Privacy Policy

We care about your privacy

Access Bank Botswana is a commercial bank owned by Access Bank Plc and licensed by the Central Bank of Botswana. This Privacy Policy explains what information we collect, how we collect, share, use, and protect your personal information when you visit or use this site and other services offered by Access Bank Botswana. As our customers or other data subjects, be assured that we will keep protecting your information as we have always done. Our customers and other data subjects have the opportunity to make choices about how their personal information may be shared, and we encourage you to make choices that enable us to provide you with quality products and services that help you meet your financial needs.

This Privacy Notice is issued in accordance with the Data Protection Act, Act No. 18 of 2024.  Access Bank Botswana may process personal data in different capacities depending on the activity. In most cases, we act as a data controller where we determine the purposes and means of processing personal data, including account opening, customer due diligence, transaction processing, fraud prevention, regulatory reporting, customer service and marketing.

Where we appoint third parties to process personal data on our behalf and only on our documented instructions, they act as data processors and must comply with appropriate confidentiality, security, data protection and contractual obligations.

In some cases, we may share personal data with third parties who act as independent controllers, such as regulators, credit bureaus, payment networks, card schemes, correspondent banks, auditors, insurers, professional advisers and other financial institutions. These parties are responsible for complying with their own data protection obligations.

Where Access Bank Botswana and another party jointly determine the purposes and means of processing personal data, we may act as joint controllers. In such cases, we will take reasonable steps to define each party’s responsibilities, including transparency, security, data subject rights, complaints, retention and breach management.

Security of personal information

Safeguarding your personal information is our main concern. We maintain physical, electronic, and procedural safeguards that comply with applicable laws to protect your information from unauthorized access and use, accidental or unlawful alteration or destruction, and other unlawful or unauthorized processing. We engage in the continuous training of our employees in the proper management of personal information. When we use other companies to provide services, we require them to protect the confidentiality of the personal information they receive.

At Access Bank Botswana, we take data protection very seriously, and we provide our customers with all necessary data security to protect their personal information from unauthorized access. We require any third parties who carry out any work on our behalf to comply with appropriate compliance standards to protect your information. We are pleased to announce that we comply with the best global practices, requirements of the Data Protection Act, Act No. 18 of 2024, and all other relevant legislation.

Access to personal data is limited to authorized employees, contractors and service providers who require access for legitimate business purposes. Such people are subject to confidentiality obligations, access controls, monitoring and disciplinary or contractual consequences for unauthorized use or disclosure.

Where we become aware of a personal data breach, we will assess the nature, scope and likely impact of the breach and take appropriate containment, investigation and remediation measures. Where required by law, we will notify the Information and Data Protection Commission and affected data subjects within the applicable legal timelines and provide relevant information on the breach and steps taken to mitigate harm.

The information we collect

We collect personal information that is necessary to open and operate a bank account, as mandated by the Central Bank of Botswana and other applicable laws. This information may include, but is not limited to, your name, residential and contact address, telephone number, email address, photographs, confirmation letters, references, and official means of identification. Such personal data is collected voluntarily and in a clear manner when you access our products and services, whether online or offline.

When you visit any of our banking halls or use our automated teller machines (ATMs), closed‑circuit television (CCTV) systems and attached cameras may capture your images for security, safety, fraud prevention, and quality control purposes.

This Privacy Notice applies to personal data relating to our customers and prospective customers, as well as authorized signatories, directors, shareholders, beneficial owners, guarantors, next of kin, beneficiaries, payers, payees, complainants, visitors, suppliers, service providers, website users, and any other individuals whose personal data we process in connection with our business operations.

We may also process sensitive personal data where required or permitted by law. This may include biometric information, personal data relating to minors, health‑related information where relevant to a specific product or service, and information processed for legal, regulatory, fraud prevention, sanctions screening, or security purposes. We apply enhanced technical and organizational safeguards when processing sensitive personal data.

