AUCTION IT (Pty) Ltd – Privacy Policy (Condensed Version)
Last updated: Tuesday, 6 May 2025
This notice explains—in plain English—how we handle your personal information when you visit auctionit.bid or our physical grounds, register, bid, buy or sell with us. It follows the Botswana Data Protection Act, 2018 . For the full legal wording, click “Full Privacy Policy” below on this page or ask for a copy at reception.
1. Who controls your data?
- Controller: Auction It (Pty) Ltd, Plot 22030 Takatokwane Way, G‑West Industrial, Gaborone.
- Data‑Protection Officer (DPO): [email protected] | +267 75 065 378.
- Record of Processing: We keep a statutory Record of Processing Activities (ROPA) and will register/renew registration with the Information & Data Protection Commission (IDPC) as the BDPA requires (s.19 & s.41).
2. What we collect & why
| Category | Typical items | Purpose |
|---|---|---|
| Identity | Name, national ID/passport, date of birth | Verify you, draft contracts, prevent fraud |
| Contact | Address, e‑mail, phone | Send invoices, auction alerts, delivery info |
| Finance | Bank‑account, source‑of‑funds proof | Settle payments & refunds, AML compliance |
| Sensitive documents | Copy of national ID, bank statements | Processed only with your explicit consent or where the law requires |
| Auction | Bidder number, bids, purchases, title docs | Run the auction, transfer ownership, keep records |
| Tech | IP address, device type, cookies, logs | Secure our systems, basic analytics |
We do not target or knowingly collect data from anyone under 18 years of age. (BDPA s.28) BCRA.
3. Our legal bases
- Contract – register you, accept bids, issue invoices, transfer titles.
- Legal obligation – AML checks, tax reporting to Botswana Unified Revenue Services (BURS), court orders.
- Legitimate interest – fraud detection, IT security, service improvement (never overriding your rights).
- Consent – optional marketing e‑mails (opt‑out anytime).
4. How—and with whom—we share data
- Sellers & buyers – limited details to finalise a sale.
- Service providers – payment processors, IT hosts, insurers, logistics, auditors (all under confidentiality contracts).
- Regulators & courts – when the law requires.
- No sale of data to ad networks or unrelated third parties.
4‑A. Botswana Unified Revenue Services (BURS) compliance
- What we disclose: transaction values, buyer/seller identity, VAT status & supporting papers BCRA.
- Why: Botswana tax law obliges us to file accurate auction‑turnover data & withhold/remit taxes.
- Frequency: per auction event & in statutory returns.
- Safeguards: secure, BURS‑approved digital channels; local copy kept under our 7‑year schedule.
- Your right: ask what was filed & correct errors before deadlines.
5. International transfers
Primary records stay in Botswana. Transfers abroad occur only if:
- the destination is on the Minister’s “adequate‑protection” list ; or
- the IDPC has authorised the transfer; or
- you give explicit, informed consent.
A copy is always kept in Botswana and contractual safeguards apply.
6. Cookies
- Essential (site functions), analytics (visitor numbers), security (fraud prevention).
- No third‑party ad‑tracking cookies. Blocking cookies may impact functionality.
7. Retention & deletion
| Phase | Location | Duration |
|---|---|---|
| Active | Secure internal servers | While you have an account or open transaction |
| Archive | Encrypted cloud in Botswana | Up to 7 years after last activity |
| Deletion | Secure wipe of all systems | At 7 years, unless the law requires longer |
8. Security
TLS encryption in transit; database encryption at rest; firewalls; role‑based access; multi‑factor staff login; regular penetration tests; 72‑hour breach notification plan DLA Piper Data Protection.
9. Automated decision‑making
Auction It does not make decisions that have legal or similarly significant effects solely by automated means.
10. Your rights (free; answered within 30 days)
- Access – know what we hold.
- Rectify – fix inaccuracies.
- Erase – request deletion when lawful.
- Restrict / Object – limit or stop certain uses.
- Portability – receive your data in a machine‑readable file.
- Withdraw consent – marketing or any consent‑based use.
- Complain – to us or the Information & Data Protection Commission: Tel +267 365 3700 | [email protected] DLA Piper Data Protection.
Contact [email protected] or visit our office to exercise any right.
11. Need the fine print?
This page is a detailed overview, but not the entire contract. For definitions, special‑case processing, and our full Data‑Breach Response Plan, please read the Full Privacy Policy.
