Primetel Pty Ltd t/a NConnect Botswana Privacy Policy

PRIMETEL T/A NCONNECT

COMPANY PRIVACY POLICY

Effective Date: [Insert Publication Date] Last Updated: [Insert Date]

1. INTRODUCTION

Primetel (Pty) Ltd, trading as NConnect (hereinafter referred to as "NConnect", "Primetel", "we", "us" or "our"), respects the privacy of its customers, website visitors, business partners and other individuals whose personal information we process.

This Privacy Policy explains how we collect, use, store, protect, disclose and otherwise process personal information in connection with our services and business operations.

NConnect provides internet connectivity, website hosting, business email hosting, domain-related services, business voice and VoIP, managed IT services, networking and other technology services.

We are committed to handling personal information responsibly and in accordance with applicable data protection and privacy laws, including the Botswana Data Protection Act, 2024, where applicable.

By using our website or services, you acknowledge that you have had the opportunity to read this Privacy Policy. Where consent is required by law for a particular processing activity, we will seek that consent separately.

2. SCOPE OF THIS POLICY

This Privacy Policy applies to personal information processed in connection with:

• NConnect's website and online customer portal.
• Customer registration and account management.
• Internet connectivity and telecommunications services.
• Website hosting and server hosting.
• Business email hosting.
• Domain registration and related services.
• Billing, invoicing and payment processing.
• Customer support and technical assistance.
• Network monitoring, security and service management.
• Business communications, enquiries and complaints.
• Recruitment or business relationships, where applicable.

This policy should be read together with our Terms and Conditions and any additional privacy notices or contractual terms applicable to a specific service.

3. PERSONAL INFORMATION WE COLLECT

Depending on the services you use and our relationship with you, we may collect and process the following categories of information.

3.1 Identity and Contact Information

This may include:

• Full name.
• Business or organisation name.
• Residential or business address.
• Service installation address.
• Email address.
• Telephone and mobile numbers.
• Customer account identifiers.
• Other information reasonably required to verify identity or manage an account.

3.2 Account and Subscription Information

This may include:

• Customer account details.
• Service subscriptions and selected packages.
• Service activation and expiry dates.
• Assigned service identifiers.
• Account status and service history.
• Customer support records.
• Information relating to service changes, suspension or termination.

3.3 Billing and Payment Information

This may include:

• Invoices and payment records.
• Amounts charged and outstanding balances.
• Payment dates and transaction references.
• Tax and accounting information.
• Refund and billing dispute records.

Payment card or banking information may be processed by an authorised payment provider where applicable. We do not intentionally collect or retain complete payment credentials unless necessary and legally permitted for the relevant service.

3.4 Technical and Network Information

When providing internet connectivity, hosting, email or other technical services, we may process technical information such as:

• IP addresses.
• Assigned network addresses and service identifiers.
• Connection timestamps and session records.
• Network traffic metadata required for service operation.
• Data usage and bandwidth consumption.
• Device, router or connection information where required for service delivery.
• DNS, firewall and security event logs where applicable.
• Authentication and access logs.
• Website server logs.
• Email delivery, routing and diagnostic information.
• Information relating to network faults, service performance and troubleshooting.

The precise information collected depends on the service, the technical systems involved and applicable legal requirements.

We seek to limit the collection and retention of personal information to what is reasonably necessary for legitimate business purposes and applicable legal obligations.

3.5 Website and Portal Information

When you visit our website or use our customer portal, we may collect:

• IP address and browser information.
• Device and operating system information.
• Login and access records.
• Pages visited and interactions with the portal.
• Session information and necessary cookies.
• Security and diagnostic information.

3.6 Customer Communications

We may retain information contained in emails, support tickets, telephone support records, complaints, service requests and other communications with NConnect where reasonably necessary to provide services, maintain records, investigate issues or meet legal obligations.

4. HOW WE COLLECT PERSONAL INFORMATION

We may collect personal information:

• Directly from you when you register, place an order or contact us.
• Through our customer portal and billing systems.
• During service installation, activation and support.
• Automatically through the operation of our networks, servers and security systems.
• From authorised payment providers and service partners.
• From authorised representatives acting on your behalf.
• From publicly available sources where lawful and relevant.
• Where required or permitted by applicable law.

