Privacy Policy

Sefalana Cash & Carry Limited (“Sefalana”, “we”, “our” or “us”) respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how Sefalana collects, uses, stores, protects and otherwise processes personal information when you visit or use our website at www.sefalana.co.bw (the “Site”), including when you use features such as our store locator, digital promotional material and AI-powered assistant/chatbot.

This Privacy Policy is intended to provide information in accordance with the Data Protection Act of Botswana, as amended from time to time (the “Act”), and other applicable laws and regulations relating to privacy and data protection.

For purposes of the Act, Sefalana is the data controller in respect of personal information processed through the Site.

This Privacy Policy applies only to the Site and does not apply to Sefalana's internal systems, employee information or other processing activities that are governed by separate privacy notices or policies.

Sefalana Cash & Carry Limited

Registered address:
Plot 10038 Broadhurst Industrial
Corner Kubu Road & Nelson Mandela Drive
Broadhurst
Gaborone
Botswana

Telephone: +267 368 1700

Privacy and data protection enquiries:
dpo@sefcash.co.bw

For privacy-related matters, you may contact the Data Officer / Data Protection Officer at the above email address.

For purposes of this Privacy Policy, “personal information” means information relating to an identified or identifiable natural person.

Depending on how you use the Site, personal information may include information such as your IP address, device information, browser information, online identifiers, location information and information contained in messages that you voluntarily submit to our AI assistant.

We seek to collect only information that is reasonably necessary for the purposes described in this Privacy Policy.

The information we collect depends on how you use the Site.

4.1 Information collected automatically

When you visit the Site, certain technical and usage information may be collected automatically, including:

• browser type and version;
• operating system;
• device type;
• screen size and display characteristics;
• language preferences;
• IP address;
• approximate geographic location derived from your IP address, such as country or city;
• pages visited;
• the order in which pages are visited;
• time spent on pages;
• links, buttons or other features that you interact with;
• referring website, search engine, social media post or other source that brought you to the Site; and
• online or cookie identifiers used for analytics and site functionality.

This information is primarily used to operate, secure, analyse and improve the Site.

4.2 Information provided when using the AI assistant

If you choose to use the AI assistant on the Site, the text that you enter into the assistant will be transmitted to our AI service provider, OpenAI, so that the service can generate a response.

Sefalana does not retain chatbot messages on its own Site servers after the response has been provided, subject to any information that may necessarily be contained in temporary technical, security or service-provider systems.

Please do not enter sensitive personal information, passwords, payment card information, identification numbers, confidential business information or any other information that you would not ordinarily wish to disclose to an online service into the AI assistant.

The AI assistant is intended primarily to provide general assistance regarding Sefalana's products, stores, promotions and services. It should not be used to submit confidential or sensitive information to Sefalana.

4.3 Precise location information

If you use a feature such as “Find my nearest store”, the Site may request permission from your browser or device to access your location.

This information is collected only after you grant permission.

Your approximate GPS coordinates may be used solely to determine your nearest Sefalana store or provide another location-based service requested by you.

Where technically applicable, coordinates are rounded to approximately one-kilometre precision before being processed or logged.

We do not retain your precise location information beyond what is reasonably necessary to provide the immediate location-based service.

You may refuse location permission. Doing so will not prevent you from using the remainder of the Site, although certain location-based features may not function.

4.4 Information we do not normally collect through the Site

The Site does not currently require visitors to create an account or log in.

We do not normally collect the following information from general Site visitors:

• names;
• telephone numbers;
• residential or postal addresses;
• identity document numbers; or
• payment card or banking details.

If a future Site feature requires us to collect any of these or other personal information, we will update this Privacy Policy and, where required, provide you with appropriate additional information at the time of collection.

5.1 Operating the Site

To:

• provide access to the Site;
• display promotional pamphlets, catalogues, specials and product information;
• provide store locations;
• operate the store locator;
• operate the AI assistant;
• provide features and services requested by visitors; and
• maintain the functionality and performance of the Site.

5.2 Improving the Site

We may analyse information about how visitors use the Site in order to:

• understand which pages and features are most useful;
• identify problems or areas where visitors experience difficulty;
• improve navigation and functionality;
• improve the customer experience; and
• develop and improve future Site features.

5.3 Marketing and campaign measurement

We may use analytics information to understand how visitors arrive at the Site and how they interact with our digital marketing campaigns.

For example, we may analyse whether visitors view or download promotional material after arriving at the Site through a particular campaign.

