1. Purpose of this document
This document explains what personal data Social Light collects about you, why we collect it, how we use it, who we share it with and what rights you have. It is intended to be read alongside our Terms and Conditions and is drafted for review against the Data Protection Act of Botswana and the guidance of the Information and Data Protection Commission.
2. Who is responsible for your data
Social Light is the data controller for the personal data described here. Where we process coverage data on behalf of a client organisation, that organisation is the controller and we act as its processor.
3. What we collect
Account and identity data: your first and last name, email address, telephone number, job title or position, and country.
Organisation data: the name of the organisation or agency you represent, your position within it, its contact details, and your confirmation that you are authorised to represent it.
Consent and compliance data: which version of each legal document you accepted, when you accepted it, and the IP address and browser user-agent recorded at the time. This is collected so that we can demonstrate that consent was properly obtained.
Billing data: the subscription plan applying to your organisation, payment records, and a tokenised reference to any saved payment card. We do not receive or store card numbers, card verification values or other sensitive card authentication data — those are entered directly with our payment provider.
Usage data: sign-in times, pages accessed, reports generated and exports taken, recorded for security, support and service-improvement purposes.
4. Why we collect it, and on what basis
We process account, organisation and billing data in order to perform our contract with you or your organisation, and to comply with legal and accounting obligations. We process consent records to comply with data protection law and to evidence that consent was given. We process usage data in our legitimate interests in keeping the Platform secure and working properly. Where we rely on your consent, you may withdraw it at any time as described below.
5. Who we share it with
We share personal data with service providers who help us run the Platform — including email delivery, cloud hosting and payment processing providers — under contracts that restrict their use of it. We share data with public authorities where we are legally required to. We do not sell personal data.
6. Transfers outside Botswana
Some of our service providers operate outside Botswana. Where personal data is transferred outside the country, we will take the steps required by the Data Protection Act to ensure it continues to be protected to an equivalent standard.
7. How long we keep it
We keep account data for as long as your account is active and for a reasonable period afterwards. We keep consent records for as long as needed to demonstrate compliance. We keep billing and payment records for the period required by tax and company law. We keep usage logs for a limited period appropriate to their security purpose.
8. Security
We apply technical and organisational measures appropriate to the risk, including access control, encryption of data in transit, organisation-level isolation of client data, and restriction of administrative access.
9. Your rights
Subject to the conditions and exceptions in the Data Protection Act, you have the right to be informed about how your data is used; to access the personal data we hold about you; to have inaccurate data corrected; to have data erased in defined circumstances; to object to or restrict certain processing; and to lodge a complaint with the Information and Data Protection Commission.
10. Withdrawing consent
Where we rely on your consent, you may withdraw it by contacting us. Withdrawal does not affect the lawfulness of processing carried out before it, and may mean we can no longer provide some or all of the service. Your withdrawal is recorded as a new consent record; earlier records are not deleted, because they are the evidence of what was agreed at the time.
11. Contact
To exercise a right, or to ask a question about this document, contact [email protected].