The personal data collected depends on the service or process being used. BOTC collects personal data that is necessary, relevant and limited to the stated purpose.

BOTC does not intentionally collect sensitive personal data unless it is necessary, lawful and proportionate for a specific purpose. Where sensitive personal data is required, BOTC will identify the lawful basis, limit collection to what is necessary and apply appropriate safeguards. Data subjects should not submit unnecessary sensitive personal data unless specifically requested for a lawful purpose.

How We Collect Personal Data

• Directly from you when you complete forms, use OPMS, submit applications, send enquiries, attend events, apply for vacancies, register as a vendor, complete surveys, communicate with BOTC or interact or engage with BOTC in any form.
• From your organisation, employer, principal, agent, authorized representative, referee or nominating body where they submit information on your behalf or identify you as a contact person or representative.
• From third-party platforms and service providers, including recruitment platforms, payment providers, cloud hosting providers, email/SMS service providers, identity/company verification sources and ICT support providers.
• From government or regulatory sources where necessary for identity, company, customs, licensing, compliance, verification or statutory/public function purposes.
• Automatically through technical means such as cookies, logs, IP addresses, timestamps, session information, audit trails, security monitoring and platform usage records.

BOTC only shares personal data where necessary and lawful. Recipients may include authorised BOTC staff, Board of Directors, Board Committee members who require access for official duties; government agencies, regulators, customs/tax authorities, courts, law enforcement or oversight bodies where required by law; and third-party service providers such as hosting providers, payment providers, recruitment platforms, ICT support providers, email/SMS providers, auditors and professional advisers.

For OPMS, recipients may include BURS, PayGate, Hostinger, Omang verification, CIPA or other approved integration partners where applicable as well professional advisors (i.e. Lawyers, and auditors). For recruitment, recipients may include referees, Agencies recognized in terms of the Employment Act, assessment providers, background screening providers and hiring panel members and professional advisors. For contractors and vendors, recipients may include financial institutions, payment processors, auditors, insurers, legal advisors, tax authorities, regulators and ICT/security providers.

BOTC requires third parties processing personal data on its behalf to apply appropriate confidentiality, security, incident notification, retention, return/deletion and data protection obligations.

BOTC personal data may be processed, hosted, accessed, supported, backed up or transferred outside Botswana where this is necessary for cloud hosting, ICT support, payment processing, recruitment platforms, email/SMS services, system integrations, professional services, disaster recovery or other lawful business/public function purposes.

Where personal data is transferred outside Botswana, BOTC will take reasonable steps to ensure that the transfer is documented and protected through appropriate safeguards, which may include contractual data protection obligations, access controls, encryption, confidentiality obligations, auditability, incident notification requirements, data return/deletion obligations and assessment of applicable legal transfer requirements. Where applicable, BOTC will assess whether a local copy of relevant personal data must be maintained in Botswana and how this will be achieved.

BOTC retains personal data only for as long as necessary to:

• fulfil the purpose for which it was collected;
• comply with legal, regulatory, audit, financial, employment, procurement and records management obligations;
• resolve disputes, support investigations, enforce agreements, establish, exercise or defend legal claims.

Different retention periods may apply to OPMS applications, supporting documents, payment records, audit logs, backups, recruitment records, vendor records, Human Resource records, event records, survey responses and website logs. Once the applicable retention period has expired, and where there is no lawful basis for continued retention, BOTC will securely delete, archive, anonymise or dispose of the personal data in accordance with approved records management and ICT secure disposal procedures.

BOTC applies appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, misuse, unauthorized disclosure. Depending on the system or process, these measures may include:

• role-based access control and least privilege access; authentication and password controls, including stronger controls for privileged users;
• HTTPS/TLS encryption for data in transit and secure configuration where applicable; database, server, cloud, firewall and network security controls;
• Pseudonymization and anonymisation of personal data where appropriate, particularly for reporting, testing, analytics, extracts or other uses where direct identification is not necessary;
• audit logging and monitoring of user, administrator and system activity; backup, recovery and disaster recovery procedures;
• vulnerability management, patching, malware/rootkit monitoring and application security testing where applicable;
• segregation of duties, access reviews, secure deprovisioning, incident detection, escalation, investigation and breach management procedures; and
• confidentiality and data protection obligations for BOTC staff, Board of Directors and Board Committee members, contractors and service providers.

Users should protect their credentials, avoid submitting unnecessary personal data and ensure that documents uploaded to BOTC systems are accurate, relevant and lawful to submit.

BOTC websites and digital platforms, including OPMS, may use cookies and similar technologies to enable secure sign-in, maintain sessions, store preferences, protect platforms, monitor performance, compile usage statistics and improve user experience. Strictly necessary cookies are required for the website or portal to function securely and correctly. Performance, functionality, analytics or targeting cookies, where used, should be optional unless they are strictly necessary.

BOTC systems may use automated workflow routing, validation rules, reference number generation, notifications, dashboards, reporting and audit logging to support administration and service delivery. BOTC does not intend to make decisions based solely on automated processing or profiling that produce legal or similarly significant effects without appropriate human review. If such processing is introduced in future, BOTC will assess the privacy impact, identify the lawful basis, provide appropriate notice and implement safeguards.

Subject to applicable law, the purpose of processing and any lawful limitations, you may have the right to:

• request access to personal data held about you;
• request correction of inaccurate or incomplete personal data;
• request deletion or erasure of personal data where there is no lawful basis for continued retention;
• request restriction of processing in specific circumstances;
• object to certain processing activities where applicable;
• request portability of personal data where applicable;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;
• not be subject to decisions based solely on automated processing where such decisions produce legal or similarly significant effects; and
• lodge a complaint with the Information and Data Protection Commission where you believe your data protection rights have been infringed.

Some rights may be limited where BOTC is required to process or retain information for statutory, regulatory, audit, financial, employment, security, legal or public interest purposes. Where a limitation applies, BOTC will explain the reason where it is lawful and appropriate to do so.

If BOTC intends to process personal data for a new purpose that is not compatible with the original purpose for which it was collected, BOTC will identify a valid legal basis and provide additional information or notice where required before such further processing takes place.

BOTC may update this Data Privacy Notice from time to time to reflect changes in law, regulatory requirements, systems, services, collection points, third-party providers, security controls, operational processes or data protection practices. The most current version should be made available through appropriate BOTC channels, including the BOTC website and, where relevant, OPMS or other portals.

If you are not satisfied with how we handle your data, we encourage you to first contact BOTC so that we can review and respond to your concern. You also have the right to lodge a complaint with the Information and Data Protection Commission where you believe your data protection rights have been infringed.