Where biometric data is collected or processed such as fingerprints, facial images, or other unique identifiers, this is done strictly where necessary for identity verification, security, fraud prevention, regulatory compliance, or service authentication purposes. Biometric data is protected using appropriate technical and organizational measures and will not be used for any unrelated purpose without a valid lawful basis.

How do we collect information?

We may collect information from a range of sources, and it may relate to any of our products or services we currently provide or may have provided in the past.

We collect your personal information when:

• You open an account or perform transactions such as making deposits or withdrawals from your account, and your payment history and transaction records are collected.
• You apply for a loan or use your credit or debit card.
• You seek advice about your investments.
• You seek information from our customer service provider, including information concerning complaints and disputes.
• We seek information about your credit history from credit bureaus.
• You provide account information such as your personal details (for example, name, gender, date and place of birth), contact information (such as your address, email address, and mobile numbers), and your employment information.
• You provide information concerning your identity, such as photo ID, passport information, National ID card and nationality.
• Your complete bank verification or customer verification procedures, including the provision of biometric information such as fingerprints, facial images, and other personal information as mandated by law.
• You use your login credentials to access our online banking platforms and mobile banking applications.
• Through our ATMs mounted with cameras to monitor transactions, in line with applicable Central Bank regulations.
• We conduct necessary investigations, including due diligence checks and AML/CFT checks, and obtain information required to meet our regulatory obligations, such as transaction details and information relating to the detection of suspicious or unusual activities.

Note: We may obtain personal data about you from third parties, including credit bureaus, regulators, public registers, sanctions and politically exposed person screening databases, fraud prevention agencies, employers, referees, correspondent banks, payment service providers, merchants, agents, group companies and other lawful sources.

Where you are connected to a corporate, business, trust, partnership or other legal arrangement, we may process your personal data in your capacity as a director, shareholder, beneficial owner, trustee, partner, authorized signatory, representative, guarantor, contact person or related party for onboarding, due diligence, account administration, regulatory reporting and financial crime prevention purposes.

We may also collect information about your computer or mobile device, including, where available, your IP address, operating system, and browser type, for system administration, security, fraud prevention, or our internal operational and commercial purposes. This information is generally used in aggregated or statistical form and does not, on its own, identify you personally.

When you use our mobile applications or digital banking platforms, we may collect device-related and usage information such as app usage data, login and authentication records, IP addresses, device identifiers, security credentials, transaction activity, and location indicators where enabled. This information is collected to provide our services, secure your account, prevent fraud, comply with regulatory requirements, and improve the functionality and security of our digital channels.

Basis for Processing Information

We shall process your information on the following basis:

• To enter and perform our contractual obligations.
• To comply with our legal obligations.
• For the performance of a statutory duty.
• For the legitimate interest of Access Bank Botswana and our Data Subjects.
• To satisfy a public interest.
• Prior consent has been obtained from data subjects for the use and processing of personal data.

The applicable lawful basis will depend on the specific processing activity. 

How we use your information

Access Bank will only use your information when you have provided your consent or when the Bank is required by law to do so, or when our services or contract require the same.

We use the information we collect to provide customers with excellent products and services, to manage our business and to offer enriched and enhanced customer experience.

We make appropriate use of your data to manage transactions, respond to your requests, and to provide you with more relevant products and services.

We use your information to deliver our products and services, carry out your instructions, and provide Online Banking, mobile banking and other online products and services.

We use this information to detect and prevent financial crimes, including fraud, financing for terrorism and money laundering, to ensure security and business continuity.

We will use your information to fulfil our compliance obligations, comply with applicable laws and regulations, and share it with regulators when necessary.

We may use your contact details to send you information about our products, services, offers, campaigns and events that were permitted by law or where you have consented. You may opt out direct marketing at any time by using the unsubscribed option provided, adjusting your preferences, contacting us, or following any other opt-out method made available by the Bank. We will not require you to accept direct marketing as a condition for receiving core banking services.

