MMONDA Legal
Legal & compliance

Privacy Policy

How MONDA Legal handles identity, payment, legal-matter, communication and technical data.

Effective: 24 July 2026Operator: EL-Grey IndustriesJurisdiction: Ghana
No call recordingAudio and video consultations are not recorded by default.
Sensitive legal dataMatter information is handled with purpose limitation and safeguards.
Your rightsYou may request access, correction, deletion or objection where applicable.
Do not send card PINs, mobile-money PINs or one-time passwords to MONDA Legal or a Partner Law Firm.

1. Who we are and scope

This Privacy Policy explains how EL-Grey Industries, operating MONDA Legal, collects, uses, stores, shares and protects personal data when you use the Platform. EL-Grey Industries acts as the data controller for the Platform information it determines how to process. A Partner Law Firm or Insurance Partner may be a separate data controller for information it receives and uses for professional or insurance purposes.

The exact legal entity receiving payment is shown on the Paystack checkout page, receipt or subscription confirmation. Privacy enquiries may be sent to enquiries@el-grey.co.uk with the subject “Privacy Request”.

2. Data we may collect

We may collect the following categories:

Identity and verification dataName, date of birth, nationality, photograph, signature, Ghana Card or other government-issued identification details, and verification results.
Contact and account dataEmail address, phone number, address, login credentials, security settings, preferences and account status.
Subscription and payment dataPlan, amount, currency, transaction reference, payment status, billing history, refunds and limited payment metadata. Paystack or the relevant financial institution handles full card or mobile-money credentials; MONDA Legal generally does not receive or store full card numbers, PINs or one-time passwords.
Legal-matter dataYour questions, instructions, case details, parties, deadlines, documents, evidence, correspondence and information required for conflict checks or legal-service delivery.
Special personal dataWhere relevant to a legal matter, information about health, alleged or actual offences, legal proceedings, race or ethnicity, religion, political opinions, sexual orientation or other sensitive matters. We collect this only where necessary and with an appropriate legal justification or consent.
CommunicationsChat messages, emails, support requests, complaints and feedback.
Call metadataDate, time, duration, participants, connection status and technical logs. MONDA Legal does not record audio or video consultations unless a separate notice and required consent are provided.
Device and usage dataIP address, device type, operating system, app version, browser, language, crash logs, security events and interactions with the Platform.
Location dataApproximate location derived from IP address and, only where permission is granted and needed, device location.
Marketing dataCommunication preferences and engagement with notices or campaigns.

3. How we obtain data

We obtain data directly from you, from your authorised representative, from Partner Law Firms or Insurance Partners involved in your matter, from Paystack and financial institutions for payment status, from identity-verification or fraud-prevention services, and automatically from devices and Platform use.

4. Why we use personal data

We process personal data for specific, lawful purposes, including:

Provide the PlatformCreate accounts, manage subscriptions, arrange appointments, support communications, store evidence and deliver selected features.
Connect users to professionalsConduct intake, conflict checks, referrals and service coordination with Partner Law Firms.
Administer insuranceConfirm eligibility, active status, service use, claims-related records and communications with an Insurance Partner where the plan includes cover.
Process paymentsConfirm transactions, issue receipts, manage recurring billing, refunds, disputes and fraud prevention through Paystack.
Verify identity and complyMeet legal, regulatory, professional, payment, anti-fraud, KYC or AML requirements where applicable.
Protect people and systemsAuthenticate users, investigate misuse, maintain logs, prevent unauthorised access and respond to security incidents.
CommunicateSend service notices, appointment reminders, policy updates, support responses and, with the appropriate permission, marketing.
Improve and analyseMeasure performance, diagnose errors and improve usability using data that is aggregated or minimised where possible.
Establish or defend rightsHandle complaints, legal claims, regulatory enquiries, audits and enforcement of our agreements.

Our legal justification may include performance of a contract, consent, compliance with a legal obligation, protection of legitimate interests that do not override your rights, or another justification recognised by the Data Protection Act, 2012 (Act 843).

5. Sharing of personal data

We may share only the data reasonably necessary with:

Partner Law FirmsFor conflict checks, legal advice, representation and professional record keeping.
Insurance PartnersFor eligibility, underwriting where applicable, policy administration, claims and complaints.
Paystack and financial institutionsFor checkout, payment confirmation, recurring billing, refunds, fraud prevention and disputes.
Technology providersSecure hosting, database, communications, identity verification, analytics, cybersecurity, customer support and app distribution.
Professional advisersAuditors, accountants, insurers and legal advisers subject to confidentiality duties.
Authorities and courtsWhere required by law, court order, regulator request, public-safety need or to establish or defend legal rights.
Corporate transactionsA lawful merger, financing, reorganisation, sale or transfer, with appropriate confidentiality and data-protection measures.