Where personal information is obtained from another source, we will handle it in accordance with applicable legal requirements.

5. PURPOSES FOR PROCESSING PERSONAL INFORMATION

NConnect may process personal information for the following purposes:

5.1 Service Delivery

To provide, activate, maintain, manage and support internet connectivity, hosting, email, VoIP and other contracted services.

5.2 Customer Account Management

To create and administer customer accounts, verify account information, manage subscriptions and communicate service-related information.

5.3 Billing and Financial Administration

To generate invoices, process payments, reconcile accounts, manage refunds, address billing disputes and maintain appropriate accounting records.

5.4 Technical Support and Troubleshooting

To investigate faults, diagnose service problems, monitor performance, respond to support requests and restore affected services.

5.5 Network Security and Fraud Prevention

To detect and investigate unauthorised access, malware, spam, phishing, network abuse, fraud, cyber attacks and other security threats.

5.6 Legal and Regulatory Compliance

To comply with applicable laws, lawful requests, regulatory obligations, court orders and other binding legal requirements.

5.7 Service Communications

To notify customers about maintenance, outages, service changes, security incidents, invoices, renewals, expiry dates and other matters affecting their services.

5.8 Business Improvement

To assess service performance, troubleshoot recurring problems, improve reliability and develop or improve our services.

Where practicable, information used for analysis and reporting will be aggregated or otherwise handled to reduce unnecessary identification of individuals.

5.9 Marketing

Where lawful, we may use appropriate contact information to communicate relevant NConnect products, services and offers.

We will respect applicable consent requirements and provide a way to opt out of direct marketing communications where required by law.

Service notices, invoices, security alerts and other essential transactional communications are not treated as optional marketing messages merely because they are delivered electronically.

6. LEGAL BASIS FOR PROCESSING

Where required by applicable law, NConnect will identify an appropriate legal basis for processing personal information.

Depending on the circumstances, this may include:

• The performance of a contract or steps requested before entering into a contract.
• Compliance with a legal obligation.
• Consent provided by the individual.
• Legitimate interests pursued by NConnect or another party, where lawful and appropriately balanced against individual rights.
• Protection of vital interests or other grounds recognised by applicable law.

Where processing relies on consent, individuals may withdraw that consent subject to applicable law. Withdrawal does not invalidate processing lawfully carried out before the withdrawal.

Where a particular category of information requires additional protection, we will apply the safeguards required by law.

7. DISCLOSURE OF PERSONAL INFORMATION

NConnect does not sell customers' personal information as a commercial product.

We may disclose personal information where reasonably necessary and lawful to the following categories of recipients:

7.1 Service Providers

Authorised providers that support our operations, including data centres, hosting infrastructure providers, email delivery providers, payment processors, software vendors, technical support providers and other contracted suppliers.

7.2 Telecommunications and Network Partners

Upstream internet providers, interconnection partners and other telecommunications providers where information is necessary to establish connectivity, investigate faults, route traffic or deliver contracted services.

7.3 Professional Advisers

Lawyers, auditors, accountants, insurers and other professional advisers where necessary for legitimate business purposes.

7.4 Regulators and Public Authorities

Competent regulators, law enforcement authorities, courts or other public authorities where disclosure is required or permitted by applicable law.

7.5 Business Transactions

Where NConnect undergoes a merger, restructuring, acquisition or transfer of business operations, personal information may be disclosed to relevant parties where lawful and subject to appropriate safeguards.

We seek to limit disclosures to information reasonably necessary for the relevant purpose and to require appropriate confidentiality and security protections from recipients where applicable.

8. CUSTOMER PRIVACY AND ISP NETWORK INFORMATION

NConnect processes certain technical information to operate and secure its internet and telecommunications services.

