Privacy Policy

Privacy Policy

This Privacy Policy explains how Mobile Enterprises (Pty) Ltd, trading as M.E Smart Communications (“Mobile Enterprises”, “we”, “us”), collects, uses, discloses, retains and protects personal data through the KYC.me.co.bw platform (the “Platform”). It is written to comply with the Botswana Data Protection Act, 2024 (Act No. 18 of 2024) (the “DPA”).

1. Who we are

KYC.me.co.bw is a digital Know-Your-Customer (KYC) and Know-Your-Business (KYB) verification platform operated by Mobile Enterprises (Pty) Ltd, a company incorporated in the Republic of Botswana.

• General enquiries: [email protected]
• Data protection contact: [email protected]

All data protection enquiries, including requests to exercise your rights, are handled by our designated data protection contact at [email protected].

2. Our role: controller and processor

We act in two capacities:

• Data controller — for personal data we collect for our own purposes: client account registration, billing, support, platform security and our own analytics.
• Data processor — for personal data collected through KYC campaigns. In this case the business running the campaign (our client) is the data controller and we process the data on their documented instructions under a Data Processing Agreement (see our DPA). If you completed a KYC form, please also read the Privacy Notice for KYC Respondents and the privacy policy of the business that asked you to verify.

3. Personal data we collect

A. From our clients (businesses using the Platform):

• Full name, company name, email address, mobile number
• Account credentials (usernames and bcrypt-hashed passwords)
• Billing and subscription information
• Support correspondence

B. From KYC respondents (end-users completing a campaign), on behalf of our clients:

• Full name, date of birth, gender, nationality, marital status
• Omang / national ID number, passport number and expiry dates
• Mobile number (verified by SMS OTP), email address, physical and postal addresses
• Employment, income, next-of-kin and business details where a campaign requests them
• Uploaded documents: ID copies, passports, proof of address, selfies/photographs and other attachments
• Consent declarations and their timestamps
• IP address, browser user-agent and submission timestamps

C. Automatically collected technical data:

• IP addresses, device and browser information, access logs
• Cookies and similar technologies — see our Cookie Policy
• Analytics data (Google Analytics) only where you have consented via the cookie banner

4. How we collect data

• Web forms (registration, campaign KYC forms, client dashboard)
• SMS one-time-password (OTP) verification through our SMS gateway
• Document and photo uploads
• Cookies and analytics (with consent for non-essential cookies)
• Email and support correspondence

5. Purposes and legal bases for processing

6. Who we share personal data with

We do not sell personal data. We share data only with:

• The client whose campaign you completed — they are the controller of that data and may export it.
• SMS gateway infrastructure — to deliver OTP messages (mobile number and message content only).
• Hosting and infrastructure providers — our servers and backups, under confidentiality obligations.
• Email delivery service — for account and notification emails (Google SMTP).
• Google Analytics — only if you accept analytics cookies.
• Regulators, law enforcement or courts — where required by Botswana law or a lawful order.

Optional add-ons such as AI-assisted document reading, if enabled for a client, are disclosed to that client and covered by the DPA before any data is processed by them.

7. Cross-border transfers

Our primary infrastructure is hosted in data centres that may be located outside Botswana, and some service providers (e.g. email delivery, analytics) process data in other jurisdictions. Where personal data is transferred across borders, we take steps required by the DPA to ensure an adequate level of protection, including contractual safeguards with the recipients. You may request details via [email protected].

8. Data retention

We keep personal data only as long as necessary for the purposes above. In summary (full detail in our Data Retention Policy):

• KYC entries and documents — for the life of the client account, then deleted or returned on termination; where a client is legally required to keep KYC records (commonly 5 years), retention is governed by the client’s instructions as controller.
• SMS OTP records — codes are stored only as hashes and logs are kept up to 12 months.
• Audit logs — up to 24 months.
• Account data — while the account is active; backups cycle out within 30 days of deletion.

9. Your rights

Under the DPA you have the right to:

• Access — obtain confirmation and a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion where there is no overriding legal reason to retain it.
• Restriction — ask us to limit processing in certain circumstances.
• Objection — object to processing based on legitimate interests or for direct marketing.
• Withdraw consent — at any time, where processing is based on consent (this does not affect processing already performed).
• Data portability — receive your data in a structured, commonly used format where applicable.
• Complain — lodge a complaint with the Information and Data Protection Commission (IDPC) of Botswana.

To exercise any right, email [email protected]. We respond without undue delay and within the timeframes prescribed by the DPA. If your data was collected through a KYC campaign, we will refer your request to the client acting as data controller and assist them in responding.

10. Security

We use encryption in transit (HTTPS/TLS), hashed password and OTP storage, role-based access controls, audit logging and rate limiting. Details are in our Security Policy.

11. Automated decision-making

The Platform does not make solely automated decisions with legal or similarly significant effect. Verification outcomes are reviewed by the client (a human) whose campaign you completed. Optional AI-assisted document reading, where enabled, extracts data for human review and does not by itself approve or reject any individual.

12. Children

The Platform is intended for verifying adults and businesses. Campaigns are not directed at children, and we do not knowingly collect children’s data for our own purposes.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date above shows the current version. Material changes will be announced on this page and, for clients, by email.

14. Contact

Data protection contact, Mobile Enterprises (Pty) Ltd t/a M.E Smart Communications: [email protected] · General: [email protected].