Privacy Policy

1. Introduction

RORO Strategic Holdings Ltd (“RORO”, “we”, “us”, or “our”) is committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard information when you visit our website at rorostrategicholdings.com (the “Site”), submit enquiries through our contact form, subscribe to our newsletter, complete our investor qualification process, or request access to group documentation through our investor relations pages.

This policy is intended to comply with the principles of the Ghana Data Protection Act, 2012 (Act 843) and applicable electronic communications and data-protection requirements. Please read it carefully. If you disagree with its terms, please discontinue use of the Site.

2. Information We Collect

The categories of personal information we collect depend on how you interact with the Site. We collect only what is reasonably necessary for the purposes described in this policy.

2.1 General contact enquiries

When you submit an enquiry through our contact page, we collect first name, last name, email address, organisation (if provided), enquiry subject/category (such as strategic partnership, business partnership, portfolio company, media, or other), and message content. Your message may include additional commercially sensitive information you choose to provide (for example, project scope, budget, or timeline) even though those fields are not separately structured on the form.

2.2 Investor qualification and document-access data

Investor and document-access data is more sensitive than ordinary contact data. When you use our investor qualification gate, document request forms, or related investor relations pages, we may collect:

• Identity and contact details: full name, email address, organisation, and role or title.
• Qualification information: country or jurisdiction, partner or investor type, and your attestations regarding eligibility, confidentiality, and issuer acknowledgment.
• Investment mandate data: optional brief mandate or area-of-interest descriptions you provide in document requests.
• Document request data: specific materials requested, qualification session reference, and timestamps of submission.
• NDA and document-room workflow data: records of NDA status, verification steps, compliance review, secure-delivery arrangements, and document-access logs where applicable.
• Compliance-screening records: information generated or retained in connection with anti-money-laundering (AML), know-your-customer (KYC), sanctions-screening, or other investor-onboarding checks.
• Technical session data: browser user-agent information submitted with qualification forms, and a secure qualification-session cookie used to gate access to restricted materials.

2.3 Newsletter subscriptions

If you subscribe to RORO Insights, we collect your email address and, if provided, your first name.

2.4 Technical and usage data

• Usage data: information your browser or device sends when you visit the Site, including IP address, browser type, pages visited, referring URL, and approximate access times.
• Cookie and local-storage data: preferences such as cookie-consent choices, announcement-banner dismissal, and investor qualification session identifiers as described in Section 7.

3. How We Use Your Information

We use personal information for the following purposes:

• To respond to general enquiries, partnership requests, media requests, and portfolio-company introductions submitted through our contact form.
• To evaluate eligibility for access to restricted investor materials, manage confidentiality obligations, and administer our qualification, verification, NDA, and compliance review process.
• To process document requests, maintain document-access records, and coordinate secure delivery of materials to qualified parties.
• To satisfy legal, regulatory, and compliance obligations, including AML/KYC and sanctions-screening requirements applicable to prospective investors or strategic partners.
• To maintain business records, investor-relations correspondence, and audit trails for governance and diligence purposes.
• To send newsletter updates where you have subscribed.
• To improve, secure, and operate the Site.
• To protect our legal rights and respond to lawful requests from authorities.

We do not sell, rent, or trade your personal information to third parties for their independent marketing purposes.

4. Legal Basis for Processing

We process personal data on one or more of the following bases: (a) your consent, where explicitly given (including investor attestations and newsletter opt-in); (b) our legitimate interests in operating our business, responding to enquiries, managing investor relations, and protecting confidential group information; (c) performance of steps taken at your request prior to entering into a formal arrangement; and (d) compliance with legal obligations, including data-protection, corporate-governance, AML/KYC, and sanctions-screening requirements. Where processing is based on consent, you may withdraw it at any time, subject to legal or contractual restrictions and our need to retain certain records.

5. Cross-Border Sharing and Group Entities

RORO operates through a Ghana-based holding company with related U.S. group entities. We may share personal information with:

• RORO Strategic Holdings Ltd and its Ghana subsidiaries, where relevant to your enquiry or investor process.
• RORO Holdings Inc. and related U.S. group entities, where necessary to administer technology services, cross-border governance, investor coordination, or future ownership arrangements under formally documented terms.
• Professional advisers, legal counsel, compliance vendors, hosting providers, secure-document providers, and other service providers who assist us with investor onboarding, NDA execution, document delivery, AML/KYC screening, or website operations.
• Regulators, courts, or law-enforcement authorities where required by applicable law.

Where personal data is transferred outside Ghana, we take reasonable steps to ensure appropriate safeguards consistent with applicable law and the sensitivity of the information involved, particularly for investor and document-access records.

6. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes in this policy, unless a longer period is required or permitted by law. Indicative retention periods are:

• General contact enquiries: up to three (3) years from the date of submission, unless a longer period is needed to manage an active discussion or legal matter.
• Investor qualification records, document requests, NDA workflow data, document-access logs, and related compliance records: typically up to seven (7) years from the date of last relevant activity, or longer where required for legal, regulatory, AML/KYC, audit, or dispute-resolution purposes.
• Newsletter subscription data: until you unsubscribe or request deletion, subject to suppression-list retention needed to honour your opt-out.
• Technical logs and security records: for a limited operational period consistent with security and troubleshooting needs.

When information is no longer required, we take reasonable steps to delete, anonymise, or securely archive it.

7. Cookies and Similar Technologies

Our Site may use cookies, local storage, and similar technologies to support functionality, remember preferences, and manage access to restricted investor materials.

• Cookie-consent preference stored in your browser to record acceptance or decline of non-essential cookies.
• Investor qualification session cookie: a secure, HTTP-only cookie used to confirm completion of the qualification gate for access to restricted materials. This cookie does not by itself grant document delivery; verification and NDA steps remain required.
• Announcement and interface preferences stored locally in your browser.

You may instruct your browser to refuse cookies or alert you when cookies are sent. Some Site features, including access to restricted investor materials, may not function properly without certain cookies.

8. AML, KYC, and Compliance Screening

Because our investor relations process may involve prospective capital partners and restricted confidential materials, we may conduct or arrange identity verification, sanctions screening, politically exposed person checks, source-of-funds or source-of-wealth enquiries, and other AML/KYC due diligence before sharing restricted documentation or entering formal discussions. You may be asked to provide additional information directly to us or our professional advisers for these purposes. We use such information only for compliance, risk management, and investor-onboarding purposes.

9. Third-Party Service Providers

Our Site is hosted using modern web infrastructure and may rely on third-party providers for hosting, email delivery, secure document sharing, compliance screening, and related operational services. These providers may process technical or personal data solely to perform services on our behalf. We do not authorise service providers to use investor or contact data for their own unrelated marketing purposes.

10. Your Rights

Subject to applicable law, including the Ghana Data Protection Act, 2012 (Act 843), you may have the right to:

• Request access to the personal information we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your personal data, subject to legal, regulatory, and retention obligations (including investor, NDA, and compliance records we may be required to keep).
• Object to or request restriction of certain processing.
• Withdraw consent where processing is based on consent, without affecting the lawfulness of prior processing.
• Lodge a complaint with the Data Protection Commission of Ghana or another competent authority.

To exercise these rights, contact us using the details in Section 12. We may need to verify your identity before responding.

11. Security

We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, or destruction. Restricted investor materials are shared only after qualification, verification, and NDA steps, and delivery may be made through secure channels with access logging where practicable. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us through our contact page. For investor-document or qualification matters, include “Data Protection” or “Investor Data Request” in your message so we can route your request appropriately. We will respond within a reasonable timeframe.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, investor processes, legal requirements, or Site functionality. Changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.