Network and connection information may be required to:

• Establish and maintain customer connectivity.
• Assign and manage IP addresses and other network resources.
• Monitor network performance and service availability.
• Investigate faults and service complaints.
• Detect malicious traffic, abuse and security incidents.
• Manage capacity and prevent disruption to other customers.
• Meet applicable legal and regulatory obligations.

NConnect does not treat the provision of internet connectivity as unrestricted permission to access or use customers' private information.

Access to network records and other personal information will be limited to authorised personnel and legitimate operational, security or legal purposes.

Where content inspection or other specialised monitoring is used, it must be conducted in accordance with applicable law and the relevant service terms.

9. WEBSITE HOSTING AND BUSINESS EMAIL PRIVACY

Customers using website hosting and business email services may store or transmit personal information through NConnect's infrastructure.

NConnect may process relevant information as necessary to operate, maintain, secure and support these services.

Depending on the service arrangement, NConnect may act as a data controller for some processing activities and as a data processor when processing personal information on behalf of a customer.

Where NConnect acts as a data processor, the applicable customer agreement and data protection requirements will govern the processing.

Customers are responsible for ensuring that their use of hosting and email services complies with applicable law, including their own data protection obligations where they determine the purposes and means of processing personal information.

NConnect personnel must not access customer content except where authorised and reasonably necessary for service delivery, technical support, security, troubleshooting or compliance with applicable legal obligations.

10. COOKIES AND ONLINE TRACKING

Our website or customer portal may use cookies or similar technologies to support essential functions, maintain login sessions, protect account security and improve the user experience.

Where optional analytics or marketing technologies are used, we will apply the consent and notice requirements applicable to those technologies.

Users may be able to control cookies through their browser settings. Disabling essential cookies may affect the operation of certain website or portal functions.

Further details may be provided through a separate cookie notice where appropriate.

11. INFORMATION SECURITY

NConnect recognises the importance of protecting personal information against unauthorised access, disclosure, alteration, loss or destruction.

Depending on the service and associated risks, security measures may include:

• Access controls and restricted administrative privileges.
• Authentication and password protection.
• Encryption where appropriate and supported.
• Network security controls and firewalls.
• Monitoring of relevant security events and system logs.
• Software updates and vulnerability remediation.
• Secure handling of customer information.
• Staff confidentiality and access procedures.
• Backup and recovery measures where provided.
• Incident investigation and response procedures.

Security measures are reviewed and adjusted as reasonably necessary, taking into account the nature of the information, the risks involved and available technical and organisational safeguards.

No internet-connected system or electronic transmission method can be guaranteed to be completely secure.

12. CYBERATTACKS AND PERSONAL DATA BREACHES

Despite reasonable security measures, personal information may be affected by hacking, malware, ransomware, phishing, unauthorised access, system failures, human error or other security incidents.

NConnect will assess suspected personal data breaches and take reasonable steps to contain, investigate and remediate incidents affecting information under its responsibility.

Where notification is required by applicable law, NConnect will notify the relevant authority and affected individuals in accordance with the applicable legal requirements.

Customers must promptly notify NConnect if they become aware of a security incident affecting their NConnect account or service.

Where a customer controls personal information stored on NConnect infrastructure, the customer may have separate obligations relating to incident assessment and notification.

13. DATA RETENTION

NConnect retains personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal, regulatory, contractual and operational requirements.

Retention periods may depend on the type of information and its purpose, including:

• Customer account and service records.
• Invoices, payment records and accounting information.
• Network and security logs.
• Technical support records.
• Email and website hosting records.
• Complaint and dispute records.
• Information required for legal proceedings or regulatory compliance.

Different categories of information may have different retention periods.

When personal information is no longer required, NConnect will take reasonable steps to delete, anonymise or securely dispose of it, unless retention remains necessary or lawful.

NConnect does not promise indefinite storage or retention of customer information.

14. CUSTOMER BACKUPS AND DATA DELETION

Customers using website hosting, business email or other storage services are responsible for maintaining independent backups of important information unless a separate written agreement expressly provides a backup service.

Customers should maintain copies of important website files, databases, email messages, attachments and other data in a secure location separate from the hosted service.

