This policy explains what personal data Polelo Trading Academy collects, why we collect it, how long we keep it, who we share it with and what you can require of us. It is written to meet our obligations as a data controller under the Data Protection Act, 2024 (Act No. 18 of 2024) of Botswana, which came into force on 14 January 2025 and replaced the Data Protection Act of 2018.
It applies to www.polelotradingacademy.ac.bw, the member portal and the trading journal platform. Words like "personal data", "processing", "data controller" and "data subject" carry the meanings given to them in the Act.
Polelo Trading Academy is the data controller for the personal data described in this policy. We are an online trading education provider based in Botswana.
The supervisory authority for data protection in Botswana is the Information and Data Protection Commission (IDPC). You may contact the Commission directly about anything in this policy — see section 15.
The Act requires that personal data be handled lawfully and fairly. In practice that means we commit to the following, and you can hold us to them:
The Act gives special protection to data revealing race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sexual life, and to genetic and biometric data. We do not ask for any of it and we have no legitimate use for it. Please do not send it to us.
One caveat, stated plainly: the trading journal invites you to record how you felt while trading, because emotional discipline is part of what we teach. If you choose to write something there that touches on your health or wellbeing, it becomes data we hold. You control what you write, you can edit or delete any entry at any time, and we do not analyse those notes for any purpose other than showing them back to you and generating your own performance statistics.
The Act requires a lawful basis for every processing operation. Ours are as follows.
| What we do | Why | Lawful basis |
|---|---|---|
| Assess your application and run the admission interview | To decide whether the programme suits you | Steps taken at your request prior to entering a contract |
| Create and administer your account; control access to paid content | To deliver the membership you bought | Performance of a contract |
| Verify payment and activate membership | To confirm what you paid for | Performance of a contract |
| Deliver courses, resources, mentorship and support | The service itself | Performance of a contract |
| Send service messages — payment confirmations, access changes, expiry reminders | So you are not caught out by an account change | Performance of a contract |
| Send marketing emails — educational content, new intakes, offers | Marketing | Your separate opt-in consent, withdrawable at any time |
| Send WhatsApp community and marketing messages | Community and marketing | Your separate opt-in consent, withdrawable at any time |
| Keep the platform secure, throttle brute-force logins, diagnose faults | To protect your account and ours | Our legitimate interest in securing the service |
| Retain financial and tax records | Statutory bookkeeping | Compliance with a legal obligation |
Where we rely on legitimate interest, we have considered whether that interest is overridden by your rights and freedoms, and we have limited the processing accordingly. You may object to it — see section 14.
Two things we want to state plainly, because plenty of sites do the opposite:
There are two independent opt-ins — email and WhatsApp. Taking one does not take the other, and declining both has no effect whatsoever on your application.
Every marketing email carries a one-click unsubscribe link. You can also withdraw either consent at any time by writing to privacy@polelotradingacademy.ac.bw.
No decision that affects you — admission, pricing, access or removal — is made by automated processing or profiling. Applications are read and decided by a person. Your journal statistics are calculated automatically, but they are shown only to you and are not used to make decisions about your membership.
We use a deliberately small number of cookies, all of them strictly necessary for the site to function:
POLELO_SSO) — keeps you signed in and carries your session across the academy and the journal subdomain. It is set with the HttpOnly, Secure and SameSite=Lax flags, so it cannot be read by scripts and is only ever sent over HTTPS.We run no analytics, advertising, profiling or tracking cookies of any kind, and no third-party tracking pixels. Because our cookies are strictly necessary, no consent banner is required for them. If we ever introduce non-essential cookies we will ask for your consent first and update this policy before doing so.
We publish the cookie names and their security flags deliberately. None of it is secret — any visitor can see both in their browser's developer tools — and the protection comes from the flags themselves, not from concealing them. The one thing a cookie notice must never disclose is the cookie's value, which is the actual session secret, and we never do.
Most browsers let you block or delete cookies in their settings. Blocking our session cookie will prevent you from signing in.
We want to be completely specific here, because a phone number is the piece of data people most dislike having misused.
By ticking a box that is unticked by default on the application form, or on the free-resources form. We record the exact wording you agreed to, along with the date and your IP address, so the consent can be evidenced. We will never add you to a group silently, and we do not buy, scrape or exchange phone numbers.
Your decision has no bearing whatsoever on your application. Declining costs you nothing.
At any time, by any of these — all equally valid, all free, and none requiring a reason:
We action opt-outs promptly and, once you have opted out, we stop. You will still receive essential service messages about an active membership — a payment confirmation is not marketing — and you can close your account entirely if you want those to stop too.
