PRIVACY POLICY

1. PERSONAL DATA COLLECTED

We may collect and process the following personal data:

1. Identity data – name, surname, ID/passport number, date of birth.
2. Contact data – address, email, phone number.
3. Transaction data – payments, purchases, services used.
4. Technical data – IP address, browser type, device identifiers, cookies.
5. Profile data – username, password, preferences, feedback.
6. Usage data – how you use our website, products, or services.
7. Sensitive personal data – only if strictly necessary and with your explicit consent. We will ask separately for such data.

We collect data when you:

1. Register an account
2. Make a purchase or request a service
3. Contact us (email, phone, form)
4. Use our website (via cookies)

2. LEGAL BASIS FOR PROCESSING

We process your personal data only when we have a lawful reason:

1. To perform a contract with you to deliver our service.
2. To comply with a legal obligation (e.g., tax, anti‑fraud laws)
3. For our legitimate interests not overridden by your rights.
4. Where you have given consent (e.g., marketing emails)
5. To protect your vital interests or those of another person

Consent: You may withdraw consent at any time (see Section 11 below). Withdrawal does not affect processing before withdrawal.

3. HOW WE USE YOUR PERSONAL DATA

We use your data to:

1. Provide, operate, and improve our products/services.
2. Process payments and transactions.
3. Communicate with you (updates, security notices, customer support).
4. Comply with legal and regulatory obligations.
5. Prevent fraud and enhance security.
6. Send marketing communications (only with your consent or as permitted by law).
7. Analyse usage to improve user experience.

4. DISCLOSURE OF YOUR PERSONAL DATA

We may share your data with:

1. Service providers (processors) – payment gateways, hosting, email delivery, IT support. They must contractually comply with the Data Protection Act 2024.
2. Legal or regulatory authorities if required by law or to protect our rights.
3. Third parties in connection with a merger, sale, or transfer of assets (with notice to you).
4. Joint controllers – where we collaborate with another organisation (we will inform you).

We do not sell your personal data. Any disclosure to a third country or international organisation follows the transfer rules under Part XIV of the Data Protection Act (e.g., adequacy decision, standard contractual clauses, or your explicit consent after being informed of risks).

5. DATA SECURITY

We implement appropriate technical and organisational measures to protect your data, including:

1. Encryption and pseudonymisation where feasible.
2. Access controls and secure servers.
3. Regular testing and assessment of security effectiveness.
4. Internal policies limiting access to authorised personnel.

Despite these measures, no transmission over the internet is completely secure.

6. DATA RETENTION

We keep your personal data only as long as necessary for the purpose it was collected, or as required by law. After that, we securely delete or anonymise it.

Retention periods:

Customer account data: 3 years after last activity

Transaction records: 5 years for tax purposes

7. YOUR RIGHTS

Under the Data Protection Act 2024, you have the following rights:

1. Right to be informed: You have the right to clear, transparent information about how we use your data (this Privacy Policy).
2. Right of access: You can request a copy of the personal data we hold about you, free of charge.
3. Right to rectification: You can ask us to correct inaccurate or incomplete data.
4. Right to erasure: You can ask us to delete your data in certain circumstances (e.g., data no longer needed, consent withdrawn, unlawful processing). Exceptions apply (legal obligations, legal claims, etc.).
5. Right to restriction of processing: You can ask us to limit processing while we verify accuracy, or if processing is unlawful but you oppose erasure.
6. Right to data portability: You can receive your data in a structured, machine‑readable format and have it transmitted to another controller (where processing is based on consent or contract and is automated).
7. Right to object: You can object to processing based on legitimate interests or public task (including profiling). You have an absolute right to object to direct marketing.
8. Right not to be subject to automated decision‑making: You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects, unless necessary for a contract, authorised by law, or based on your explicit consent (with human intervention).

How to exercise your rights

1. Contact us using the details in Section 1.
2. We will respond within one month (may be extended by two months for complex or numerous requests).
3. Most requests are free of charge, but we may charge a reasonable fee if requests are manifestly unfounded or excessive.

8. COOKIES & AUTOMATED DECISION‑MAKING

We use cookies and similar technologies for analytics, functionality, and advertising. You can manage cookie preferences via your browser settings.

Profiling / automated decisions:

We [do / do not] use automated decision‑making that produces legal or similarly significant effects. If we do, we will:

Notify you separately and obtain explicit consent where required.

Provide meaningful information about the logic, significance, and consequences.

Allow you to request human intervention, express your point of view, and contest the decision.

9. TRANSFERS OF DATA OUTSIDE BOTSWANA

If we transfer your personal data to a third country or international organisation, we ensure one of the following safeguards (Part XIV):

1. An adequacy decision by the Botswana Information and Data Protection Commission (the country/organisation provides an equivalent level of protection).
2. Appropriate safeguards (e.g., standard contractual clauses approved by the Commission, binding corporate rules).
3. A derogation (e.g., your explicit consent after being informed of the risks, performance of a contract, legal claims, vital interests).

For transfers based on your explicit consent, we will inform you of the possible risks.

10. YOUR CONSENT & WITHDRAWAL

Where processing is based on your consent (e.g., marketing, some cookies, sensitive data), you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

To withdraw consent, contact us (Section 1) or via email.

11. DATA BREACH NOTIFICATION

In the event of a personal data breach that poses a risk to the rights and freedoms of data subjects, we shall take immediate remedial action.

1. We shall notify affected individuals, and the Information and Data Protection Commission of Botswana as required under applicable law, within a reasonable timeframe following discovery of the breach.
2. Notification to affected individuals shall include: (a) a description of the nature of the breach; (b) the categories and approximate number of data subjects affected; (c) the likely consequences of the breach; and (d) the measures taken or proposed to address the breach.
3. BusLink shall not be liable for data breaches caused by the actions or negligence of third-party processors, operators, or users, provided BusLink has implemented reasonable technical and contractual safeguards.

12. COMPLAINTS

You have the right to lodge a complaint with the Information and Data Protection Commission (Botswana) if you believe we have violated the Data Protection Act 2024.

We would appreciate the chance to resolve your concern first, so please contact us initially.

13. CHANGES TO THIS PRIVACY POLICY

1. We may update this policy from time to time. Material changes will be notified via email or a prominent notice on our website. The “Effective Date” at the top indicates when the policy was last revised.
2. Continued use of the platform following publication of an updated Policy constitutes acceptance of the updated terms.

14. CONTACT US

For any questions, to exercise your rights, or to withdraw consent:

Data Controller: ALORACRAS SOLUTIONS
Email: buslinkbw@gmail.com
WhatsApp: +267 75 244 248
Location: Gaborone, Botswana