Legal
Privacy Notice
How the Insurance Academy of Botswana collects, uses, shares and protects personal information, and the rights you have over it.
Version 1.0Last reviewed 24 September 2026Approved by Insurance Academy of BotswanaEffective from 24 September 2026
Read together with the Document Upload Privacy Notice, Cookie Notice and Data Requests.
1. About this Notice
1.1 Who we are
Insurance Academy of Botswana (Pty) Ltd ("iAB", "we", "us") is the data controller for the personal information described in this notice. We are an accredited education and training provider registered in Botswana (company registration BW0000132853), at Lot 102, Unit 1, Light Industrial Commerce Park, Gaborone, Botswana.
1.2 Scope and governing law
This notice covers personal information we process through this website, our application process, and the administration of our programmes. It is written under Botswana's Data Protection Act, 2024, which is the law that governs your rights. We have used established privacy practice from other jurisdictions as a drafting benchmark only; it does not govern your relationship with us.
1.3 Who this notice is about
Prospective students and applicants; enrolled and former students; employer and sponsor contacts where an employer funds a student; and visitors to this website.
1.4 Changes to this notice
We update this notice when our processing changes, when the law changes, or when we improve how we explain something. The version and review date are shown above. Where a change materially affects you we will tell you rather than rely on you noticing.
2. Information We Collect
2.1 Application and account information
When you apply we collect your first and last name, email address, phone number, date of birth, the type of identity document you hold and its number, your physical address (street, suburb or ward, city or town and country), your highest qualification and the entry route you are relying on, your reason for enrolling, and your programme, intake, study mode and funding method, together with a record of the consents you gave. Gender, employer, occupation, insurance experience and your preferred contact channel are optional. We also record an application reference, application status, staff status history, and any internal notes about your application. If you use the status page we hold a hashed access token.
2.2 Your identity document number
We collect and store your Omang or passport number. We do this for one operational reason: the payment reference you are asked to use when you pay iAB is that number, and without it a deposit into our bank account cannot be matched to your application. It is treated as sensitive throughout. It is never used to look up an application, never sent to any advertising or analytics provider, never included in a web address, a file name or a storage location, never written into an email subject line, and never printed in our system logs. Where it appears on a screen you are reading, it is masked except for the last few characters. Only authorised admissions and finance staff can see it in full.
2.3 Documents you upload
You upload a copy of your Omang or passport, a certified copy of your BGCSE certificate or equivalent (or a Diploma or Degree where you are asking us to consider an exemption), proof of payment, and any supporting document we ask for. We store the document itself so a member of staff can verify it against what you told us. Document handling is described in full in our Document Upload Privacy Notice.
2.4 Sensitive personal information
This website does not ask whether you have a disability or require academic support. If iAB asks for that information through another channel, it is health information and is treated as sensitive: collected only so far as necessary to arrange reasonable academic support, on an appropriate lawful basis including your explicit consent where required, held separately, restricted to the staff arranging that support, and never used for marketing or analytics or shared with any advertising provider. You may withdraw consent at any time, though doing so may affect the support arrangements it enables.
3. How We Collect Information
Directly from you through the application form, document uploads, email, telephone and WhatsApp; from an employer or sponsor where they fund your studies; automatically from your device when you use the website; and from our own records as your application and studies progress.
4. How We Use Information
We use it to assess your application, verify your identity and qualifications, register you, deliver your programme, administer assignments, assessments and examinations, issue results and certificates, collect fees and administer accounts, answer your enquiries, secure our systems and prevent fraud, meet our accreditation, tax and company obligations, and improve our programmes. We use it for marketing and non-essential analytics only where you have given consent.
5. Legal Bases
Assessing your application: steps taken at your request before entering a contract. Delivering your programme, administering assessments and examinations, issuing results and certificates, and collecting fees: performance of our contract with you. Verifying identity and qualifications, keeping accounting records, and meeting accreditation and regulatory obligations: compliance with legal obligations. Securing our systems, preventing fraud, recovering debts, and improving our programmes: our legitimate interests, balanced against your rights. Optional marketing and non-essential analytics: your consent, which you may withdraw at any time.
6. Applications and Student Records
6.1 Assessment of applications
Every application is assessed by a member of staff. We do not make decisions about admission by solely automated means, and we do not profile applicants for admission purposes.
6.2 Student records
Once you are registered we hold a student record covering your registration, programme, assessment and examination results, certification, fee account and correspondence with us. We keep it so we can administer your studies and later verify an award we have made.
