Privacy Policy

"Personal data" means information relating to an identified or identifiable natural person, whether directly (e.g. name, phone number) or indirectly (e.g. an online identifier, device ID, or location data).

"Processing" means any operation performed on personal data, including collection, storage, use, disclosure, or deletion.

"Data Controller" means the entity that determines the purposes and means of processing personal data : Mobi Biz, in respect of data collected via mobibiz.org and our own client relationships.

"Data Processor" means an entity that processes personal data on behalf of a controller : for example, Mobi Biz acting on behalf of a client that owns an end-customer relationship.

"Data Subject" means the individual to whom personal data relates.

"Sensitive personal data" has the meaning given in the DPA, including data relating to race or ethnic origin, health, religion, political opinion, trade union membership, genetic/biometric data, or an individual's sex life.

Mobi Biz is the data controller responsible for personal data processed through mobibiz.org and our direct client engagements.

Where Mobi Biz processes end-customer data on behalf of a business client (for example, when deploying a Respond.io WhatsApp chatbot for that client), the client remains the data controller for that data and Mobi Biz acts as data processor under a signed Data Processing Addendum.

In line with sections 19 to 24 of the DPA, we only process personal data where at least one of the following legal grounds applies:

• You have given consent for a specific purpose (e.g. opting in to receive WhatsApp messages);
• Processing is necessary to perform a contract with you or to take steps at your request before entering into one;
• Processing is necessary to comply with a legal obligation to which Mobi Biz is subject;
• Processing is necessary for our legitimate business interests (e.g. website security, service improvement), provided this does not override your rights and freedoms; or
• Processing is necessary to protect your vital interests or those of another person.

Sensitive personal data is processed only where the DPA permits : typically with your explicit consent and with additional safeguards.

Consistent with sections 19 to 25 of the DPA, Mobi Biz processes personal data:

• Lawfully, fairly and transparently;
• For specified, explicit and legitimate purposes only (purpose limitation);
• To the minimum extent adequate and relevant (data minimisation);
• Accurately, with reasonable steps to correct or erase inaccurate data;
• For no longer than necessary for the purpose collected (storage limitation); and
• With appropriate technical and organisational security (integrity and confidentiality).

Mobi Biz is responsible for, and able to demonstrate, compliance with these principles (accountability, DPA s.25).

We do not knowingly collect more personal data than is necessary for the stated purpose, and we do not collect sensitive personal data unless a client engagement specifically and lawfully requires it.

• Operating and maintaining mobibiz.org and responding to enquiries;
• Providing, configuring and supporting our omnichannel messaging and chatbot services;
• Managing contracts, invoicing and account administration;
• Sending service updates, and with consent marketing communications, which you may opt out of at any time;
• Monitoring, securing and improving our website and services, including fraud and abuse prevention;
• Complying with legal, regulatory, tax and audit obligations.

We do not use automated decision-making that produces legal or similarly significant effects on data subjects without human review.

We do not sell personal data. We may share personal data with:

• Respond.io / Rocketbots Limited : our messaging platform provider, which processes messaging data on our and our clients' behalf under its own Data Processing Agreement;
• Cloud hosting, IT and security service providers who support our infrastructure;
• Professional advisers (auditors, lawyers, accountants) where necessary;
• The Information and Data Protection Commission or other authorities, where required by law; and
• A business client, where Mobi Biz processes that client's end-customer data on its behalf (data flows to the client as controller).

All third parties who process personal data on our behalf are bound by written data processing agreements requiring them to protect the data and use it only as instructed.

Some of our service providers (including Respond.io/Rocketbots, cloud hosting and analytics providers) process data outside Botswana. Where personal data is transferred outside Botswana, Mobi Biz ensures the receiving country or organisation provides an adequate level of protection, or that appropriate safeguards such as standard contractual clauses, binding data processing agreements, or your explicit consent are in place, in accordance with the cross-border transfer requirements of the DPA.

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, to meet contractual commitments, or to comply with legal, tax and regulatory retention obligations. Website server logs are retained for a limited period (typically up to 30 days) for security purposes. Chat and messaging records are retained for the duration of the client engagement plus any period required by the client's own retention policy or applicable law, after which data is securely deleted or anonymised.

Mobi Biz implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include encryption of data in transit, access controls, staff confidentiality obligations, and regular review of our security posture. In the event of a personal data breach likely to result in risk to data subjects, we will notify the Information and Data Protection Commission and affected data subjects as required by the DPA.

Under Part VIII of the DPA, you have the right to:

• Be informed about how your personal data is processed;
• Access the personal data we hold about you;
• Request correction (rectification) of inaccurate or incomplete data;
• Request erasure of your personal data in certain circumstances;
• Object to processing carried out for certain purposes, including direct marketing;
• Restrict processing in certain circumstances;
• Request a copy of your personal data in a portable format, where applicable;
• Withdraw consent at any time, without affecting processing carried out before withdrawal; and
• Not be subject to a decision based solely on automated processing that significantly affects you, without the right to human intervention.

To exercise any of these rights, contact us at dataprivacy@mobibiz.org. We will respond within the timeframes required by the DPA. We may need to verify your identity before actioning a request.

Our website and services are not directed at children, and we do not knowingly collect personal data from individuals under the age of 18 without appropriate parental or guardian consent.

mobibiz.org uses cookies and similar technologies to operate the site, remember preferences, and analyse traffic. You can manage or disable cookies through your browser settings; doing so may affect site functionality.

If you believe we have not handled your personal data in accordance with this policy or the DPA, please contact us first at dataprivacy@mobibiz.org so we can investigate. You also have the right to lodge a complaint with Botswana's Information and Data Protection Commission.

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or the law. The "Effective date" above indicates when it was last revised. Material changes will be communicated through the website or, where appropriate, directly to affected data subjects.