We may send you general announcements or important news about your account, request your feedback, and we believe you should be able to select what kinds of information you receive from us via email.

We may need to record conversations you have with us, including phone calls, face-to-face meetings, letters, emails, and any other kinds of communication. These recordings may be used to check your instructions to us and improve our product and service delivery.

We may record and monitor telephone calls, video calls, branch interactions, electronic communications and customer service engagements for identity verification, instruction confirmation, quality assurance, training, dispute resolution, fraud prevention, regulatory compliance and record-keeping purposes.

When you visit our branches, we use CCTV cameras for security reasons and record-keeping. CCTV footage and branch surveillance records are processed for safety, security, fraud prevention, incident investigation, dispute resolution, regulatory compliance and protection of customers, staff and property. Access to CCTV footage is restricted and footage is retained only for as long as necessary, unless required for an investigation, legal claim or regulatory purpose.

We may use data analytics, profiling and segmentation to understand customer needs, improve our products and services, manage risk, detect fraud, personalize customer experience, assess product suitability and support responsible business decision-making. Where profiling produces a legal or similarly significant effect, we will apply appropriate safeguards, including human review where required.

Who we share your information with

Towards enhancing our service delivery, we may share data with our technical support and other service providers, partners, associates, subsidiaries, and the Group. However, where applicable, we execute compliant data-sharing agreements or data-processing agreements to provide an extra layer of protection for personal information shared in the process.

To process payments and provide banking services, we may share personal data with payment systems, card schemes, correspondent banks, clearing houses, settlement systems, mobile money operators, merchants, agents, remittance providers and other financial institutions involved in completing or investigating transactions.

We may disclose personal data to regulators, supervisory authorities, courts, law enforcement agencies, tax authorities, financial intelligence authorities, ombudsman bodies, auditors or other authorized public bodies where required or permitted by law, regulation, court order, lawful request or regulatory obligation.

We may use secure technology platforms, cloud services, data centres, cybersecurity tools, digital banking platforms and other technology service providers to process and store personal data. Such providers are subject to due diligence, contractual controls, confidentiality obligations and security requirements appropriate to the nature of the data processed.

Cross-border transfers of personal data

Your personal data may be transferred to, stored in or accessed from countries outside Botswana, including where we use group entities, cloud service providers, correspondent banks, payment networks, technology providers or other service providers. Where we transfer personal data outside Botswana, we will ensure that appropriate safeguards are in place, which may include adequacy mechanisms, contractual protections, binding corporate rules, regulatory approvals or other lawful transfer mechanisms.

Where required, we will ensure that cross-border transfers are carried out in accordance with the Data Protection Act, Act No. 18 of 2024, and applicable regulatory requirements.

Individual rights

• The right to be informed
  To emphasize the need for transparency over the usage of personal data, we ensure fair processing and adequate provision of information, typically through this privacy policy.
• The right of access
  Individuals have the right to access information the Bank holds, access their personal data and other supplementary information and obtain information about how we process it.
• The right to restrict processing
  Individuals have a right to ‘block’ or withdraw their consent to our processing of their information, which you can do at any time. When processing is restricted, we are permitted to store personal data, but not further process it.
• The right to rectification
  Individuals is entitled to have their personal data rectified if it is inaccurate, out of date, or incomplete. If this personal data in question has been disclosed to third parties, they must be informed of the rectification, where possible. The Bank must also inform the individuals about the third parties to whom the data has been disclosed, where appropriate.
• The right to erasure/deletion
  Individuals have the right to request the deletion or removal of personal data where there is no compelling legal or regulatory requirement for its continued processing. The Bank will make sure that this right is protected.
• The right to data portability
  Where practicable, we will ensure that personal data is moved, copied or transferred easily from one IT environment to another safely and securely, without hindrance to usability.
• The right to object
  Individuals has the right to object to our processing of their information in some circumstances.
• The right not to be subject to solely automated decisions
  Where applicable, you have the right not to be subject to a decision based solely on automated processing, including profiling, where such decision produces legal effects or similarly significant effects concerning you, unless permitted by law and subject to appropriate safeguards.

