Privacy notice

The company operating as Covva, whose legal name is to be confirmed before launch, is the data controller for personal data processed through our website and apps. We intend to be registered with the Data Protection Commission as required by Act 843. Registration details are to be confirmed before launch.

Your broker of record and the insurers you ask for quotes are separate controllers for the data they receive to advise you, underwrite your risk and administer your policy. Their own privacy notices also apply.

Data protection contact: to be confirmed before launch. For now, email support@covva.com.gh.

• Identity and contact details — name, phone number, email, date of birth, Ghana Card or passport details where an insurer requires them.
• Risk information — details about what you want to insure, for example your vehicle, home, trip, business or the people to be covered.
• Special category data — health information only where needed for health, life or travel cover, collected with your explicit consent.
• Documents — photos and documents you upload, such as vehicle registration or claim evidence.
• Transaction data — quotes, applications, payment references and status (we do not store full card numbers or mobile money PINs).
• Communications — messages with your broker and our support team.
• Technical data — device, browser, IP address and usage information to keep the service secure and working.

• To create and secure your account, and verify your identity — to perform our contract with you.
• To route your request to a licensed broker, obtain quotes and arrange cover — contract, and your consent where special category data is involved.
• To send service messages such as status updates, renewal reminders and claim progress — contract and legitimate interests.
• To prevent fraud and duplicate submissions, and keep an audit trail — legal obligation and legitimate interests.
• To improve the platform using aggregated or de-identified data — legitimate interests.
• To send marketing, only if you opt in — consent, which you can withdraw at any time.

We use automated tools, including AI, to explain, summarise and extract information for review by people. We do not make decisions about suitability or claims by automated means alone.

• Your broker of record, to advise you and arrange and service your cover.
• The insurers your broker approaches for your request — only what they need to quote and underwrite.
• The payment provider, to process your payment to the insurer.
• Service providers who host and operate our systems (for example cloud hosting, messaging and email), under contracts requiring confidentiality and security.
• Regulators, law enforcement or courts, where the law requires it.

We do not sell your personal data. We never submit the same risk to the same insurer twice.

Some of our service providers may store or process data outside Ghana. Where they do, we put safeguards in place as required by Act 843, such as contractual commitments and security controls. Details of these safeguards are to be confirmed before launch.

We keep personal data only as long as needed for the purposes above and to meet legal, regulatory and insurer record-keeping requirements — generally for a number of years after your last policy ends or your request closes (the number of years is to be confirmed before launch), unless a longer period is required by law or for an ongoing claim or complaint. Unsubmitted drafts are deleted after a number of days to be confirmed before launch.

Under Act 843 you have the right to:

• be told what personal data we hold about you and receive a copy;
• ask us to correct inaccurate or incomplete data;
• ask us to delete data or stop processing it, subject to legal retention rules;
• object to processing for direct marketing at any time;
• withdraw consent where we rely on it;
• complain to the Data Protection Commission.

To exercise your rights, use the privacy settings in your account or email support@covva.com.gh. We will respond within a number of days to be confirmed before launch.

We use encryption in transit and at rest, role-based and organisation-scoped access controls, multi-factor authentication for staff, and a tamper-evident audit trail of access to customer records. We test our controls regularly and will notify you and the Data Protection Commission of a breach where required.

See our cookie notice.

We will update this notice when our practices change and show the version at the top. If changes are significant, we will tell you before they take effect.