Privacy Policy

Effective date: 14 October 2026. This policy covers Mathcoby’s website, customer communications, and related business records. Public customers do not need an account.

Who Is Responsible

Contact Mathcoby Engineering & Construction Ltd., Accra, Ghana, at mathewgogah8@gmail.com or +233 26 715 3112. Mathcoby determines how customer information is used and is the data controller. For a privacy request, use the email above with the subject “Privacy Request”.

Appointments and Contact Inquiries

We collect the details you enter to understand your request, arrange assessments, provide quotations, and reply.

• Appointments require your name, phone number, location, service category and preferred contact method. Email, project description, preferred date/time and most service details are optional; an “Other problem” detail is required when that category is chosen. If you choose email contact, provide a usable email address.
• The contact form requires name, email, phone, subject and message. Without required details the form cannot be submitted; you can contact us directly instead. The API also accepts inquiries without optional contact fields.
• Administrators may record service-related notes, status updates and follow-up notifications. Avoid submitting identity documents, health information, payment-card details or information about other people that we do not need.

Reviews and Project Content

Submitting a review requests that we consider it for public display. Approved reviews may show your submitted name, service/project type, rating, review text and location if provided. Unapproved reviews are not displayed publicly.

• You can request correction or removal through our privacy contact. Please do not include private contact details or confidential information in review text.
• Published project descriptions, locations and images are intended for public viewing. Project photographs can identify people or properties; Mathcoby should have permission or another appropriate basis before publishing them.

Invoices and Internal Financial Records

We store manually prepared invoice references, customer/project names, amounts in Ghana cedis, invoice dates, Pending/Paid status, optional notes, optional PDF attachments and timestamps. The website does not generate or automatically send invoices, process payments, or provide a customer account dashboard. Invoice records and PDFs are restricted to authorised administrators.

Admin and Technical Information

Private administrator records include name, email, role, account status, authentication records and login/session timestamps. Supabase Auth handles admin sign-in credentials; the application stores a hash of its session token. We also use request identifiers, request method/status and keyed rate-limit identifiers for security. Hosting and email providers may separately process IP addresses, device information, access/delivery logs and support records.

Why We Process Information

Processing is limited to the stated service, recordkeeping, publication and security purposes. Depending on the circumstances, the grounds under Ghana’s Data Protection Act include your consent, an existing contract, legal obligations, or a necessary legitimate interest in handling requested services and protecting systems. A website inquiry alone is not a signed construction contract.

• Optional analytics requires a separate choice; submitting a form does not accept analytics or marketing.
• Review publication follows your request to submit a review for approval. Service-related communication is separate from advertising. These website forms do not subscribe you to marketing.

Telephone, WhatsApp and Email

We may respond through the method you select or use to contact us. WhatsApp is operated by Meta and applies its own terms and privacy practices. Clicking a WhatsApp link opens that service and may pass a prepared message; it does not itself send the message. Email and telephone providers also handle communications. Do not send unnecessary sensitive documents through these channels.

Service Providers and International Processing

Our website is hosted on Vercel; the API runs on Render; Supabase provides PostgreSQL, admin authentication and file storage. Resend handles notification emails where configured; a configured SMTP provider may be used instead. Google Analytics 4 runs only when configured and you accept analytics. Google Fonts and the jsDelivr-hosted Lucide library are requested to render the site and may receive technical connection information even when analytics is rejected.

• Providers may process information outside Ghana. The company must assess their contracts, regions, access controls and applicable Ghanaian safeguards; this policy does not claim Ghana-only hosting or verified overseas certification.
• Data may also be disclosed when required by law or to authorised professional advisers where necessary. We do not sell personal data.

Cookies and Analytics

The site remembers consent and theme choices in browser storage. Essential admin cookies maintain private sessions. Optional GA4 reporting concerns page views and website actions; application analytics excludes form values and strips URL query strings/fragments. See the Cookie Policy. Use “Cookie Preferences” in the footer to accept or reject analytics at any time.

Security and Access

The application uses server-side administrator checks, restricted database permissions and row-level security, input/file validation, rate limits and friendly errors. Invoice PDFs are stored in a private bucket and retrieved through an authenticated API. Production sessions are designed to use Secure, HttpOnly cookies and expire after 15 minutes of inactivity. Public project images are accessible through temporary links; published content is not confidential. No online system is risk-free, and we do not claim specific certifications or guaranteed security.

Retention and Deletion

Records are retained while needed for the relevant service, an applicable legal/financial obligation, or a dispute. Fixed business deletion periods have not yet been established for every category; there is no automatic customer-record expiry. Tax-related invoice/supporting records may require at least six years from the legally relevant date, or longer where a tax matter remains unresolved. We assess deletion requests individually rather than promising unconditional deletion.

• Deletion from active records may not immediately remove provider backups, email copies, WhatsApp conversations, or previously shared/public copies. We must consider those systems separately and apply provider retention arrangements.
• Expired sessions stop granting access even if a restricted record remains for security review. Analytics and provider-log retention depend on the approved account settings.

Your Rights and Requests

You may request access, correction, deletion where appropriate, withdrawal of consent, or objection to processing as provided by Ghanaian law. No customer account is needed. Email our privacy contact, identify the type and approximate date of your request, and provide the contact detail used originally. Do not attach a full identity document unless we explain why it is needed and agree a secure method.

• We reasonably verify identity before releasing, changing or deleting records, and protect information about other people. We may contact you through an existing contact channel.
• Access requests should be handled promptly and, subject to the statutory conditions, within 40 days of receipt. We will explain any lawful refusal or retention requirement and the action taken.
• You may complain to the Ghana Data Protection Commission. Contacting Mathcoby first does not prevent a complaint.

Updates

We will update this policy when processing or legal requirements change, with the revised date shown here. A materially new optional use may require a new consent choice. This policy does not certify DPC registration or guarantee legal compliance.