Data Protection Policy

This Policy sets out how Granjo Institute of Management (Proprietary) Limited (BW00002781374) and Granjo Holdings (Proprietary) Limited (BW00000125897), trading as Granjo Trainers and Consultants (together, "Granjo", "we", "us"), collect, use, store, share and protect personal data.

Granjo is committed to protecting the privacy of everyone whose personal data it handles, and to complying with the Data Protection Act, 2024 (Act No. 18 of 2024) of Botswana ("the Act"), the Electronic Communications and Transactions Act, and the requirements of the Botswana Qualifications Authority (BQA) and the Human Resource Development Council (HRDC).

Granjo is a data controller for the personal data described in this Policy.

This Policy applies to personal data of:

applicants, students, former students and graduates;

parents, guardians, sponsors and employers of students;

corporate clients, delegates and research or consultancy clients;

directors, employees, lecturers, contractors and job applicants;

suppliers, service providers and visitors; and

users of Granjo's website, Moodle, WhatsApp, social media and online forms.

It applies to all Granjo campuses (Gaborone, Francistown and Artesia), online operations, and all records in any form, including paper, electronic, audio, video and images.

It applies to all Granjo directors, staff, lecturers, contractors and anyone processing personal data on Granjo's behalf.

Personal data means any information relating to an identified or identifiable natural person, such as a name, Omang or passport number, contact details, photograph, results or payment records.

Sensitive personal data includes data about health, disability, religion, political opinions, sexual life, criminal records, genetic and biometric data, and the personal data of minors.

Processing means any operation on personal data, including collecting, recording, storing, using, sharing, transferring, archiving and destroying it.

Data subject means the person to whom personal data relates.

Data processor means a person or organisation that processes personal data on Granjo's behalf.

Personal data breach means any loss, theft, unauthorised access, disclosure, alteration or destruction of personal data.

Commission means the Information and Data Protection Commission established under the Act.

Granjo processes personal data in line with the following principles. Personal data must be:

processed lawfully, fairly and transparently;

collected for specified, explicit and legitimate purposes, and not used for unrelated purposes;

adequate, relevant and limited to what is necessary;

accurate and kept up to date;

kept no longer than necessary;

protected by appropriate security measures; and

processed in a way that Granjo can demonstrate complies with the Act (accountability).

Granjo processes personal data only where it has a lawful basis under the Act, namely:

the data subject's consent;

performance of a contract with the data subject, such as enrolment, training or employment;

compliance with a legal obligation, such as BQA, HRDC, tax, labour and anti-money laundering requirements;

protection of the vital interests of the data subject or another person, such as contacting a next of kin in an emergency; or

Granjo's legitimate interests, where these do not override the rights of the data subject.

The main purposes are:

Where Granjo relies on consent, the consent is recorded in writing (including electronically on Granjo's forms) and may be withdrawn at any time. Withdrawal does not affect processing already carried out.

Granjo processes sensitive personal data only where necessary and permitted by the Act, such as with the data subject's written consent or to meet a legal obligation.

Medical and disability information is used only to consider deferrals, special assessment arrangements and support. It is seen only by the staff who need it and is stored separately from general student records.

Personal data of students under 18 is processed with the written consent of a parent or legal guardian, and with additional care.

Granjo does not collect biometric data. If this changes, Granjo will first obtain consent and update this Policy.

Students and staff are asked to provide details of a next of kin or emergency contact. By providing these details, the student or staff member confirms that the next of kin has agreed to their details being given to Granjo for this purpose.

Next of kin details are used only to:

contact the next of kin in a medical or other emergency;

inform the next of kin if the student or staff member cannot be reached and there is a serious concern for their safety or wellbeing; and

deal with the student's or staff member's affairs in the event of death or serious incapacity, including any refund to the estate.

Granjo will not use next of kin details for marketing, fee collection or any other purpose, and will not disclose the student's or staff member's academic, financial or health information to the next of kin without consent, except in an emergency where it is necessary to protect life or health, or where the law allows.

A next of kin who is also the sponsor or the parent or guardian of a student under 18 may receive information in that capacity, as set out in this Policy.

Students and staff must keep next of kin details up to date. Changes are made on the Granjo Student Request Form or through the HR office. A next of kin may ask Granjo to remove their details at any time.

Next of kin details are deleted together with the student or staff file at the end of its retention period.