This helps Sefalana evaluate the effectiveness of its marketing activities and allocate advertising resources responsibly.

5.4 Location-based services

Where you provide permission, we may process location information to respond to requests such as identifying your nearest Sefalana store.

5.5 Security and fraud prevention

We may process technical information, including IP addresses and server access information, to:

• protect the Site;
• identify malicious or abnormal activity;
• prevent abuse of the Site;
• limit automated or excessive requests;
• investigate security incidents; and
• maintain the availability and integrity of our systems.

5.6 Compliance with legal obligations

We may process personal information where necessary to comply with applicable laws, regulations, court orders, regulatory requirements or lawful requests from competent authorities.

5.7 Establishment, exercise or defence of legal claims

We may process personal information where reasonably necessary to establish, exercise or defend legal rights or claims.

Sefalana will process personal information only where there is a lawful basis for doing so under applicable data protection law.

Depending on the circumstances, the lawful basis may include:

• your consent;
• the performance of a contract or steps taken at your request before entering into a contract;
• compliance with a legal obligation;
• the protection of legitimate interests pursued by Sefalana or a third party, where those interests are not overridden by your rights and interests;
• protection of vital interests where applicable; or
• another lawful basis recognised under applicable law.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Where processing is necessary for the provision of a particular Site feature and you do not provide information or permission required for that feature, the feature may not be available to you.

Sefalana seeks to collect and process only personal information that is relevant and reasonably necessary for the purposes described in this Privacy Policy.

We take reasonable steps to ensure that personal information in our possession is accurate and, where necessary, kept up to date.

You may contact us if you believe that personal information we hold about you is inaccurate or incomplete.

A cookie is a small text file or similar identifier that may be stored on your device when you visit a website.

The Site may use cookies and similar technologies for functionality, analytics, security and other purposes described in this Privacy Policy.

8.1 Google Analytics cookies

The Site currently uses the following Google Analytics cookies:

• _ga— Helps distinguish visitors for Google Analytics measurement. Provider: Google. Approximate lifetime: up to 2 years.
• _ga_G-0GLN0SQFM9— Maintains session information for Google Analytics. Provider: Google. Approximate lifetime: up to 2 years.

Actual cookie lifetimes may vary depending on the Site configuration and the visitor's browser or device.

8.2 Cookie choices

Where required, the Site will provide a cookie consent mechanism allowing you to accept or decline non-essential cookies.

You may also control or delete cookies through your browser settings.

Most modern browsers allow you to:

• block cookies;
• delete existing cookies;
• receive a warning before cookies are stored; or
• browse using private or incognito mode.

Blocking or deleting cookies may affect certain Site functionality.

We may update the cookies used by the Site from time to time. Where this occurs, we will update this Privacy Policy and, where required, our cookie-consent mechanism.

We use Google Analytics, provided by Google LLC, to understand how visitors use the Site.

Google Analytics may process information such as:

• IP address or information derived from it;
• device and browser information;
• approximate geographic location;
• pages visited;
• interaction with Site features;
• referring source;
• session information; and
• other usage information.

Analytics information is used to measure Site performance, understand visitor behaviour and improve the Site and our digital marketing.

Our current intended retention period for Google Analytics data is 26 months, after which the relevant Analytics data is automatically deleted in accordance with the applicable Google Analytics configuration.

You can also control cookies through your browser settings and other privacy controls made available by Google or your browser provider.

The Site includes an AI-powered assistant that uses services provided by OpenAI, L.L.C.

When you submit a message to the assistant:

1. your message is transmitted to OpenAI;
2. OpenAI processes the message in order to generate a response;
3. the response is returned to the Site; and
4. Sefalana does not retain the chatbot conversation on its own Site servers after the response, subject to temporary technical processing and any retention that may apply within the relevant service-provider environment.

The AI assistant may not always provide accurate or complete information. Information supplied by the assistant should not be regarded as a substitute for official Sefalana terms, conditions, policies or communications.

Sefalana does not use chatbot conversations to make decisions that produce legal effects or similarly significant effects concerning visitors.

You should avoid entering unnecessary personal or sensitive information into the chatbot.

Sefalana uses selected third-party service providers to support the operation of the Site.

These providers may process personal information on Sefalana's behalf or receive information as necessary to provide their services.

