Privacy Policy

1. Who We Are & Scope of This Policy

Enermyx ("Enermyx," "we," "us," or "our") is a hardware prototyping, electronics, and digital services company based in Accra, Ghana, serving clients across Africa. For the purposes of Ghana's Data Protection Act, 2012 (Act 843), Enermyx acts as a "data controller" for personal information collected through our website, shop, ordering tools, and direct communications, and may act as a "data processor" for certain information provided to us by clients for the purpose of completing a specific project.

This Policy applies to personal information we collect through enermyx.com, our online shop, our 3D print ordering wizard, our contact forms, email, WhatsApp, phone calls, and any in-person consultations or project work. It does not apply to third-party websites or services that we may link to, which have their own privacy practices.

2. Information We Collect

We collect different categories of personal information depending on how you interact with us:

Information you give us directly:

• Identity and contact information, such as your name, email address, phone number, and physical or delivery address;
• Order and project information, such as items purchased, product specifications, design files, 3D models (STL files), project requirements, and quote or invoice details;
• Payment confirmation details processed via Paystack (see Section 4), such as transaction reference numbers and payment status. We do not collect or store full card numbers, CVV codes, or mobile money PINs ourselves;
• Communications you send us, including messages submitted through our contact form, email, WhatsApp, or phone calls, and any attachments, files, or materials you share with us for a project;
• Academic or institutional information, where relevant, such as school name, course or programme details, and supervisor information, for clients requesting final-year or academic project assistance; and
• Feedback, reviews, and survey responses you choose to provide, including Google reviews we may invite you to leave after an order.

Information collected automatically:

• Technical data such as your IP address, browser type and version, device type, operating system, and general location (such as city or country) inferred from your IP address;
• Usage data such as pages visited, time spent on pages, links clicked, referring website, and how you navigate our site, the shop, and the 3D print ordering tool;
• Cookies and similar tracking technologies, as described in Section 9 (Cookies & Tracking Technologies); and
• Security-related data captured by tools such as Google reCAPTCHA, used to detect bots and prevent abuse of our contact and order forms.

Information from third parties:

• Payment status and limited transaction metadata from Paystack, our payment processing partner;
• Delivery status updates from courier or logistics partners used to fulfill physical orders; and
• Information shared with us by a partner organization in the context of a joint or co-launched project (for example, a school sharing relevant operational information needed to scope a hardware integration), where that partner has confirmed they are authorized to share it with us.

We do not knowingly collect sensitive personal data (such as health information, religious beliefs, or biometric data) unless it is directly necessary for a specific project you have engaged us for and you have provided it voluntarily, in which case we apply additional care as described in Section 10 (Sensitive Personal Data).

3. How & Why We Use Your Information

We use personal information only for purposes that are specific, lawful, and reasonably necessary, including to:

• Process and fulfill orders placed through our shop or 3D print ordering tool, including calculating pricing, generating quotes, and arranging pay-on-delivery or prepayment;
• Communicate with you about your order, project, quote, consultation, or enquiry, including sending confirmations, updates, and invoices;
• Deliver hardware prototyping, PCB design, 3D printing, robotics, web development, academic project assistance, training, and other Services you have requested;
• Verify payments and prevent fraud, in connection with our payment processor, Paystack;
• Improve our website, shop, and ordering tools, including diagnosing technical issues and understanding how our Services are used;
• Protect the security of our Services, including detecting and preventing spam, abuse, or fraudulent activity through tools such as reCAPTCHA;
• Send you service-related communications (such as order status, delivery updates, or project milestones), which are not optional while you have an active order or project;
• With your consent or where you have not opted out, send you marketing communications, promotional offers, or requests for feedback (such as an invitation to leave a Google review); and
• Comply with legal, tax, accounting, or regulatory obligations, and respond to lawful requests from courts, regulators, or government authorities, including the Data Protection Commission.

Legal basis for processing: Under the Data Protection Act, 2012 (Act 843), we rely on one or more of the following grounds to process your personal information: your consent (for example, opting in to marketing); the need to perform a contract with you (for example, fulfilling an order or project); our legitimate business interests (for example, fraud prevention and service improvement), balanced against your rights; and compliance with a legal obligation. Where we rely on consent, you may withdraw it at any time as described in Section 7 (Your Rights).

