Data privacy statement

1. Who we are

Absa Bank Botswana (Absa) is a prominent, diversified financial services provider and part of one of Africa’s largest financial institutions. Absa is committed to treating all your personal information carefully and responsibly. This Privacy Notice explains how we will collect, use and share your personal information, which you provide to us or which we may receive from third parties.

2. When does the Privacy Notice apply?

This Privacy Notice applies when you:

• Apply for, sign up for or use any of our products and services as Absa
• Visit  or use our websites (absa.co.bw ), our Banking App, ATMs or other digital service platforms
• Visit our offices, contact our call centres, visit one of our branches or interact with us through any of our service channels
• Engage with us as a prospective employee, an employee, a contract worker, a supplier or a third party.
• Provide personal information to us directly or where we obtain your personal information from third parties as permitted by law

3. When does it NOT apply?

This Privacy Notice does not apply to the data protection practices of third parties with which we may engage to provide products or services, including their websites or mobile apps. If a third party uses your personal information for its own purposes, it is solely responsible for complying with applicable data protection laws.

When you leave our website or digital platforms and access a third-party site, please be aware that you are subject to that third party’s terms, conditions and privacy policies. We do not review or endorse the content, privacy practices or policies of any external sites, and we are not responsible for how they handle your personal information.

4. What is personal information?

Personal information includes, but is not limited to any information that lets us uniquely identify you, such as your name and surname combined with your physical address, contact details, photograph or image, and any unique identifiers.

Under applicable laws in Botswana, including the Data Protection Act no 18 of 2024.

Special personal information, or sensitive data, includes information about your race or ethnic origin, religious and philosophical beliefs, political persuasion, trade union membership, health or sex life, biometric information (for example, your voice or fingerprints) and any criminal behaviour that relates to alleged criminal offences or proceedings.

Any information that does not identify you, such as anonymised or deidentified data, is not covered by this Privacy Notice.

5. How do we use your personal information and what is the lawful basis for doing so?

We always need a lawful basis for using your personal information. The broad lawful basis for processing your personal information is:

Customers and prospective customers

• Where you, either in your own capacity or acting under a legal mandate for a juristic entity or child, consent to our processing of your information.
• Where we provide a service or product to you, and your personal information is required to be processed for the effective functioning of the product or service (such as the facilitation of payments) and to fulfil our contractual obligation to you.
• Where we need to meet our lawful obligations, such as anti-money laundering and fraud detection or tax reporting.
• Where you, Absa Bank Botswana or a third party has an evidenced legitimate interest in processing the information (such as where we use analytics to assess the viability of a product offering and understand our customers’ needs). In these cases, we carefully balance the legitimate interest against the importance of respecting your privacy to ensure that there is no negative effect on you.
• Where we design, manage, price and provide you with the products or services in which you may have expressed an interest or for which you have applied (including value-added services), and then communicate with you and keep you informed about these products or services.
• Assessing whether you qualify for credit or for an increase or decrease of your credit limit, and conducting credit scoring.
• Delivering your credit or debit card to you at your chosen address, where you have applied for a credit or debit card.
• Meeting your financial services needs by providing you with customised offers, experiences and communications.
• Providing discretionary and administrative financial services.
• Responding to any correspondence with us, including via email or by telephone.
• Identifying you and verifying your physical address, source of funds, income and similar information.
• Assessing your personal financial circumstances and needs before providing advice, products or services to you. In this regard, we may collect your personal information from you in your capacity as our prospective customer.
• Minimising risk and identifying or investigating fraud or other related activities.
• Any purpose related to the prevention of financial crime, including fraud detection and prevention, sanctions screening, adverse media screening, monitoring of anti-money laundering and any financing of terrorist activities.
• Managing our business and identifying potential trends in the market, to ensure that our products are future fit.
• Enforcing our obligations and any contract we have concluded with you, including without limitation the collection of amounts outstanding from you and your provision of security for banking facilities. Enforcement actions may include tracing you through the use of a tracing agent or instituting legal proceedings against you.
• Further processing for historical, statistical or research purposes where the outcomes will not be published in an identifiable format.
• Conducting analytics to better understand you as our customer so that we can tailor our product or service offerings to you, where relevant and applicable.
• Improving our service to you and your experience with us.
• Providing income tax-related information to tax authorities.
• For purposes relating to the sale or transfer of any of our businesses, legal entities or assets as part of corporate transactions.
• Conducting surveys to gauge customers’ satisfaction or to improve our product and service offering.
• Contacting you for marketing purposes regarding products and services, competitions and other promotional products, rewards or value-added services, which we or any of our partners offer, unless you have opted out from, objected to or, where required, not consented to receiving marketing material from us.
• For such other purposes to which you may consent from time to time.
• For purposes of monitoring the use of our electronic systems and platforms by customers.
• Complying with internal and external auditing and reporting requirements, as well as related information requests from regulatory bodies.
• Processing payment instructions (such as debit orders) and instructions received via payment devices (such as debit cards).
• Complying with the requirements of specific local or foreign laws by which we are governed (including codes of conduct, industry agreements and any joint standards, directives, guidelines and rules issued by regulatory bodies from time to time) or complying with any regulations, directives, judgments or court orders, government sanctions or embargoes, reporting requirements under financial transactions legislation, and demands of any supervising authority, regulator, tribunal, enforcement agency or exchange body.

