Debswana Pension Fund (DPF) eKYC System
Privacy Notice
The Financial Intelligence Act together with complementary legislation aimed at combating money laundering and the financing of terrorism, requires Debswana Pension Fund (“DPF”) to conduct customer due diligence, commonly referred to as Know Your Customer (“KYC”) on all its members. For convenience, DPF provides this electronic platform through which members can submit their KYC documents. As with KYC submissions made in person or via email, this platform involves the collection of personal data. Read this Notice to understand why your personal data is collected, the corresponding legal basis, whom we share your personal data with, how long we retain it, your rights and information on any cross-border transfer of your data outside Botswana.
Purpose And Legal Basis For Processing
We collect personal data directly from you through prompts on the platform. The types of personal data we collect are informed by the Financial Intelligence Regulations and/or the need to effectively conduct enhanced due diligence from time to time. In addition to the data required by law, we will collect certain personal data not explicitly specified in the legislation, namely biometric data in the form of facial recognition. This is used solely for identity verification purposes and is obtained through a video selfie, which you will be prompted to take during the submission process. We assure you that your personal data will be processed only for the purposes described above. In doing so, we rely on the following lawful grounds for processing personal data:
| Personal Data | Legal Basis |
|---|---|
| All the personal data collected save for next of kin details and biometric data | Compliance with a legal obligation |
| Next of kin details | Legitimate interest to enable contact when the member is unreachable (e.g., during KYC updates) |
| Biometric data (facial recognition via video selfie) | Consent |
Recipients Of Your Data
Where necessary, your personal data will be disclosed to relevant regulatory authorities, including the Financial Intelligence Agency and the Non-Bank Financial Institutions Regulatory Authority. Your personal data will also be shared with third-party service providers engaged by DPF to support the due diligence process and fund operations. This includes, Guidepoint, the provider of the electronic due diligence platform and Mmila Fund Administrators, which, in accordance with the Retirement Funds Act, provides fund administration services to DPF. From time to time, we may also share your personal data with other parties such as law enforcement agencies, actuaries, investment managers, auditors, and other professional service providers engaged by DPF.
International Transfers
Your personal data will be processed outside Botswana to achieve the purposes described in this Notice. Specifically, such processing takes place in South Africa and/or the European Union, both of which have been recognised by law as providing adequate levels of data protection. In instances where your personal data is transferred to countries that do not have an adequacy decision, we will ensure appropriate safeguards are in place or rely on permitted derogations under data protection laws to lawfully transfer your data.
Data Retention
We will retain your personal data, excluding biometrics, for a period of 20 years following the termination of your relationship with us, in accordance with the requirements of the Financial Intelligence Act. Biometric data collected for facial recognition purposes will be retained for no longer than 7 working days, unless a longer retention period is required by law.
Your Data Protection Rights
You have the right to:
- Request access to your data.
- Ask for correction of your data.
- Ask for deletion of your data, provided that this is permitted by the law.
- Request restriction of processing i.e. we limit how your data is used.
- Object to the processing of your data, for personal data processed on the basis of legitimate interest.
- Request a copy of your data in a structured, commonly used and machine-readable format for personal data processed on the basis of consent.
- Withdraw consent at any time without affecting any processing that took place before the withdrawal.
Some rights may be subject to conditions based on the purpose and legal basis of processing. To exercise your rights, please contact us. We will explain any applicable limitations. You also have the right to lodge a complaint with the Information and Data Protection Commission. We encourage you to contact us first so we can resolve your concerns directly.
Automated Decision-Making
The platform uses automated tools like Optical Character Recognition (OCR) and facial recognition to help verify your identity. These tools assist the process but do not make final decisions that affect your rights or access to services.
Acknowledgement
By clicking "Acknowledge and continue", you confirm that you have read and understood this Privacy Notice.
