Privacy Policy

The Trunk ("the App", "we", "us", or "our") is a communications operations platform provided for the New Patriotic Party (NPP) Communications Directorate in Ghana. It includes a mobile application for registered communicators and related web services used by authorised Directorate staff.

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how long we keep it, and the choices available to you. It is written to meet the expectations of the Apple App Store and Google Play, and to align with Ghana’s Data Protection Act, 2012 (Act 843) and good practice for organisational apps.

This Policy applies to personal data processed when you:

• Use The Trunk mobile app as a communicator or other authorised mobile user
• Create or manage an account, acknowledge the Code of Conduct, or update your profile
• Receive speaking notes, deployments, headlines, notifications, or appraisals through the App
• Contact support through channels listed in the App
• Visit our public website pages that link to this Policy (including /privacy)

It does not cover third-party websites or services that we do not control, even if they are linked from the App.

Depending on your role and how you use The Trunk, we may process the following categories of data:

The mobile app may ask for the following permissions. You can withdraw permission in your device settings; some features will then be unavailable:

• Camera — to take a profile picture
• Photo library — to choose a profile picture or attach images to feedback
• Phone-related permissions on some Android builds — only as declared for platform compatibility; we do not use the App to place marketing calls or scrape your contacts
• Notifications — to send operational alerts (new speaking notes, deployment requests, appraisal outcomes, and similar)

We do not request access to your contacts list, precise continuous location tracking, microphone recording for ambient audio, or health data for the communicator App’s core features.

We use personal data to:

• Authenticate you and protect accounts (including MFA, password reset, and session management)
• Operate communicator workflows: profile management, Code of Conduct acknowledgement, speaking notes delivery and acknowledgement, deployments, appearances, appraisals, and related notifications
• Coordinate media appearances and ensure tier eligibility rules are applied
• Provide support and respond to feedback
• Maintain security, audit trails, and prevent abuse or unauthorised access
• Improve App performance, reliability, and usability using analytics and diagnostics
• Comply with legal obligations and internal governance requirements of the Communications Directorate

We do not sell your personal data. We do not use your communicator profile data for third-party advertising.

We process personal data because it is necessary to provide The Trunk to authorised users of the NPP Communications Directorate, to perform organisational communications functions, to meet security and accountability obligations, and — where required — with your consent (for example for optional camera/photo access or optional analytics where consent is used).

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Some processing cannot be withdrawn if it is required to keep your account secure or to meet retention duties.

Your data may be accessed or shared only as needed for the purposes above:

• Authorised NPP Communications Directorate staff and administrators operating The Trunk web portal
• Service providers who host or support the platform under contract (for example cloud hosting, SMS/email delivery for OTPs and alerts, analytics providers such as PostHog, and mobile distribution / update infrastructure such as Expo)
• Professional advisers or authorities when required by law, valid legal process, or to protect rights, safety, and security

Service providers are instructed to process personal data only on our instructions and for the purposes of providing their services.

We keep personal data only as long as needed for the purposes described in this Policy, including operational, security, and audit needs.

If you (or an authorised administrator) request deregistration or erasure of personal data, we aim to schedule deletion of eligible personal data within 30 days of a validated written request, consistent with our communicator deregistration process. Certain records may be retained where required for audit, security, dispute resolution, or legal compliance (for example appraisal history and security audit logs).

Local session data on your device is removed when you sign out or uninstall the App, subject to normal device storage behaviour.

We use administrative, technical, and organisational measures designed to protect personal data, including encrypted transport (HTTPS), hashed credentials, role-based access controls, session controls, and audit logging on the server side. The mobile app stores authentication tokens using platform secure storage where available.

No method of transmission or storage is completely secure. If you believe your account has been compromised, contact support immediately and reset your password.

Some service providers (for example analytics or hosting infrastructure) may process data on servers outside Ghana. Where that happens, we take steps appropriate to the risk and the provider’s role so that personal data continues to be protected in line with this Policy and applicable law.

The Trunk is an organisational tool for authorised adult communicators and staff. It is not directed at persons under 18, and we do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will take appropriate steps to delete it.

Subject to applicable law and organisational policy, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete data (some profile fields can be edited directly in the App; others are managed by administrators)
• Request deletion of your account and associated data (see Delete your data below)
• Object to or restrict certain processing, where applicable
• Withdraw optional consent (for example camera or photo library access) in device settings
• Manage notification preferences where the App provides those controls

To exercise these rights, use in-app Contact Us / Support, email support@thetrunk.app, or ask your Communications Directorate administrator. We may need to verify your identity before fulfilling a request.

If you created or were issued an account for The Trunk, you can request deletion of that account and the personal data associated with it. Freezing, disabling, or deactivating an account is not the same as deletion — when we complete a validated deletion request, we delete the account and associated personal data, except where retention is required as described below.

How to request deletion:

• Email support@thetrunk.app with the subject line “Delete my The Trunk account”, and include the email address and/or phone number linked to your account so we can verify your identity
• Or use Contact Us / Support inside the App and clearly ask for account and data deletion
• Or ask an authorised Communications Directorate administrator to submit a deregistration / erasure request on your behalf

What we delete: your account credentials and access, profile information you provided (such as name, contact details, and photo), device/push tokens registered to your account, and other personal data tied to your communicator profile that is not subject to a retention requirement.

What we may retain: limited records required for audit, security, dispute resolution, or legal compliance (for example appraisal history and security audit logs), as described in Data retention. We will not keep your account active after a completed deletion request.

Timing: after we verify your request, we aim to complete deletion of eligible personal data within 30 days. Uninstalling the App from your device stops local use of the App but does not by itself delete your account or server-side data — please send a deletion request as above.

The App relies on carefully chosen third-party services to operate, including analytics (PostHog), mobile runtime and updates (Expo), and infrastructure that delivers SMS/email notifications. Those providers process limited technical and usage data as needed to provide their services. Their own privacy notices may also apply to their processing.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page and, where appropriate, notify you in the App or through other reasonable channels. Continued use of The Trunk after an update means you acknowledge the revised Policy, except where additional consent is required by law.

For privacy questions, data deletion requests, or concerns about how The Trunk handles personal data, email us at support@thetrunk.app, use the support channels shown in the App (Contact Us), or write to the administrator responsible for The Trunk within the Directorate.

You may also have the right to lodge a complaint with Ghana’s Data Protection Commission if you believe your data protection rights have been infringed.