Granjo collects personal data directly from data subjects through application and request forms, enrolment, Moodle, email, WhatsApp, phone and in person.

Granjo may also receive personal data from sponsors, employers, schools, external examining bodies, HRDC, BQA, referees and recruitment platforms. Where this happens, Granjo will inform the data subject where required by the Act.

Granjo collects only the personal data it needs for the stated purpose.

Granjo does not sell personal data. Granjo shares personal data only where necessary, and only with:

the student's sponsor or employer, including attendance, progress and fee information;

BQA, HRDC and other regulators;

external examining and professional bodies;

government bodies where required by law, including the Botswana Unified Revenue Service and the Financial Intelligence Agency;

auditors, legal advisers and insurers;

service providers acting as data processors, such as Zoho (accounting, forms and email), Moodle hosting, payment gateways, banks, IT and cloud providers;

credit bureaus and debt collectors, for unpaid accounts after written notice; and

employers or third parties verifying a qualification, only with the student's written consent.

Granjo requires every data processor to sign a written agreement to process personal data only on Granjo's instructions, keep it confidential and secure, and notify Granjo of any breach without delay.

Some of Granjo's service providers, such as cloud-based accounting, forms, email and learning platforms, store data outside Botswana.

Granjo transfers personal data outside Botswana only where permitted by the Act, namely where:

the receiving country is recognised as providing an adequate level of protection;

the transfer is authorised by the Commission;

the data subject has consented; or

the transfer is necessary to perform a contract with the data subject, and adequate contractual safeguards are in place.

Granjo takes appropriate technical and organisational measures to protect personal data, including:

role-based access, so staff see only the data they need;

strong passwords and multi-factor authentication on accounting, banking, email and Moodle administrator accounts;

prompt removal of system access when staff leave;

locked storage for paper records and restricted access to offices holding personal data;

encryption of devices and secure, regular backups;

never sharing passwords, bank details or personal data by WhatsApp, email or phone without verification;

confidentiality undertakings in all staff and contractor agreements; and

data protection training for all staff handling personal data.

Subject to the Act, every data subject has the right to:

be informed about how their personal data is processed;

access the personal data Granjo holds about them;

have inaccurate or incomplete personal data corrected;

have personal data deleted where it is no longer needed and Granjo is not required by law to keep it;

object to processing, including direct marketing;

withdraw consent at any time; and

lodge a complaint with the Information and Data Protection Commission.

Requests must be made in writing, by students on the Granjo Student Request Form, and by others by email to the Data Protection Officer.

Granjo will verify the identity of the person making the request before releasing any personal data.

Granjo will respond within 30 days of receiving a complete request. Requests are free of charge, except that a reasonable administrative fee may be charged for repeated or excessive requests.

Granjo may refuse or limit a request where the law allows, for example where records must be kept by law, or where releasing them would disclose another person's personal data. Reasons will be given in writing.

Granjo keeps personal data only for as long as necessary for its purpose or as required by law, as follows:

At the end of the retention period, personal data is securely destroyed (paper records shredded, electronic records permanently deleted) or anonymised.

Any staff member who suspects a personal data breach must report it immediately to the Data Protection Officer.

The Data Protection Officer will contain the breach, assess the risk, and record it in the breach register.

Where a breach is likely to result in a risk to the rights and freedoms of data subjects, Granjo will notify the Information and Data Protection Commission without delay and, where feasible, within 72 hours of becoming aware of it.

Where the breach is likely to result in a high risk to data subjects, Granjo will inform the affected data subjects without undue delay, with advice on steps they can take to protect themselves.

Granjo sends marketing messages only to people who have consented, or to existing students and clients about similar programmes. Every marketing message includes a simple way to opt out, and opt-outs are actioned promptly.

Granjo will ask for consent before using an identifiable photograph or video of a person in marketing. Consent may be withdrawn at any time, but materials already printed or published may not be recalled.

Where CCTV is installed, signs are displayed. Footage is used only for security and investigations and is kept as set out in section 13.

Breach of this Policy by staff may result in disciplinary action, and may also be an offence under the Act.

Questions or complaints about the handling of personal data should be sent to the Data Protection Officer. Granjo will respond within 10 business days.

A data subject who is not satisfied may complain to the Information and Data Protection Commission.

This Policy is reviewed at least every three years, or sooner if required by changes in the law or Granjo's operations. The current version is published on www.granjo.com.