4. Payments & Financial Information

All online payments are processed through Paystack, a licensed third-party payment service provider. When you make a payment, your card, mobile money, or bank details are entered directly into Paystack's secure payment interface and are not transmitted to or stored on Enermyx's own servers or spreadsheets.

We receive limited transaction information from Paystack, such as confirmation of payment, the amount paid, a transaction reference, and the payment method used, which we use to verify your order and maintain accurate financial and order records. Paystack's handling of your payment data is governed by Paystack's own privacy policy, which we encourage you to review.

For pay-on-delivery orders within eligible areas, payment is collected in person at the point of delivery and is not processed through Paystack; in that case, we retain only the order and delivery records necessary to confirm the transaction took place.

5. How We Store & Where Your Data Is Processed

We use a combination of tools to store and process personal information, including Google Workspace products (such as Google Sheets and Google Apps Script) for order, customer, and project records, Google Drive for file and document storage, our website hosting provider for site and form data, and EmailJS for sending transactional emails (such as order confirmations and review requests). We also use Google reCAPTCHA to help secure our forms against automated abuse.

Because several of these providers operate infrastructure outside Ghana, your personal information may be transferred to, stored on, and processed on servers located in other countries. Where this occurs, we take reasonable steps to ensure that such providers maintain a standard of data protection consistent with the Data Protection Act, 2012 (Act 843), including relying on providers with their own recognized security and privacy commitments (such as Google's and Paystack's published security practices).

We apply reasonable administrative, technical, and physical safeguards appropriate to the size of our business to protect personal information from unauthorized access, alteration, disclosure, or destruction. These include access restrictions on our internal systems, use of reputable third-party infrastructure providers with their own security standards, and limiting access to personal data to those who reasonably need it to perform their role at Enermyx. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

6. Sharing & Disclosure of Information

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may share personal information in the following limited circumstances:

• Service providers: with trusted third parties who help us operate our business, such as Paystack (payments), Google (data storage, spreadsheets, and email infrastructure), EmailJS (transactional email delivery), Google reCAPTCHA (form security), our hosting provider, and courier or logistics partners (delivery of physical orders). These providers are only given access to the information necessary to perform their function for us.
• Strategic and co-launched product partners: where you engage with a product or system jointly developed or offered by Enermyx and a partner organization (for example, under a strategic partnership described in our Terms of Service), limited operational information necessary to deliver that specific product or system may be shared between Enermyx and that partner.
• Legal and safety reasons: where we believe in good faith that disclosure is necessary to comply with a legal obligation, respond to a valid request from a court, regulator, or government authority (including the Data Protection Commission), enforce our Terms of Service, or protect the rights, property, or safety of Enermyx, our clients, or others.
• Business transfers: if Enermyx is involved in a merger, acquisition, restructuring, or sale of assets, personal information may be transferred as part of that transaction, subject to reasonable confidentiality protections and consistent with this Policy.
• With your consent: in any other circumstance where you have given us explicit permission to share your information with a specific third party.

Where we share personal information with a service provider or partner, we take reasonable steps to ensure they are contractually or otherwise required to protect that information and use it only for the purpose for which it was shared.

7. Your Rights as a Data Subject

Under the Data Protection Act, 2012 (Act 843), you have a number of rights in relation to your personal information, including the right to:

• Be informed about what personal data we hold about you, why we collect it, and who it may be disclosed to;
• Access a copy of the personal data we hold about you;
• Correct personal data that is inaccurate, incomplete, or out of date;
• Request deletion of personal data we hold about you, subject to any legal, contractual, or legitimate business reason we may have to retain certain records (for example, financial records we are required to keep for tax purposes);
• Object to or restrict certain processing of your personal data, including direct marketing, at any time;
• Withdraw consent you previously gave us for a specific purpose, without affecting the lawfulness of processing carried out before withdrawal; and
• Lodge a complaint with Ghana's Data Protection Commission if you believe we have not handled your personal information in accordance with the law.

To exercise any of these rights, contact us at info@enermyx.com. To protect your information, we may need to verify your identity before responding to certain requests. We will respond to verified requests within a reasonable time and in accordance with the timeframes set out in the Data Protection Act, 2012 (Act 843).

8. Data Retention

We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, including to provide our Services, maintain order and project records, comply with our legal, tax, and accounting obligations, resolve disputes, and enforce our agreements.