Before responding to a rights request, we may request information to verify your identity and confirm your authority to act on behalf of another person. We may decline or limit a request that were permitted by law, including where disclosure would affect the rights of others, prejudice legal or regulatory obligations, compromise financial crime prevention, or interfere with legal claims, investigations or security controls.

Available remedies
In the event of an infringement of data protection rights, we will ensure any damage is remedied within the shortest possible time. However, you are at liberty of reporting to the Information & Data Protection Commission or seeking other legal remedies.

If you are dissatisfied with how we handle your personal data or respond to your request, you may first contact our Data Protection Officer or Privacy Office at botswanaprivacy@accessbankplc.com. You also have the right to lodge a complaint with the Information and Data Protection Commission or any competent supervisory authority, where applicable.

Time Frame for Remedy

At Access Bank Botswana, we are committed to promptly addressing any violations of data subjects' rights. Upon receiving a complaint or becoming aware of a breach, we will acknowledge the issue within 48 hours. We aim to fully resolve all issues within one month. In cases where more time is required due to complexity, we will inform the data about the extension and the reasons for it within the initial one-month period.

Where a matter involves a personal data breach, we will follow the applicable breach assessment, notification and escalation requirements under the Data Protection Act, Act No. 18 of 2024, including notification to the Information and Data Protection Commission and affected data subjects where required by law.

Cookies Policy

A cookie is a small file that is placed on your computer’s hard drive. Its functions include storing your login and session statuses, recording your user preferences, and analyzing web traffic.

Cookies enable websites and applications to store your user preferences in order to enhance your overall website experience by better understanding your preferences, likes and dislikes. They also allow websites to identify when users are logged on to their site and when they return to their site, test new content and analyze web traffic with data analytics. Apart from the data that you choose to disclose and share with us; we cannot access your computer or any other information about you through cookies.

Although most browsers automatically accept cookies, you can amend your browser settings to disable cookies. This may, however, prevent you from fully experiencing the website as it was intended.

We may use strictly necessary cookies to operate our website and digital channels, preference cookies to remember your choices, analytics cookies to understand usage and improve performance, and marketing cookies to provide relevant content and measure campaign effectiveness. Where required, we will request your consent before placing non-essential cookies on your device.

You may manage or disable cookies through your browser settings or any cookie preference tool made available on our website.

How long do we keep your information?

Access Bank Botswana retains your personal information only for as long as it is necessary and relevant to fulfil the purposes set out in this Privacy Policy, unless a longer retention period is required or permitted by applicable law. Where we no longer have an ongoing legitimate business need to process your personal information, we will either securely delete or anonymize such data. Where deletion or anonymization is not immediately possible, such as where personal data is stored within backup archives or disaster recovery systems, we will securely retain the information, restrict access to it, and isolate it from further active processing until it can be safely deleted or anonymized.

We retain personal data for as long as necessary to provide banking and related services, manage and maintain our relationship with you, comply with legal, regulatory, tax, accounting, audit, anti‑money laundering, counter‑terrorism financing and record‑keeping obligations, resolve complaints or disputes, enforce contractual agreements, prevent and detect fraud, and protect our legitimate interests. Retention periods may therefore vary depending on the nature of the personal data, the relevant product or service, the type of transaction involved, and the applicable legal or regulatory requirements.

Where appropriate, we may anonymize, aggregate or otherwise de‑identify personal data so that it can no longer reasonably be used to identify you. Such anonymized or aggregated information may be retained and used for lawful purposes including analytics, research, reporting, product and service development, risk management, service enhancement and statistical analysis.

