Privacy Policy & Data Protection

Automate Africa, a subsidiary of UnoWorld Technologies, builds AI, automation and cloud systems for businesses and government in Botswana. Our office is at Plot 68, Commerce Park, Gaborone.

For the information described in sections 3 to 11 we are the data controller — we decide what is collected and why. For the client data described in section 12 we act as a data processor, on our client's instructions.

This policy covers automate.co.bw, the enquiry and prototype request forms on it, the email and phone channels listed at the end, and our WhatsApp business number. It also covers the professional services we deliver to clients.

It does not cover third-party websites we link to. Once you follow a link away from this site — including to WhatsApp, YouTube or Google Maps — that provider's privacy policy governs what happens there.

We do not ask for sensitive personal information — health records, biometric data, political or religious views — through this website. Please do not put it into an enquiry form.

• Responding to your enquiry and preparing a proposal, quotation or prototype scope.
• Delivering, supporting and maintaining the systems you have engaged us to build.
• Sending operational messages about a project you are involved in — timelines, releases, incidents.
• Improving this website and understanding which content and channels actually start conversations.
• Meeting our legal, tax, audit and regulatory obligations in Botswana.

We do not sell your information, and we do not share it with third parties for their own marketing.

Under the Data Protection Act, 2018 of Botswana we process personal information only where we have a lawful basis for doing so. In practice that is one of four:

• Your consent — when you submit an enquiry or ask us to contact you.
• Performance of a contract — when we deliver and support a system you have engaged us to build.
• Legitimate interests — running, securing and improving our website and our business, where that does not override your rights.
• Legal obligation — tax, company and regulatory record-keeping.

WhatsApp is our primary contact channel, and several buttons on this site open a WhatsApp conversation with a message pre-filled. The enquiry form on the contact page works the same way: it does not store your details on a server of ours, it composes a message and hands it to WhatsApp. Nothing leaves this website until you press send there.

Once you do send it, the conversation is delivered and stored by WhatsApp under its own terms and privacy policy, and a copy sits in our business inbox. We use those conversations to answer you and to keep a record of what was agreed.

This site does not use advertising or cross-site tracking cookies. Where analytics is enabled, we use Google Analytics to count page views and to see which calls to action lead to a conversation. It sets its own cookies and processes that data under Google's privacy policy.

We read this data in aggregate; we are not trying to identify individual visitors from it. You can block cookies in your browser settings — the site works without them.

We share personal information only where it is necessary, and only with:

• Service providers — the suppliers we rely on to run the business — hosting, cloud infrastructure, email, messaging and analytics — each bound to process data only on our instructions.
• Professional advisers — auditors and legal counsel, under a duty of confidentiality.
• Authorities — where we are required to disclose information by law or a valid court order.

Some of the infrastructure we use — cloud hosting, email, messaging and analytics — operates from data centres outside Botswana. Where personal information is transferred out of the country we do so in line with the Data Protection Act, 2018, and only to providers that offer an adequate level of protection through their own compliance programmes and contractual commitments.

Where a client requires data residency inside Botswana we can build and host to that requirement. Raise it before the project starts, so the architecture reflects it from the beginning.

We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including:

• Encryption of data in transit using TLS, and encryption at rest on the systems we host.
• Role-based access control, so staff only reach the data their work requires.
• Separate credentials per environment, with production access limited to named engineers.
• Logging and audit trails on the systems we build, so access to records can be reconstructed.
• Regular backups, with restore procedures tested rather than assumed.

No system is perfectly secure. If a breach affects your personal information we will notify you and the Information and Data Protection Commission as the Data Protection Act, 2018 requires, with what happened and what we are doing about it.

We keep enquiry correspondence for as long as the conversation is live and for a reasonable period afterwards, in case you come back to it. Records tied to a contract are kept for the life of the engagement and then for the period our tax and company law obligations require.

When information is no longer needed for any of those purposes we delete it, or anonymise it so it can no longer be linked to you.

When we build and run a system for a client — payroll and attendance, document digitization, a WhatsApp chatbot, a point of sale — that system holds data about the client's employees and customers. For that data the client is the controller and Automate Africa is the processor. In practice:

• We process client data only on documented instructions from the client, for the purpose of delivering and supporting the system.
• We do not use client data to train models for other customers, and we do not reuse it for our own purposes.
• Access is restricted to the engineers assigned to that engagement, and access to production systems is logged.
• We support the client in answering access, correction and deletion requests from the people whose data is in the system.
• On termination we return or delete client data, as the client instructs, subject to any legal retention requirement.

Where a project involves biometric attendance, health records, financial records or government records, these commitments are set out in the engagement contract and, where required, a separate data processing agreement.

If you are an employee or customer of one of our clients and want to exercise your rights over data held in a system we operate, contact that organisation first — they are the controller, and we will support their response.

Under the Data Protection Act, 2018 you have the following rights over personal information we hold as controller:

To exercise any of these, email info@automate.co.bw. We respond within the period the Act allows. We may ask you to confirm your identity first, so that we do not disclose someone's data to the wrong person.

This website and our services are aimed at organisations, not children. We do not knowingly collect information from anyone under 18 through this site. If you believe a child has given us information, contact us and we will delete it.

We update this policy when our services, systems or legal obligations change. The date at the top of the page shows when it was last revised. Where a change materially affects how we handle your information we will say so, rather than relying on the date alone.

For any question about this policy, or to exercise your rights, reach us at:

If you are not satisfied with our response you may complain to the Information and Data Protection Commission, the supervisory authority for data protection in Botswana.