General Privacy Notice

1 Personal Data

Personal data refers to any information relating to an identified or identifiable natural person.

An identifiable natural person is one who can be identified directly or indirectly by reference to a name, identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

2 The Personal Data We Collect and Why

LEA processes personal data for lawful and legitimate purposes related to fulfilling its statutory mandate and providing you with the services you require.

Depending on the processing activity, the Authority may rely on one or more of the following legal bases:

• Consent;
• Processing necessary for the performance of a contract;
• Processing necessary for compliance with a legal obligation;
• Processing necessary for the protection of vital interests;
• Processing necessary for the performance of a duty carried out in the public interest or in the exercise of official authority; and
• Legitimate interests.

Personal data processed by LEA may include:

• Personal details: Names, proof of identity such as Omang or passport, gender, date of birth, driver’s licence, next of kin and dependent information, and marital status.
• Contact information: Phone number, physical address, postal address and email address.
• Online information: Cookie data and IP address.
• Miscellaneous information: ITC clearance and tax clearance, where applicable.

3 How We Use Your Information

The personal data collected from you is used to enable the Authority to provide the services you require.

Your personal data may also be used for statistical analysis, research and record-keeping purposes.

Should your personal data be used for a purpose other than those stated in this Notice, you will be informed.

In adherence to the principles of processing set out in the Data Protection Act, 2024, the Authority will:

• Process your personal data in a lawful, fair and transparent manner;
• Use your data only for the stated purpose;
• Request only the personal data required to provide you with the relevant services;
• Take reasonable measures to ensure that personal data collected is accurate and kept up to date;
• Retain your personal data only for as long as necessary; and
• Ensure that your personal data is appropriately protected.

4 How the Authority Secures Your Personal Data

LEA will take appropriate and reasonable technical and organisational measures to protect clients’ personal data in line with industry best practices.

The Authority’s physical, technological and procedural safeguards will be appropriate and reasonable. These measures include:

1. Keeping the Authority’s systems secure, including monitoring access and usage;
2. Storing records securely;
3. Controlling access to premises, systems and records; and
4. Safely destroying or deleting records.

Where the Authority engages a data processor, the Authority will ensure that the processor is contractually obligated to apply appropriate security practices.

5 How the Authority Shares Your Personal Data

Your personal data may be processed, stored, shared, transferred or disclosed by LEA to third parties for the purposes outlined in this Privacy Notice.

This may be necessary to operate effectively and securely, facilitate transactions, deliver services, enhance business operations and comply with legal or regulatory obligations.

Such processing may involve cross-border transfers to jurisdictions that may not have data protection laws equivalent to those in Botswana. Your personal data may be transferred for storage or processing on behalf of the Authority.

In these circumstances, LEA will take reasonable steps to ensure that your personal data is subject to appropriate safeguards and an adequate level of protection in accordance with applicable data protection legislation.

Where applicable, the Authority may share your personal data with:

1. Local or international stakeholders and buyers for the provision of business opportunities;
2. Cloud service providers for the secure storage and processing of personal data; and
3. The Ministry of Trade and Entrepreneurship for reporting purposes.

6 How Long the Authority Keeps Your Personal Data

The Authority will keep clients’ personal data for as long as:

1. The law requires the Authority to retain it;
2. A contract between the client and the Authority requires LEA to retain it;
3. The client has consented to the Authority retaining it;
4. The Authority requires it to achieve the purposes listed in this Notice;
5. The Authority requires it for statistical or research purposes; or
6. The Authority requires it for lawful business purposes.

7 Your Rights and Duties Regarding Personal Data

Clients may be required to provide the Authority with proof of identity when exercising the rights stated below.

Subject to permissible legal limitations and restrictions, you have the right to:

1. Access your personal data;
2. Request rectification or correction;
3. Request the deletion of your personal data under certain circumstances;
4. Restrict the processing of your personal data;
5. Object to the processing of your personal data;
6. Withdraw your consent to processing;
7. Exercise the right to data portability;
8. Request information about how the Authority processes your personal data; and
9. Lodge a complaint with the Information and Data Protection Commission.

Your responsibilities

You must inform the Authority of any changes to your personal data as soon as reasonably possible.

If you provide the Authority with personal data about another person, such as a next of kin, beneficiary or emergency contact, you confirm that you have their permission to do so.

The Authority will process such data in accordance with applicable data protection laws and regulations and only for lawful purposes. These may include managing your account, fulfilling contractual obligations, complying with legal or regulatory requirements, or contacting someone in an emergency.

To exercise your data privacy rights, please request a Data Subject Request Form through the contact details provided below.

Contact Details