We may also process and store personal data within backup systems, disaster recovery environments and business continuity arrangements to ensure operational resilience, regulatory compliance, service continuity and the secure restoration of systems and services in the event of a disruption or system failure. Personal data held in these environments is subject to appropriate technical and organizational safeguards and is accessed only where necessary for recovery, continuity or compliance purposes.

Children

Access Bank Botswana understands and acknowledges the importance of safeguarding children’s privacy; hence, our sites are not intentionally designed for or directed at children under the age of 18. It is our policy never to knowingly collect or maintain information about anyone under the age of 18, except as part of an engagement to provide child-categorized account opening services, which requires parental guardianship.

Data security and integrity

We have implemented reasonable and effective security policies and procedures to protect your personal information from unauthorized access, data loss, misuse, alteration, or destruction. To the best of our ability, access to your personal information is limited to those who have a need to know and are required to always maintain the confidentiality of such information. Despite our best efforts and intentions, we acknowledge that security cannot be guaranteed against all threat actors. Hence, we also make reasonable efforts to retain personal information only for so long:

• as the data subject asks that the information be deleted;
• as necessary to comply with legal, regulatory, internal business or policy requirements; or
• The information is necessary to comply with an individual’s request.

We apply privacy by design and by default by embedding data protection controls into our products, services, systems, processes and third-party arrangements from the earliest stages of design and implementation.

Where processing is likely to result in a high risk to the rights and freedoms of individuals, we will conduct a Data Protection Impact Assessment before commencing the processing. This may apply to new technologies, biometric processing, large-scale profiling, automated decision-making, surveillance, high-risk data sharing or other processing activities requiring enhanced privacy assessment.

Principles of data protection

• The principles of data processing which our Bank fulfils include the following:
• We ensure our processing of personal data is lawful, fair, and transparent.
• We only collect the required and relevant personal data for our services and activities.
• We retain personal data for only as long as necessary or permitted by law.
• We ensure that the personal data kept up is updated and accurate.
• For as long as practicable, we enable the transfer of data from our Bank to other entities when requested.
• We only use the data collected for the purpose disclosed or contemplated.

We remain accountable for the personal data controlled by us. Kindly inform us promptly of any changes to your personal data, including your contact details, identification information, employment details, beneficial ownership information or other relevant records.

Automated decision making

Except as otherwise declared by the Data Protection Act, we do not engage in automated decision-making, as all our processes have human intervention.

We may use automated tools, rules, models or scoring systems to support decisions relating to identity verification, fraud prevention, credit risk, transaction monitoring, service eligibility and customer experience. Where a decision is made solely by automated means and produces legal or similarly significant effects, we will inform you where required and provide appropriate safeguards, including the right to request human intervention, express your view or contest the decision.

Data Subject Access Request (DSAR) Form

As part of our commitment to protecting your privacy, we provide a Data Subject Access Request (DSAR) Form. This form allows you to exercise your rights under applicable data protection laws to access your personal data that we hold.

By clicking HERE, you will be directed to the DSAR Form. Please complete the form with the required information and submit it in person at your nearest Access Bank Branch.

When you submit a DSAR or any other rights request, we may require proof of identity and sufficient information to locate the relevant personal data. We will respond within the timelines required by applicable law, subject to any lawful extensions, exemptions or restrictions.

Contact us

Your privacy is important to us, and we are dedicated to handling your personal data with care and transparency.

If you would like further information on anything included in this Privacy Policy, contact us at:

Access House
Fairgrounds Office Park
Plot 62433
Gaborone, Botswana
botswanaprivacy@accessbankplc.com

You may contact our Privacy Office regarding any question, request, complaint or concern relating to how we process your personal data through: botswanaprivacy@accessbankplc.com or at Access House, Fairgrounds Office Park, Plot 62433, Gaborone, Botswana.

Updates to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in law, regulation, our products, services, systems or processing activities. The latest version will be made available through our website, branches or other appropriate channels, and the effective date will be clearly indicated.