Our principal providers currently include:

• Google LLC— Google Analytics — Website usage, device, browser, approximate location, identifiers and analytics events.
• Google LLC— Google Maps / Maps API — Location information where you use location-based store-finder functionality, together with standard map-service request information.
• OpenAI, L.L.C.— AI services — Text submitted to the Site's AI assistant.
• Amazon Web Services EMEA SARL— Hosting and infrastructure — Website traffic, technical information and information processed through the Site's hosting environment.

Third-party providers are required, where applicable, to process information in accordance with their contractual obligations, applicable data protection law and Sefalana's instructions.

We do not sell personal information to third parties for their own independent marketing purposes.

We do not operate an advertising exchange or data-broker service through the Site.

Sefalana may disclose personal information where reasonably necessary for the purposes described in this Privacy Policy.

This may include disclosure to:

• technology and hosting service providers;
• analytics and website-performance providers;
• AI service providers;
• mapping and location-service providers;
• professional advisers;
• auditors;
• insurers;
• law enforcement agencies;
• courts, regulators or other competent authorities; and
• other persons where disclosure is required or permitted by law.

We do not sell personal information to third parties.

Where we appoint a third party to process personal information on our behalf, we seek to ensure that appropriate contractual and technical safeguards are in place.

Some of our service providers are located outside Botswana. As a result, personal information may be transferred to, accessed from or processed in countries outside Botswana.

For example, Google and OpenAI are based in the United States, while certain Sefalana hosting infrastructure is operated through Amazon Web Services.

Where personal information is transferred outside Botswana, Sefalana will take appropriate steps to ensure that the transfer is carried out in accordance with applicable Botswana data protection law and that appropriate safeguards are in place.

Depending on the circumstances, these safeguards may include:

• contractual data protection obligations;
• appropriate contractual safeguards;
• standard contractual clauses or equivalent mechanisms where applicable;
• recognised transfer mechanisms;
• other safeguards permitted under applicable law; or
• a lawful derogation where applicable.

Where required by law, information regarding the relevant safeguards may be obtained by contacting Sefalana at dpo@sefcash.co.bw.

Sefalana retains personal information only for as long as reasonably necessary for the purpose for which it was collected, unless a longer retention period is required or permitted by law.

Our current retention periods for the Site include:

• Google Analytics data— 26 months, subject to the applicable Google Analytics configuration.
• Chatbot messages on Sefalana's Site servers — Not retained after the response, subject to temporary technical processing.
• IP addresses in server access logs— Approximately 30 days.
• Precise location coordinates— Not retained beyond the immediate location-based response, subject to temporary technical processing.

Retention periods may be extended where reasonably necessary for security investigations, legal claims, regulatory requirements, dispute resolution or other lawful purposes.

When personal information is no longer required, we will take reasonable steps to delete it, anonymise it or otherwise dispose of it securely.

Subject to applicable law and any lawful limitations, you may have the following rights in relation to your personal information:

15.1 Right of access

You may ask whether Sefalana holds or processes personal information about you and request access to that information and relevant information about how it is processed.

15.2 Right to rectification

You may request that inaccurate or incomplete personal information be corrected or completed.

15.3 Right to erasure

In circumstances provided by law, you may request that your personal information be deleted. This right is not absolute and may not apply where Sefalana is legally entitled or required to retain or process the information.

15.4 Right to restriction of processing

In circumstances provided by law, you may request that processing of your personal information be restricted.

15.5 Right to object

You may object to certain processing of your personal information where permitted by law, including processing based on legitimate interests in circumstances where your rights and interests override those interests.

15.6 Right to data portability

Where the applicable legal requirements are satisfied, you may have the right to receive certain personal information that you have provided to Sefalana in a structured, commonly used and machine-readable format and, where technically feasible and legally applicable, request that it be transmitted to another data controller.

15.7 Right to withdraw consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

15.8 Rights relating to automated decision-making

You may have rights relating to automated individual decision-making, including profiling, where applicable under the Act.

Sefalana does not currently use information collected through the Site to make automated decisions that produce legal effects or similarly significant effects concerning you.

15.9 Right to lodge a complaint

You have the right to lodge a complaint with the Information and Data Protection Commission (IDPC) where you believe that your personal information has been processed unlawfully or that your rights under applicable data protection law have been infringed.

To exercise a privacy or data protection right, please email:

dpo@sefcash.co.bw

Please use the subject line: “Data Protection Request”

Your request should, where reasonably possible, include:

• your name;
• a description of the information or processing to which your request relates;
• the right you wish to exercise; and
• sufficient information to enable us to identify and respond to your request.