As a general guide: order and transaction records are typically retained for the period required by applicable tax and accounting laws in Ghana; project files, design assets, and client communications related to an active or completed project are typically retained for a reasonable period after project completion in case of warranty, support, or dispute-related needs; and contact form submissions or marketing-related data are retained until you opt out or request deletion, or until they are no longer needed for the purpose collected. Where personal information is no longer needed, we take reasonable steps to delete, anonymize, or securely dispose of it.

9. Cookies & Tracking Technologies

Our website may use cookies and similar tracking technologies (such as local storage and tracking pixels) to operate correctly, remember your preferences, understand how visitors use our site, and, where applicable, measure the performance of our content and offerings.

We use, or may use, the following categories of cookies:

• Strictly necessary cookies: required for core website and shop functionality, such as maintaining your session while you complete an order or use the 3D print ordering tool, and supporting security tools such as Google reCAPTCHA. These cannot be switched off without affecting how the site works.
• Functional cookies: used to remember choices you make on our site (such as display preferences) to provide a more personalized experience.
• Analytics and performance cookies: used, where enabled, to understand how visitors use our website, such as which pages are viewed and how users navigate the shop and ordering tools, so that we can improve our Services. This may include tools such as Google Analytics.
• Third-party cookies: certain third-party services we use, such as Paystack during checkout and Google reCAPTCHA on our forms, may set their own cookies as part of providing their service to us. These are governed by the relevant third party's own cookie and privacy practices.

Most web browsers allow you to control or disable cookies through their settings. Please note that disabling certain cookies, particularly strictly necessary ones, may affect the functionality of our website, shop, or ordering tools, including your ability to complete an order.

10. Sensitive Personal Data

We do not seek to collect sensitive personal data (such as data relating to health, religion, ethnicity, political opinions, or biometric identifiers) as part of our standard Services. If a specific project requires processing of sensitive personal data (for example, where a client-provided dataset or hardware integration incidentally includes such information), we will only do so where it is strictly necessary for that project, where you have provided explicit consent or another lawful basis applies under the Data Protection Act, 2012 (Act 843), and with additional safeguards appropriate to the sensitivity of that data.

11. Children's Privacy

Our Services, including our academic and final-year project assistance offerings, may be used by or on behalf of students who are minors, typically in connection with a school, programme, or parent/guardian engagement. Where we knowingly process personal information relating to a minor, we do so only where it is necessary to deliver the requested academic or project assistance Service, and we rely on the involvement of a parent, guardian, teacher, or institution to provide consent and oversight where required by law.

We do not knowingly collect personal information directly from young children for unrelated marketing purposes. If you are a parent or guardian and believe a minor has provided us with personal information outside the context of a legitimate, supervised project engagement, please contact us at info@enermyx.com so we can review and, where appropriate, delete that information.

12. Data Security & Breach Notification

We implement administrative, technical, and physical security measures appropriate to the nature of the personal information we hold and the size of our business, with the goal of protecting it from unauthorized access, alteration, disclosure, loss, or destruction.

In the event of a personal data breach that is likely to risk your rights or freedoms, we will, as required under the Data Protection Act, 2012 (Act 843), notify the Data Protection Commission and affected data subjects as soon as reasonably practicable, and take reasonable steps to investigate, contain, and remedy the breach and restore the integrity of affected systems.

13. Third-Party Links & Services

Our website and communications may contain links to third-party websites or services, such as Paystack's payment pages, social media platforms, or partner websites. We are not responsible for the privacy practices or content of these third parties. We encourage you to review the privacy policy of any third-party site or service before providing it with personal information.

14. Registration with the Data Protection Commission

Under the Data Protection Act, 2012 (Act 843), entities that process personal data as data controllers or data processors are generally required to register with Ghana's Data Protection Commission. Enermyx is committed to meeting its registration and compliance obligations under the Act, and will update this section, where applicable, to reflect our current registration status with the Commission.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, our Services, or legal and regulatory requirements. Any changes will be posted on this page with a revised "Last Updated" date. Where changes are material, we will make reasonable efforts to bring them to your attention, such as by email or a notice on our website. Your continued use of our Services after an updated Policy takes effect constitutes your acceptance of the revised Policy.

16. Contact Us & Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us at info@enermyx.com. We aim to respond to all privacy-related enquiries within a reasonable time.

If you believe we have not addressed your concern adequately, you have the right to lodge a complaint directly with Ghana's Data Protection Commission as the independent body responsible for enforcing the Data Protection Act, 2012 (Act 843).