Privacy Policy

1. Introduction

YIFAN Business Services LTD ("Yifan", "we", "us") is a travel agency registered in Ghana. We collect personal data to book flights, hotels, transfers, and visas on behalf of our customers, and we are responsible for how that data is handled.

This policy explains what we collect, why we collect it, who we share it with, and the rights you hold. It is written to meet our obligations under Ghana's Data Protection Act, 2012 (Act 843), which is administered and enforced by the Data Protection Commission of Ghana.

By using our website or making a booking through us, you agree to the practices described here. If you do not agree, please do not provide your data, and contact us if you would like data we already hold deleted.

2. Information We Collect

We only collect what we need to fulfil your booking and run our service. Specifically:

• Identity and contact: full name, title, gender, and date of birth; nationality; email address and phone number; home or billing address (when required for payment).
• Travel and booking: passport number, expiry date, and country of issue (required by airlines and immigration to ticket international flights); frequent flyer programme membership numbers (only if you choose to add them); booking history, travel dates, and itineraries; special requests (dietary needs, mobility assistance, room preferences); co-passenger details that you provide when booking on someone else's behalf.
• Payment: payment for bookings made through our booking engine at yifan.amadeusonlinesuite.com is processed by a third-party payment provider. We receive only the transaction reference, the amount, and the success or failure status. We do not see, store, or have access to your full card number, CVV, or mobile money PIN. No payments are taken on this website.
• Technical and usage: IP address, browser type, device type, and operating system; pages visited on our website and the time of the visit; authentication session cookies set when you sign in to our booking engine (this website itself does not use accounts or sign-in).
• Communications: messages and enquiries you send us via our contact form, WhatsApp, email, or phone.

3. Our Lawful Basis for Processing

Under the Data Protection Act 2012 we must have a lawful reason to process your personal data. We rely on the following bases:

• Contract performance: we need your details to book and deliver the flight, hotel, transfer, or visa service you have asked us for.
• Legal obligation: we are required to retain certain booking and financial records under Ghanaian tax, anti-fraud, and immigration law.
• Legitimate interest: to operate our business safely, including preventing fraud, securing our systems, and improving service quality.
• Your consent: where required by law (for example, marketing communications). You can withdraw consent at any time.

4. How We Use Your Information

• Search and book flights, hotels, transfers, and visas on your behalf
• Issue tickets, vouchers, and booking confirmations
• Process payments and refunds, and resolve disputes
• Communicate with you about your bookings and respond to enquiries
• Maintain your account on our booking engine, including saved traveller profiles
• Comply with legal, tax, and regulatory requirements
• Protect our website, our booking engine, and our customers from fraud and abuse
• Send marketing emails only if you have opted in (you can opt out at any time)

5. How We Share Your Information

We do not sell your personal data. We do not rent it. We do not share it for advertising.

We share data only with the parties we genuinely need to in order to deliver your booking and run our service:

• Travel suppliers: airlines, hotels, transfer operators, and visa authorities receive the booking details they need to honour your reservation.
• Technology and infrastructure providers: hosting, database, payment processing, and email delivery providers that operate our systems, including our booking engine. See section 6 below for the international transfer disclosure.
• Government authorities: when required by law (court order, tax audit, immigration enquiry).
• Professional advisers: lawyers, auditors, or insurers, where strictly necessary and under a duty of confidentiality.

6. International Data Transfers

We rely on a small number of established technology and infrastructure providers to deliver bookings, process payments, send confirmations, and host our website. Some of these providers operate from outside Ghana, which means your personal data may be transferred internationally as part of delivering your booking.

We only work with providers who offer protections we consider adequate under the Data Protection Act 2012, and we share only the minimum data each needs to do its job. If you do not wish your data to be transferred this way, we will not be able to complete your booking.

If you would like specific information about which providers we use and where they are based, please contact us at yifanbusinessservicesltd@gmail.com.

7. Sensitive Data We Handle

Some of the data we collect is more sensitive than ordinary contact details. We want you to know exactly what it is and how it is handled.

Passport details: passport number, expiry date, country of issue, and date of birth are required by airlines, hotels, and immigration authorities to issue tickets and process visas. We share these only with the specific supplier or authority your booking requires. We do not retain scanned copies of your passport unless you explicitly send one to us for a visa application.