A WhatsApp group may expose your phone number and display name to other members of that group, depending on how it is configured. That is a property of WhatsApp, not a choice we make, and we cannot undo it for messages already sent. Consider using a WhatsApp display name you are comfortable sharing.
WhatsApp is operated by a third party under its own terms and privacy policy. Messages sent through it are processed on its infrastructure, outside Botswana, not on ours.
Opting in to the community does not grant access to paid academy content.
The floating chat button asks for your name and email, then opens WhatsApp with a message already written. Two things worth being straight about:
Our lawful basis is the step you asked us to take at your request. You can ask us to erase a chat enquiry record at any time under section 14.
We run a small notice on our marketing pages saying that someone has recently joined the academy. Everything about it is real: it is generated from actual approved memberships, and we never invent names, numbers or sign-ups.
You appear there only if you have agreed to it. Specifically:
Our lawful basis is your consent, which you may withdraw at any time.
We do not sell your personal data, and we do not share it for anyone else's marketing. We disclose it only to the following, and only as far as each needs it:
Every processor acting on our behalf is bound to process your data only on our documented instructions, to keep it confidential, and to apply appropriate security — as the Act requires of us.
Some of the providers listed above operate servers outside Botswana. That means your personal data is transferred across borders.
Under the Act, a transfer of personal data to a country outside Botswana may only take place where that country ensures an adequate level of protection, or where an authorised alternative applies. The Commission treats a number of jurisdictions as offering adequate protection, including the states of the European Union and European Economic Area, South Africa, Japan, Israel, New Zealand and Uruguay. Where a destination is not covered by such a finding, we rely on your explicit consent or on contractual safeguards with the recipient, and we seek the Commissioner's authorisation where it is required.
If you would like to know exactly where your data is held and on what basis it is transferred, email privacy@polelotradingacademy.ac.bw and we will tell you.
| Data | Retention | Reason |
|---|---|---|
| Unsuccessful or withdrawn applications | 12 months from the decision | So we can recognise you if you reapply |
| Member account, learning records and journal entries | For the life of the account, then 12 months | So you can return without losing your history |
| Payment records and proofs of payment | 7 years | Tax and accounting obligations |
| Marketing and WhatsApp consent records | Until withdrawn, then 24 months | To evidence that consent was validly obtained |
| Chat-button enquiries | 12 months | To follow up and keep a record of what was asked |
| Failed login attempts | Rolling 15 minutes | Brute-force protection only |
| Server and security logs | Up to 12 months | Security and fault diagnosis |
You may ask us to delete your account and its contents sooner, and we will do so except where we are legally obliged to retain a record — principally financial records. When a retention period ends we delete the data or irreversibly anonymise it.
The measures we actually have in place:
Secure and HttpOnly.Botswana's Cybersecurity Act, 2025 (Act No. 21 of 2025) established a national framework for cybersecurity and a National Cyber Security Authority. We monitor the obligations arising under it and under the Digital Services Act, 2025 (Act No. 22 of 2025) as their subsidiary regulations are issued, and we will adjust our practices and this policy as required.
No online service can guarantee perfect security and we will not claim otherwise. What we can commit to is the response set out next.
The Act sets a firm timetable for reporting a personal data breach, and we will meet it:
Under the Act you have the following rights over your personal data. Exercising them is free of charge.
Email privacy@polelotradingacademy.ac.bw. We will acknowledge your request promptly and respond substantively within 30 days. If a request is genuinely complex and we need longer, we will tell you why within those 30 days. We may need to verify your identity first, so that we do not disclose your data to somebody else — we will ask only for what is necessary to do that.
You can also delete your own account directly from your account settings.
If you are unhappy with how we have handled your personal data, please raise it with us first at privacy@polelotradingacademy.ac.bw — most issues are resolved quickly at that stage.
You have the right to complain to the supervisory authority regardless of whether you come to us first:
Information and Data Protection Commission (IDPC)
Republic of Botswana
www.idpc.org.bw
The Act treats the personal data of minors as requiring special protection. The Academy is intended for adults: we do not knowingly accept applications from, or create accounts for, anyone under the age of 18. We do not direct any marketing at children.
If you believe a minor has given us personal data, contact privacy@polelotradingacademy.ac.bw and we will verify and erase it promptly.
When we change this policy we update the date at the top of the page. Where a change is significant — a new purpose, a new category of recipient, or a new basis for processing — we will notify members directly by email before it takes effect, and where the change requires your consent we will ask for it rather than assume it.
Any question, request or complaint about your personal data:
Chat with Polelo Trading Academy
Mon–Fri, 08:00–18:00 CAT
Tell us who you are and we'll pick it up on WhatsApp. Takes a few seconds.