NConnect does not guarantee that customer data will remain available indefinitely or that deleted, corrupted or lost information can be recovered.

Where services are cancelled, suspended or terminated, information may become inaccessible or may be deleted in accordance with applicable retention practices, contractual commitments and legal obligations.

This section does not remove any obligations NConnect may have under applicable data protection law.

15. INTERNATIONAL DATA TRANSFERS

Some NConnect service providers, software platforms, infrastructure providers or technical support providers may operate outside Botswana.

Where personal information is transferred to or accessed from another country, NConnect will comply with applicable legal requirements governing international transfers of personal information.

Where required, appropriate safeguards, contractual protections or other lawful transfer mechanisms will be applied.

Customers may contact NConnect for further information about relevant international transfers, subject to security, confidentiality and legal restrictions.

16. YOUR PRIVACY RIGHTS

Subject to applicable law and any lawful exemptions, individuals may have rights relating to their personal information, including the right to:

• Request confirmation of whether their personal information is being processed.
• Request access to personal information held about them.
• Request correction of inaccurate or incomplete information.
• Request deletion or erasure where legally applicable.
• Object to certain processing activities where the law provides that right.
• Request restriction of processing where applicable.
• Withdraw consent where processing relies on consent.
• Request information about relevant processing activities.
• Lodge a complaint with the competent data protection authority.
• Exercise any other rights available under applicable law.

These rights are subject to legal conditions, exemptions and the rights of other individuals.

NConnect may need to verify the identity and authority of a person making a request before disclosing or changing personal information.

We will respond to valid requests within the period required by applicable law.

17. HOW TO MAKE A PRIVACY REQUEST OR COMPLAINT

Individuals who wish to access, correct or otherwise exercise their rights regarding personal information may contact NConnect using the contact details below.

Please include sufficient information to help us identify the relevant account or records and understand the request.

Do not send passwords, payment card details or other unnecessary sensitive information when making a privacy request.

We may request additional information where reasonably necessary to verify identity, clarify a request or protect another person's privacy.

If you are dissatisfied with our response, you may have the right to complain to the competent data protection authority or pursue another remedy available under applicable law.

18. CHILDREN'S PERSONAL INFORMATION

NConnect services are primarily intended for customers who are legally capable of entering into the relevant service agreements.

Where services involve children or the processing of children's personal information, NConnect will apply the safeguards and requirements prescribed by applicable law.

We do not knowingly collect children's personal information for purposes unrelated to providing a lawful service or meeting a legitimate and permitted business requirement.

Where required, appropriate parental or guardian authorisation will be obtained.

19. THIRD-PARTY WEBSITES AND SERVICES

Our website or customer portal may contain links to third-party websites, payment platforms or external services.

Those third parties may have their own privacy policies and data handling practices.

NConnect does not control the privacy practices of independent third parties and encourages users to review their applicable privacy notices before providing personal information to them.

This does not exclude any responsibility NConnect may have under applicable law for its own activities or contractual arrangements.

20. CHANGES TO THIS PRIVACY POLICY

NConnect may update this Privacy Policy to reflect changes in our services, systems, business practices, security measures or legal requirements.

The revised policy will be published with an updated effective date or revision date.

Where a material change requires direct notification or additional consent under applicable law, NConnect will take the necessary steps.

Customers are encouraged to review this policy periodically.

21. CONTACT INFORMATION

For privacy questions, personal information requests or complaints, please contact NConnect using the official details below.

Service Provider: Primetel (Pty) Ltd, trading as NConnect Country of Operation: Republic of Botswana Registered Address: Plot 1266 Luthuli Rd, Gaborone Privacy Contact Email: john@ncbw.co.bw Customer Support Email: helpdesk@ncbw.co.bw Website: https://www.nconnect.co.bw

Please use the subject line "Privacy Request" when contacting us about personal information.

22. GOVERNING LAW

This Privacy Policy is intended to be interpreted in accordance with the laws of the Republic of Botswana, including applicable data protection legislation, subject to any mandatory legal requirements that apply.

Nothing in this policy limits any right or protection that cannot lawfully be excluded.