Legal
Document Upload Privacy Notice
What happens to the identity, qualification and payment documents you upload to iAB.
Version 1.0Last reviewed 24 September 2026Approved by Insurance Academy of BotswanaEffective from 24 September 2026
Read together with the Privacy Notice.
1. Scope
This notice covers the documents you upload through this website as part of an application. It sits alongside our main Privacy Notice, which covers everything else we do with your personal information.
2. Documents We Collect
2.1 Identity document
A copy of your Omang or passport. An identity document contains more than your name: it shows your identity number and date of birth. We store the document image so a member of staff can verify it against the details you gave us. We also hold the document number you typed into the application form, because it is the reference you use when you pay us and we cannot match a bank deposit without it. That number is never used as your student reference, never used to look up an application, and never appears in an email subject, a notification, an audit entry, a filename, a web address or a log.
2.2 Qualification certificate
A certified copy of your BGCSE certificate or equivalent, or the Diploma or Degree you are asking us to consider for an exemption from the English and Mathematics requirement. It is retained as part of your student record so we can evidence that you were properly admitted.
2.3 Proof of payment
Used to reconcile your payment against your application and for our accounting records. Please redact anything on a bank document that is not needed to identify the payment. We do not need your account balance or your other transactions.
2.4 Please do not upload more than we ask for
Only upload the documents requested. Please do not upload medical records, financial statements beyond the payment itself, documents belonging to other people, or anything else we have not asked for. If you send us something we do not need, we will delete it. This website does not ask for evidence of a disability or a support need; if iAB asks for that through another channel it is health information, kept apart from your general application record, restricted to the staff arranging your support, and never used for marketing or analytics.
3. Why We Need Them
The identity document confirms you are who you say you are and that your certificate belongs to you. The qualification certificate confirms you meet the entry requirements, including whether you have passes in English and Mathematics or a Diploma or Degree that supports an exemption. Proof of payment lets us match your payment to your application. We ask for nothing else.
4. Access and Verification
Only authorised iAB staff whose role requires it can see your documents: admissions and document-review staff verifying your application, and finance staff reconciling a payment. Access is role-based rather than general, so holding a staff account does not by itself give access to documents, and privileged actions such as exporting records require a specific permission. Staff view documents through short-lived, read-only links generated at the moment of viewing, which expire shortly afterwards. They are expected to view a document to verify it, not to download and keep copies, and not to circulate them by email or messaging. Sensitive administrative actions are written to an append-only audit log recording who did what and when.
5. Storage and Security
5.1 How uploads are handled
Uploads travel over an encrypted connection. We check the actual bytes of the file rather than trusting what it claims to be, and accept only PDF, JPEG and PNG, so an executable or a script renamed with a document extension is rejected. Files are limited to 4 MB.
5.2 Where documents are stored
In private object storage, never in a public folder and never in the page itself. Each file is stored under a random identifier, not under your name, your identity number or the original filename, so the storage location reveals nothing about you. Our database records only that identifier, the file type and its size. The file itself is never stored in the database. There is no public link to any uploaded document, the storage container permits no anonymous access, and a document cannot be reached by guessing a URL.
5.3 If something goes wrong
If a security incident affects uploaded documents we will investigate promptly, contain it, record it, notify the Information and Data Protection Commission within 72 hours where the law requires, and tell affected people without undue delay where there is a risk to their rights or freedoms.
6. Sharing
We do not share your documents for marketing, analytics or advertising, and we never send them to Meta or any advertising provider. We may disclose a document where we are legally required to, where an accreditation or regulatory body is entitled to verify an award, or where it is necessary to establish or defend a legal claim.
7. International Processing
Uploaded documents are stored by our document storage provider, Supabase, in London, United Kingdom, in a private store with no public access. Botswana's Data Protection Act permits this under an appropriate transfer mechanism and requires that a copy of transferred personal information remains in Botswana for the period of processing. We are confirming with our legal advisers the mechanism that applies and how the local-copy requirement is met, and we will update this notice with those details.
8. Retention and Deletion
Documents supporting a successful application are kept as part of your student record for as long as we may need to verify your admission and your award. Documents attached to an incomplete or unsuccessful application are kept for a short period so we can answer queries or reconsider, then deleted. Proof of payment is kept for the period required for financial records. A detailed retention schedule is being finalised and will be published. When a document reaches the end of its retention period it is deleted from the document store and the record of it is removed. You can ask us to delete a document sooner and we will do so unless we are required to keep it, for example because it evidences your admission to a qualification we have awarded, or because it is needed for a legal claim.
9. Your Rights
You can ask what documents we hold, ask us to correct a record, ask us to delete a document, or object to how it is being used. Our Data Requests page explains how, and what happens next.
10. Contact
info@iab.co.bw, or write to us at Lot 102, Unit 1, Light Industrial Commerce Park, Gaborone, Botswana. Telephone +267 311 7200.