Visitors to Absa premises

If you visit an Absa office, we will collect your personal information to ensure that we manage the capacity of our buildings and ensure the safety of all persons on our premises. We may also use CCTV footage to monitor movement within the buildings. We process this information in accordance with applicable data protection laws.

Employees and prospective employees

Where you are an employee of Absa, we collect your personal information to comply with applicable employment laws. Continuous monitoring of employee conduct is essential for ensuring that we uphold our ethical and legal obligations as a responsible corporate citizen.

Where you have applied for employment at Absa or for an Absa scholarship, we perform applicant screening and background checks, and such screening may include social media screening and screening relating to any information about you obtained from publicly available sources such as search engine results.

Where you are a student, graduate or employment seeker, we will process your personal information only for socioeconomic development purposes, to assist you with job placements through Absa’s designated youth employment agencies, for entrepreneurial upliftment purposes, for skills development and to comply with our legal obligations in terms of applicable Broad-based Black Economic Empowerment laws.

Where you are an Absa employee (including contractors), we create an employment record of you on our system to facilitate continuous monitoring during your employment with us.

As part of our responsibilities in the financial services sector, we may need to report certain employee conduct to relevant authorities or industry databases. This could include cases of dishonesty, misconduct or regulatory breaches. These reports help maintain the industry’s integrity and allow other organisations to check suitability before hiring. Where applicable, such reporting will be carried out in accordance with relevant laws, regulations and guidance, and you will be informed, where required.

Where you are an Absa director, we create a record of you as a director on our internal systems and update your personal information on government databases such as the companies and intellectual authority as required.

Where you have been identified as a next of kin by an employee or customer, we create a record of you on our system. 

Third parties

Where you are a supplier or third party to Absa, we process your personal information for due diligence, risk assessment, administrative and payment purposes. Your responsibilities as a third-party provider to Absa are outlined in our contract and in the Absa Third-party Control Obligations (available on our external website).

In all circumstances, we will not process your sensitive personal information unless:

• You have consented to our processing thereof (in circumstances where we are legally obliged to obtain your consent); or
• It is necessary to exercise or defend a right or obligation in employment and social protection insofar as it is authorised by law; or
• processing is necessary to protect your vital interests
• It is necessary to comply with a legal obligation of public interest; or
• It is for certain historical, research or statistical purposes that would not adversely affect your privacy; or
• You have deliberately made your personal information public.

6.         Where do we collect your personal information?

Personal information may be given to or collected by us in writing as part of a written application form or electronically (including email, messaging applications or other digital service platforms).

In most cases, personal information will be collected directly from you, but there may be other instances when we will collect personal information from other sources where such information is available. These may include public records, places where you may already have made your personal information public (for example, on social media where your settings on such social media are set to “public”) or third parties such as credit bureaus, regulatory bodies or enforcement agencies, and other mandated representatives where you are a corporate entity. We will only collect your personal information from other sources where we are legally entitled or obliged to do so.