Payment details: your full card number, CVV, expiry date, and mobile money PIN are entered into a payment form hosted by the third-party payment provider on our booking engine at yifan.amadeusonlinesuite.com. We never see, store, or process these directly. What we receive is a transaction reference and the success or failure status of the charge.

Health and dietary information: if you tell us about a medical condition, mobility need, or dietary requirement that affects your booking, we share it only with the specific supplier who needs to accommodate it (for example, telling the airline you need a wheelchair). We do not keep this data on your profile, and we do not use it for any other purpose.

8. Cookies and Tracking

This website (yifanbusinessgh.com) has no accounts or sign-in and sets no authentication cookies. Our booking engine at yifan.amadeusonlinesuite.com uses essential cookies, primarily the authentication session cookie set when you sign in there. We do not currently run third-party analytics, advertising trackers, or behavioural tracking on this website.

If we add analytics in future (for example, to understand which pages are most useful), we will update this policy and, where required, ask for your consent before any non-essential cookies are set.

You can clear cookies or block them in your browser settings. Blocking essential cookies on the booking engine will sign you out and prevent you from completing bookings there.

9. Data Security

We protect your data with practical safeguards:

• All connections to our website are encrypted in transit (HTTPS / TLS).
• Access to booking and customer records within our systems is restricted to the staff who need it to do their jobs, behind password-protected accounts.
• We never store full card numbers, CVVs, or mobile money PINs. Payment is handled directly by the third-party payment provider on our booking engine.

No system connected to the internet can be made perfectly secure. If a data breach affecting your personal information ever occurred, we would notify both you and the Data Protection Commission of Ghana, as required by the Act.

10. How Long We Keep Your Data

We only keep your data as long as we need it. Specifically:

• Account profile: for as long as you hold an account on our booking engine. You can request account closure at any time, and we will delete or anonymise your personal data within 30 days.
• Booking records: kept for up to 7 years after the date of travel. This is required by Ghanaian tax law and to handle late refund, insurance, or dispute enquiries.
• Payment transaction references: kept for up to 7 years to comply with anti-fraud and accounting requirements.
• Marketing consent: kept until you withdraw it, plus a short record of the withdrawal so we can prove you opted out.
• Website logs (IP address, page visits): kept for up to 90 days, then deleted.

11. Your Rights Under the Ghana DPA

The Data Protection Act 2012 gives you the following rights over your personal data. Each one is free to exercise, with limited exceptions for repeated or excessive requests:

• Right of access: to know what data we hold about you and receive a copy of it.
• Right to correction: to ask us to fix data that is wrong or incomplete.
• Right to erasure: to ask us to delete your data, subject to legal retention requirements above.
• Right to restrict processing: to ask us to stop using your data for specific purposes.
• Right to object: to object to processing based on legitimate interest or to direct marketing.
• Right to withdraw consent: for anything we relied on consent for, including marketing.
• Right to data portability: to receive a copy of your data in a structured, machine-readable format.
• Right to lodge a complaint: with the Data Protection Commission of Ghana if you believe we have mishandled your data.

To exercise any of these rights, email us at yifanbusinessservicesltd@gmail.com. We will respond within 30 days, as required by the Act.

If you are not satisfied with our response, you may contact: Data Protection Commission of Ghana, Accra, Ghana. Email: info@dataprotection.org.gh. Website: dataprotection.org.gh.

12. Children's Privacy

We do not offer accounts on our booking engine to anyone under 18. If a child travels on a booking made through us, the parent or legal guardian must make the booking and must provide the child's details. We only collect what is required to complete the ticket (name, date of birth, passport, nationality) and we treat that data with the same care as any other passenger's.

We rely on the date of birth you provide; we do not verify it against official documents. If we discover that an account belongs to someone under 18, we will close it and delete the associated data.

If you believe a child's data has been collected directly from them without parental consent, email us at yifanbusinessservicesltd@gmail.com and we will delete it within 7 days.

13. Changes to This Policy

We may update this policy from time to time, for example when we add a new sub-processor, when the law changes, or when we add a new product. Updates will be posted on this page with a new effective date at the top.

If a change materially affects your rights or the way we use your data, we will notify affected customers by email before it takes effect.

14. Contact Us

YIFAN Business Services LTD, Oak Court House No.2, Patrice Lumumba Street, Airport Residential Area, Accra, Ghana.

Email: yifanbusinessservicesltd@gmail.com

Phone: +233 25 714 0202 / +233 30 395 5728