We may need to take reasonable steps to verify your identity before providing personal information or acting on certain requests.

Sefalana will respond to requests in accordance with the requirements and time periods prescribed by applicable law.

There may be circumstances in which Sefalana is permitted or required by law to refuse or limit a request. If this occurs, we will explain the reason where legally permitted to do so.

If you have a concern about the way Sefalana has handled your personal information, we encourage you to contact us first so that we can investigate and attempt to resolve the matter.

You may also lodge a complaint with the Information and Data Protection Commission of Botswana in accordance with the applicable law.

Nothing in this Privacy Policy limits your statutory right to approach the IDPC.

Sefalana takes reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, destruction, alteration, disclosure or other unlawful processing.

Depending on the nature and circumstances of the processing, these measures may include:

• encryption of information in transit using HTTPS/TLS;
• appropriate access controls;
• authentication and authorisation controls;
• security monitoring;
• firewalls and other network security measures;
• security updates and software patches;
• logging and monitoring of relevant system activity;
• employee awareness and data-protection training;
• backups and disaster-recovery measures; and
• incident detection and response procedures.

Access to personal information is limited to persons who require access for legitimate business or operational purposes.

No internet transmission or electronic storage system can be guaranteed to be completely secure. Accordingly, while we take reasonable measures to protect personal information, we cannot guarantee absolute security.

Sefalana maintains procedures for identifying, investigating and responding to actual or suspected personal data breaches.

Where a personal data breach occurs, Sefalana will assess the nature and potential impact of the breach and take appropriate remedial and protective measures.

Where notification is required by applicable law, Sefalana will notify the Information and Data Protection Commission within the applicable statutory period and will notify affected data subjects where and to the extent required by law.

Where appropriate, notifications may include information about:

• the nature of the breach;
• the categories of information affected;
• the likely consequences;
• measures taken to address the breach; and
• steps that affected individuals can take to protect themselves.

Sefalana seeks to incorporate appropriate privacy and data protection considerations into the design and operation of its Site, systems and services.

This includes, where appropriate:

• limiting collection of personal information;
• limiting access to personal information;
• retaining information only for as long as necessary;
• implementing appropriate security measures; and
• considering privacy risks when introducing new technologies or features.

Where processing involving new technologies is likely to result in a high risk to individuals' rights and freedoms, Sefalana will assess whether a Data Protection Impact Assessment or other assessment is required under applicable law.

The Site is intended for a general audience and is not specifically directed at children.

Sefalana does not knowingly seek to collect unnecessary personal information from children.

Where we become aware that personal information has been submitted by a child in circumstances where the collection or processing is not lawful or appropriate, we will take reasonable steps to address the information in accordance with applicable law.

If you believe that a child has provided personal information through the Site, please contact us at dpo@sefcash.co.bw.

The Site may contain links to third-party websites, applications or services.

These third parties operate independently from Sefalana and may have their own privacy policies and terms of use.

Sefalana is not responsible for the privacy practices, content or security of third-party websites or services.

We encourage you to review the privacy policy of any third-party website before providing personal information.

Sefalana may amend this Privacy Policy from time to time to reflect:

• changes in applicable laws or regulatory requirements;
• changes to the Site;
• new products, services or features;
• changes to our technology or service providers; or
• changes to our data-processing practices.

When we make changes, we will update the “Last updated” date at the beginning of this Privacy Policy.

Where a change is material and applicable law requires notification or consent, we will take appropriate steps to notify affected visitors.

We encourage you to review this Privacy Policy periodically.

If you have any questions about this Privacy Policy, wish to exercise a data protection right, or have a concern regarding the processing of your personal information, please contact:

The Data Officer / Data Protection Officer
Sefalana Cash & Carry Limited
Plot 10038 Broadhurst Industrial
Corner Kubu Road & Nelson Mandela Drive
Broadhurst
Gaborone
Botswana

Telephone: +267 368 1700
Email: dpo@sefcash.co.bw

Please use “Data Protection Request” as the subject line for requests concerning your personal information.

This Privacy Policy applies specifically to personal information processed through the Sefalana website at www.sefalana.co.bw.

Sefalana may have separate privacy notices, policies and procedures governing personal information processed through other channels, including employment, recruitment, customer accounts, loyalty programmes, suppliers, business partners, CCTV, physical stores and other Sefalana systems or services.

Where another Sefalana privacy notice applies to a particular service or relationship, that notice should be read together with this Privacy Policy.