6.3 Applicants under 18
Our programmes are designed for working adults and people entering the profession. We have not set a minimum age for application, and the Data Protection Act imposes additional requirements where a child's information is processed in an online service. If you are under 18 and want to apply, please contact us first so we can deal with your application appropriately. We are reviewing our position on applicants under 18 and will state it here once it is settled.
7. Payments and Debt Recovery
We process payment records, proof of payment, account balances and correspondence to administer fees. Where an account falls into arrears we may share the information reasonably necessary to recover it with a debt-collection agency or our legal advisers. We do this on the basis of our contract with you and our legitimate interest in recovering money owed, and only to the extent lawful and proportionate.
8. Communications and Marketing
Operational messages about your application, fees, assignments, examinations and programme administration are part of delivering your programme. You cannot opt out of these while you have a live application or enrolment, because we cannot administer your studies without them. Marketing is separate: it is sent only with your consent, that consent is never bundled into accepting our terms, and you can withdraw it at any time without any effect on your application.
10. Sharing Information
Service providers who process on our instructions: our website hosting provider, our database host, our document storage provider, our transactional email provider, our WhatsApp messaging provider, and an SMS provider once one is appointed. We never share your date of birth, identity document number, address or uploaded documents with any advertising or analytics provider. Meta, for advertising measurement, after you consent. Debt-collection agencies and legal advisers where an account is in arrears. Accreditation and regulatory bodies, and other authorities, where we are legally required to disclose. We do not sell your personal information.
11. International Processing
Our providers process personal information outside Botswana. Our application database and the documents you upload are held by Supabase in London, United Kingdom. This website runs on Vercel, whose servers for this site are in London and whose platform is operated from the United States. Transactional email is sent through Resend, which processes message details in the United States, and WhatsApp messages are sent through WATI on Meta's WhatsApp Business Platform, which process them outside Botswana. Botswana's Data Protection Act permits transfers where an appropriate transfer mechanism applies, and requires that a copy of transferred personal information remains in Botswana for the period of the processing. We are confirming with our legal advisers the transfer mechanism that applies to each provider and how the local-copy requirement is met, and we will update this notice with those details. We are not claiming, and you should not read this notice as claiming, that every transfer arrangement is already in place.
12. Retention
We keep personal information only for as long as it is needed for the purpose it was collected for, and for any period required by law. Incomplete and unsuccessful applications are kept for a short period so we can answer queries and reconsider an application, then deleted. Student records, assessment and examination records, and certification records are kept for as long as we may need to verify an award. Financial records are kept for the period required by tax and company law. Debt and legal records are kept while a claim is live and for as long afterwards as the law allows. A detailed retention schedule is being finalised with our advisers and will be published here.
13. Security
13.1 How we protect information
Staff accounts use salted scrypt password hashing and a signed, HttpOnly, SameSite session cookie with an eight-hour lifetime, enforced by middleware and re-checked by every server route. Staff access is role-based, and privileged actions such as exporting records require a specific permission. Login attempts are rate-limited. Applicant status links use 256-bit random tokens, stored only as a hash, time-limited and revocable. Uploaded documents are validated by inspecting the actual file bytes, capped at 4 MB, stored under random identifiers in private storage with no public access, and reachable only through short-lived authenticated links. Sensitive administrative actions and every application status change are recorded in an append-only audit log. Database queries are parameterised. No security measure is perfect, and we do not claim otherwise.
13.2 Security incidents
If a personal data breach occurs we will investigate promptly, take steps to contain and mitigate it, and record it. Where the Data Protection Act requires it we will notify the Information and Data Protection Commission within 72 hours of becoming aware of the breach, and we will tell affected people without undue delay where the breach is likely to put their rights or freedoms at risk.
14. Your Rights
You have the right to be informed about how we use your information, and to access it, have it corrected, have it erased in the circumstances the law allows, restrict how we use it, receive it in a portable form where applicable, object to processing including direct marketing, withdraw consent you have given, and not be subject to a decision based solely on automated processing. How to exercise these rights is set out on our Data Requests page.
15. Complaints
If you are unhappy with how we have handled your personal information, please contact us first at info@iab.co.bw so we can try to put it right. You also have the right to complain to Botswana's Information and Data Protection Commission. We have not reproduced the Commission's contact details here rather than risk publishing details we have not verified; they are available from the Commission's own published material.
16. Contact
Privacy questions and data-subject requests: info@iab.co.bw, or write to us at Lot 102, Unit 1, Light Industrial Commerce Park, Gaborone, Botswana. Whether iAB must formally designate a Data Protection Officer under the Act is being assessed against our processing as a whole; we will publish those details if one is designated. A dedicated privacy mailbox is planned and this notice will be updated when it is live.