant laws of its country, as required by Act 843.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes at least 30 days in advance by posting the updated policy on our website with a revised "Last updated" date and notifying facility operators by email.
13. Contact Us
If you have questions about this Privacy Policy, contact us at: