Privacy Policy

1. Introduction

Kopano ("we," "our," or "us") is committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and applicable data protection laws in Botswana. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

By using Kopano, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

2. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Consent: Where you have given clear consent for us to process your personal data for specific purposes
• Contract: Where processing is necessary for the performance of a contract with you
• Legal Obligation: Where we need to comply with a legal obligation
• Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party
• Vital Interests: Where processing is necessary to protect someone's life
• Public Task: Where processing is necessary to perform a task in the public interest

3. Information We Collect

2.1 Personal Information

We collect information you provide directly to us, including:

• Name and surname
• Email address
• Phone number
• Physical address
• Omang (National ID) number (for business verification only)
• Business registration details
• Payment information (processed securely through third-party providers)

2.2 Automatically Collected Information

When you use our platform, we automatically collect:

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, time spent, clicks)
• Location data (with your permission)
• Cookies and similar tracking technologies

4. How We Use Your Information

We use the collected information for:

• Providing and maintaining our services
• Processing transactions and payments
• Verifying business ownership and authenticity
• Communicating with you about your account and services
• Sending promotional communications (with your consent)
• Improving our platform and user experience
• Complying with legal obligations
• Preventing fraud and ensuring platform security

5. Information Sharing and Disclosure

We do not sell your personal information. We may share your information with:

• Service Providers: Third parties who help us operate our platform (hosting, payment processing, analytics)
• Business Partners: When you interact with businesses on our platform
• Legal Requirements: When required by Botswana law or to protect our rights
• Business Transfers: In connection with any merger, acquisition, or sale of assets
• With Your Consent: When you explicitly agree to sharing

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of sensitive data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication procedures
• Employee training on data protection
• Secure data centers with physical security measures

7. Your Rights Under GDPR

Under the GDPR and Botswana data protection principles, you have the following rights:

• Right of Access (Article 15): Request a copy of your personal data and information about how we process it
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete personal data
• Right to Erasure (Article 17): Request deletion of your personal data ("right to be forgotten")
• Right to Restriction (Article 18): Request restriction of processing in certain circumstances
• Right to Data Portability (Article 20): Receive your data in a structured, commonly used, and machine-readable format
• Right to Object (Article 21): Object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent
• Right to Lodge a Complaint: File a complaint with a supervisory authority
• Rights Related to Automated Decision Making (Article 22): Not to be subject to decisions based solely on automated processing

8. Children's Privacy

Our services are not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

9. International Data Transfers

Your information may be transferred to and processed in countries other than Botswana. When we transfer data outside the European Economic Area (EEA) or Botswana, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions where applicable
• Your explicit consent for specific transfers
• Other appropriate safeguards as required by GDPR Article 46

Your information may be transferred to and processed in countries other than Botswana. We ensure appropriate safeguards are in place to protect your information and comply with applicable data protection laws.

10. Cookies Policy

We use cookies and similar tracking technologies to:

• Remember your preferences and settings
• Authenticate users and prevent fraud
• Analyze platform usage and performance
• Provide personalized content and advertisements

You can manage cookie preferences through your browser settings. Note that disabling cookies may affect platform functionality.

11. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations. Our retention periods are:

• Account Information: Active account duration plus 30 days after deletion request
• Transaction Records: 7 years for tax and accounting purposes
• Marketing Data: Until consent is withdrawn or 3 years of inactivity
• Technical Logs: 90 days for security and performance monitoring
• Legal Hold Data: As required by applicable laws or legal proceedings

When retention periods expire, we will delete or anonymize your personal information using secure deletion methods.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
• Notify you without undue delay if the breach is likely to result in a high risk to your rights
• Document all breaches and actions taken
• Take immediate steps to mitigate any damage

13. Privacy by Design and Default

We implement privacy by design and by default principles:

• Data minimization - we only collect data necessary for specified purposes
• Purpose limitation - we only use data for stated purposes
• Privacy-enhancing technologies including encryption and pseudonymization
• Regular privacy impact assessments for new features
• Default privacy settings that protect your data

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Effective Date." Your continued use of Kopano after changes constitutes acceptance of the updated policy.

15. Contact Information

If you have questions or concerns about this Privacy Policy, please contact us:

16. Regulatory Compliance

This Privacy Policy is designed to comply with:

• General Data Protection Regulation (GDPR) - EU 2016/679
• Botswana Data Protection Act (when enacted)
• Other applicable international data protection laws

We are committed to working with regulatory authorities to ensure the protection of your personal data and maintain compliance with all applicable laws.