Where you share your information on social media pages or electronic communication channels (such as Facebook, WhatsApp or Instagram), and you have already provided your consent through these channels, we can use the information collected through these social media pages to garner customer insights and help us to offer you relevant marketing offers. Through these customer insights, we are able to learn more about our customers’ preferences and improve product development and customer support.

If you provide personal information about another person, you warrant that you have that person’s express permission to give us their personal information to process for the specified purpose for which you are sharing such personal information with us. 

7.         What happens if you do not provide us with your personal information?

There are some personal information fields that you must fill in or provide for us to provide you with your chosen product or service, to fulfil a legal obligation or to perform an obligation in terms of an agreement with you.

Such mandatory information or fields will be indicated to you, for example, by an asterisk on the respective forms or electronic channels. If we do not receive the necessary personal information, we will be unable to continue with your application, to perform our obligations under applicable law or any relevant contract we have or are attempting to enter with you, or to provide the chosen product or service. In such cases, we may have to decline to provide you with the product or services and you will be notified accordingly. If you are already a customer, employee or third party of Absa and we ask you for this information and you do not provide it, we may have to suspend the provision of the product or service for a period of time or, as the case may be, even terminate our relationship with you.

Any information you provide must be accurate and complete and you must notify us of any changes to your personal information.

8.         Do we share your personal information?

For the purposes outlined in this Privacy Notice, we will, in most instances, collect and process your personal information internally. However, there are times when we need to outsource these functions to trusted third parties, including parties in other countries.

We may also need to share your personal information with external organisations, such as our divisions or third parties involved in providing the products or services to you, fraud detection services, credit bureaus, professional advisers (including auditors, attorneys and external professional consultants), tax authorities or other regulatory or industry bodies, other banks, insurance institutions or financial institutions, and courts of law or tribunals, so that we can meet our due diligence or regulatory requirements or provide the products or services to you.

We may share your information for analytics, research and product development purposes, to ensure product suitability and to enable us to better understand customers’ needs, improve our offerings and enhance your experience. Third parties may assist us to provide telephone support, assist in facilitating our IT or marketing products or services, or provide data storage.

We may need to share your personal information with our business partners or counterparties, where we are involved in corporate transactions relating to the sale or transfer of any of our businesses, legal entities or assets, or with any party to whom we assign our rights under any of our agreements for particular products and services.

We will enter into written agreements with all third parties to ensure that they process any personal information in accordance with applicable laws and Absa Botswana standards. Where personal information is transferred to a foreign jurisdiction, including for processing and storage by third parties, we will ensure that there are adequate levels of data protection.

When Absa (including any entity within the Absa Group) transfers your personal information to other Absa Group entities located outside South Africa, such transfers will be governed by our internal data sharing agreements and policies, which ensure an adequate level of protection in accordance with applicable laws.

Consent will not be required for intra-group transfers where such transfers are necessary for the performance of a contract, compliance with legal obligations or legitimate business interests, and appropriate safeguards are in place.

Where personal information is transferred to external third parties in a foreign jurisdiction, we will put in place appropriate safeguards and adhere to any applicable laws.

9.         What are your rights when an automated decision is made about you?

There may be instances where we will process your personal information through a secure automated tool (without any human intervention used in the decision-making process) or perform profiling and make decisions based on such profiling, which may affect you significantly (for example, the automatic non-approval of a personal loan for which you may have applied through any of our online channels, or the automatic non-approval of an application for employment or engagement as a supplier).

If you are unhappy about the outcome of such a decision or would like further information on how such outcome was reached, please contact: 

• Your local Customer Service centre (for customers);
• Your resourcing consultant (for job applicants);
• The people partner for your business (for employees);
• Your supplier relationship manager (for suppliers); or
• Absa’s Group Secretariat office (for directors of Absa-owned companies).

10.         How do we process personal information relating to children?

We are committed to protecting the privacy of children and complying with all applicable data protection laws regarding the collection and processing of children’s personal information. We take additional steps to safeguard children’s data, including providing clear notice to parents or guardians and ensuring that where required by law, we obtain consent from a parent or guardian before collecting, using or sharing a child’s personal information.

