Back to home

Data protection policy

[Company legal name] ("Zero Entry", "we", "us") Effective date: [effective date] Version: 1.0 (draft for legal review)

1. Purpose

This policy sets out how Zero Entry collects, uses, stores and protects personal information, and how it meets its obligations under the Data Protection Act, 2018 of Botswana and any regulations made under it. It applies to all personal information we process, whether about our users, their customers, our employees, or third parties.

2. Scope

This policy applies to every director, employee, contractor and agent of Zero Entry, and to all personal information processed by the platform on behalf of our users. Users of the platform remain the controllers of the financial and customer data they upload; Zero Entry processes that data on their instruction.

3. Definitions

  • Personal information means information about an identifiable individual.
  • Processing means any operation performed on personal information, including collection, storage, use, disclosure and deletion.
  • Data subject is the individual the information is about.
  • Controller decides why and how personal information is processed.
  • Processor processes personal information on behalf of a controller.

4. Principles

We process personal information in line with the following principles.

  1. Lawfulness and fairness. We process personal information only where we have a lawful basis, such as consent, performance of a contract, a legal obligation, or a legitimate interest that is not overridden by the individual's rights.
  2. Purpose limitation. We collect personal information for specified, explicit purposes and do not use it in a way incompatible with those purposes.
  3. Minimisation. We collect only what is necessary for the stated purpose.
  4. Accuracy. We take reasonable steps to keep personal information accurate and up to date.
  5. Storage limitation. We keep personal information only for as long as it is needed, or as required by law.
  6. Integrity and confidentiality. We protect personal information with appropriate technical and organisational measures.
  7. Accountability. We can demonstrate our compliance with these principles.

5. What we collect and why

  • Account information (name, email, business name, contact details), to create and administer accounts.
  • Financial documents uploaded by users (invoices, receipts, bank statements) and the data extracted from them, to provide the accounting service.
  • Customer and supplier information contained in those documents, processed on behalf of the user as controller.
  • Usage and technical information (log data, device and browser information), to secure and improve the service.
  • Billing information, to process subscriptions and payments.

6. Lawful basis

We rely on performance of a contract to provide the service, consent where required (for example marketing communications), legal obligation for tax and regulatory records, and legitimate interest for security and service improvement.

7. Sharing and disclosure

We do not sell personal information. We share it only with:

  • service providers who process data on our behalf under written agreements (for example hosting, payment processing and document extraction), bound to confidentiality and security obligations no less protective than this policy;
  • authorities, where required by law or valid legal process; and
  • a successor entity in the event of a merger or acquisition, subject to this policy.

8. Cross border transfer

Where personal information is processed or stored outside Botswana, we take steps to ensure it receives a level of protection consistent with the Data Protection Act, including contractual safeguards with the receiving party.

9. Security

We apply technical and organisational measures appropriate to the risk, including access controls, encryption in transit, segregation of client data, and regular review. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect information against unauthorised access, loss and misuse.

10. Data subject rights

Subject to the Act, individuals may request access to their personal information, correction of inaccurate information, deletion where there is no lawful reason to retain it, and objection to certain processing. Requests should be sent to the contact in section 13. We respond within the period required by law.

11. Retention

We retain personal information for the life of the account and for any further period required by tax and company law, after which it is deleted or anonymised. Users may export or request deletion of their data subject to those legal retention requirements.

12. Breach handling

If a personal data breach occurs that is likely to cause harm, we will assess it, contain it, notify the relevant authority and affected individuals where required by law, and record the incident and our response.

13. Contact and complaints

Data protection queries and requests: [DPO or data protection contact], [email], [phone]. Individuals also have the right to complain to the supervisory authority established under the Data Protection Act.

14. Review

This policy is reviewed at least annually and when the law or our processing changes.