We do not sell personal data. We do not permit service providers to use Platform data for their own unrelated marketing.

6. Partner Law Firms, privilege and professional records

Partner Law Firms are professionally independent and may maintain their own client file under legal and professional obligations. Their privacy notice and engagement terms may apply in addition to this Policy.

Information sent before a law firm accepts an engagement may not automatically be protected by lawyer-client privilege. Once an engagement exists, privilege and confidentiality are determined by applicable law and the law firm’s professional duties.

7. Paystack and payment security

Paystack processes payment information under its own terms and privacy policy. MONDA Legal receives transaction status, reference, amount and limited customer or risk information needed to administer the subscription and resolve disputes.

Never share your card PIN, mobile-money PIN, one-time password or full security credentials with MONDA Legal staff or a Partner Law Firm.

8. International transfers

EL-Grey Industries has operations and service relationships that may involve Ghana, the United Kingdom, Canada and cloud-service locations in other countries. Personal data may therefore be accessed or processed outside Ghana.

Where data is transferred internationally, we will use reasonable contractual, organisational and technical safeguards and will seek to ensure a level of protection consistent with applicable law.

9. Security

We use reasonable administrative, technical and physical safeguards appropriate to the sensitivity of the data. Measures may include encryption in transit and at rest, access controls, authentication, backups, monitoring, staff confidentiality and incident-response procedures.

No system is completely secure. You should use a strong unique password, protect your device and report suspicious activity promptly.

10. Retention

We keep personal data only for as long as reasonably necessary for the purpose collected, the duration of the account or legal matter, professional or insurance record requirements, payment and audit obligations, complaint handling, limitation periods, security and applicable law.

Different records may have different retention periods. Partner Law Firms and Insurance Partners determine retention for their independent records. When data is no longer required, it will be deleted, anonymised or securely archived unless law requires continued retention.

11. Your rights

Subject to the Data Protection Act, 2012 (Act 843) and lawful limitations, you may request:

AccessConfirmation of whether we hold personal data about you and a description or copy of that data.
CorrectionCorrection of inaccurate, incomplete, out-of-date or misleading data.
Deletion or blockingDeletion, destruction or restriction where the data is unlawfully held, excessive or no longer necessary, subject to legal retention duties.
ObjectionObjection to certain processing, including direct marketing.
Withdrawal of consentWithdrawal where processing relies on consent, without affecting processing already carried out lawfully.
ComplaintReview by EL-Grey Industries and, where unresolved, a complaint to the Data Protection Commission of Ghana.

To protect you, we may verify identity before completing a request. We will respond within the period required by applicable law or, where no fixed period applies, within a reasonable time.

12. Marketing and notifications

Service messages about payments, security, appointments, legal-matter activity and policy changes are necessary to operate the account and cannot always be disabled while the account is active.

You may opt out of promotional email, SMS or push notifications using the available unsubscribe or settings tools. Opting out of marketing does not stop essential service communications.

13. Cookies and similar technologies

The MONDA website may use necessary cookies for security, login and preferences, and may use analytics cookies with appropriate notice or consent. Browser or device settings can be used to control non-essential cookies, although some features may be affected.

14. Children

The Platform is intended for persons aged 18 or older. We do not knowingly create accounts for children. A parent or lawful guardian seeking assistance concerning a child should use the adult’s account and provide only information necessary for the matter.

15. Security incidents

If a security compromise affects personal data, we will investigate, contain and remediate it and will notify affected persons and the Data Protection Commission where required by law.

16. Changes to this Policy

We may update this Policy to reflect legal, security, operational or service changes. The updated version will state its effective date, and material changes will be communicated through the Platform, website or email.

17. Contact and complaints

Privacy requests or complaints: enquiries@el-grey.co.uk (subject: “Privacy Request”)

Postal address: 3 Praso Street, Batsonaa, Spintex, Accra, Ghana

You may also contact the Data Protection Commission of Ghana through its official channels if you believe your data-protection rights have been infringed.

Questions?

Email enquiries@el-grey.co.uk or write to 3 Praso Street, Batsonaa, Spintex, Accra, Ghana.