11.         How is your information used for direct marketing?

• If you are a customer of Absa, we would like to keep you informed of updates to our products or services, competitions and other promotional products, rewards or value-added services that we or any of our partners offer, which we think may benefit your lifestyle.
• To do this, we may contact you via SMS, email, telephone or post.
• If you do not want to receive direct marketing communication from us, you can immediately update your preferences to opt out by contacting our contact centre or a service representative at any of our branches or by contacting us on the contact details that appear in paragraph 15 below, all at no cost to you.
• If you are not a customer, we may contact you to provide information about our products and services, but only if you have shared your contact details for that purpose. You can opt out of receiving these marketing messages at any time by notifying the Absa representative who contacts you, or by making a request in writing.
• We will adhere to your communication channel preferences whenever we can, but we may need to send you important communications via a channel that is not your preference. We will only do so in cases where we deem the information to be important and relevant for you.

12.         Retaining and deleting personal information

• We will not retain any personal information for longer than is necessary to achieve the purpose of such collection.
• We will retain your personal information for as long as it is legally required and where we have a defined purpose to retain it. Thereafter we will destroy it, deidentify it or anonymise it.

13.         How do we secure and protect your personal information?

• The security of your personal information is of utmost importance to us. We will take appropriate technical and organisational precautions through a multi-layered defence strategy to secure your personal information and to prevent the loss, misuse, unauthorised access, disclosure or alteration of your personal information.
• We will store all your personal information on secure servers, in cloud technology and in secure manual record-keeping systems, in accordance with internationally accepted banking information security practices.
• We use a range of physical, electronic and other security measures to protect the security, confidentiality, integrity and availability of the personal information that we hold. For example:
  • Access to our information systems is controlled through identity and access management and through logging and monitoring controls.
  • Our employees and our contracted service providers are bound by internal information security policies and standards and are required to keep information secure.
  • Our employees are required to complete annual training about privacy and information security.
  • We regularly monitor and review our compliance with internal policies and industry best practices and standards.
  • It is your responsibility to ensure that your password is complex, that it is not susceptible to being guessed (whether by a person or by a computer program) and that you do not use the same banking password on other sites. You are responsible for keeping the password that you use for accessing our website confidential. We will not ask you for your password or PIN (except when you log in to our digital channels or are performing a transaction)

14.  Your data protection rights

To the extent that local legislation permits, you have the following rights regarding your personal information:

• The right to request us to confirm whether any personal information is held about you and to access your personal information that we have on record.
• The right to ask us to correct or delete any of your personal information  that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully.
• You can ask us to delete or destroy your personal information that we are no longer authorised to retain. Our records are subject to regulatory retention periods, which means that we may not be able to delete or destroy your personal information immediately on request.
• You can also object on reasonable grounds to our processing of your personal information. However, the result of such a request may be that we have to suspend the provision of products and/or services for a period of time or even terminate our relationship with you.
• The right to withdraw consent at any time, where you have previously consented to the processing of your personal information, by providing us with notice to that effect. Withdrawal of consent shall not affect the lawfulness or validity of any processing carried out based on your consent before its withdrawal.
• The right to be notified that your personal information is being collected and processed by us. This Privacy Notice seeks to give effect to this right.
• The right to be notified in any situation where we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person (e.g. data breach or security compromise).
• The right not to be subject to a decision based solely on the automated processing of your personal information that is intended to provide a profile about you, where we have not complied with the requirements under applicable law and/or our commitments in paragraph 9 above.
• If you have a complaint relating to the protection of your personal information, including the way in which it has been collected or processed by us, please contact us using the local contact details listed in paragraph 15 below.
• If you have not had your complaint dealt with satisfactorily in accordance with our internal dispute resolution process, you may lodge a complaint with your local privacy regulator in terms of applicable privacy laws.

15.         Right to change this Privacy Notice

• We reserve the right to change this Privacy Notice at any time. All changes to this Privacy Notice will be posted on our website and you will be presumed to have knowledge of it from the date it is posted.
• Unless otherwise stated, the current version will supersede and replace all previous versions of this Privacy Notice.

Contact details

If you have any questions about this Privacy Notice or a complaint regarding the treatment of your personal information, please use the contact link on our website or contact our information officer using the details set out below:

Botswana:

Hours: Weekdays, 08:00 to 17:00

Email address: DataPrivacyBW@absa.africa