Privacy Policy

This policy explains what personal information Unearth Botswana (Pty) Ltd collects, why we use it, who we share it with and the choices you have. We follow Botswana's Data Protection Act, 2024. We never sell your personal information.

1. Who is responsible

Unearth Botswana (Pty) Ltd, company registration number BW00009130916, of Maun, Botswana is the data controller for the personal information described in this policy. You can contact us about privacy at any time at info@unearthbotswana.co.bw or on +267 73 776 447.

• "Unearth", "we" and "us" mean Unearth Botswana (Pty) Ltd. "You" means anyone whose personal information we handle, including travellers ("Guests"), people who make enquiries, website visitors, account holders, photographers who send us images, donors to Unearth Gives, and contact people at our lodge, camp and operator partners ("Partners").
• "Personal information" means any information about an identified or identifiable living person, as defined in the Data Protection Act, 2024 (Act No. 18 of 2024) (the "Act").
• Our use of personal information is supervised by the Information and Data Protection Commission of Botswana (the "Commission").
• This policy covers our website unearthbotswana.co.bw, the Unearth account and Partner Hub, our AI assistant Zoe, and our emails, phone calls and WhatsApp messages. It does not cover the websites of Suppliers or other businesses we link to; they have their own policies.

2. What we collect

• Contact and identity details: name, email, phone, country, and the names of the people travelling with you.
• Trip details: dates, places, preferences, budget, and the lodges and activities you choose.
• Travel documents: nationality, and, when needed for a booking, passport details and dates of birth.
• Special category information: dietary, medical, mobility or accessibility needs that you choose to tell us so that Suppliers can look after you, and children's ages. We use this only with your consent and only to arrange your trip.
• Payment information: payment amounts, references and status. Card payments are handled by DPO Pay; your card number goes directly to them and never reaches Unearth.
• Messages: enquiries, emails, WhatsApp and in-account messages, reviews and survey answers.
• Account and website information: your sign-in details (passwords are stored encrypted), saved trips, and basic technical information such as your browser and IP address used for security.
• Photos and films you send us: the images themselves, which may show you or other people, your name and social media handle or website for the credit, where they were taken, and the email you sent them from.
• Partners: for lodges and operators, business details, contact people, licences and documents, and bank details for payouts.

More detail on some categories

• Children's information: names, dates of birth or ages, passport details and any dietary or medical needs of Guests under 18. We collect this only from a parent, guardian or the Lead Traveller acting with their authority (see section 12).
• Special categories: health information (including allergies, pregnancy, medication, weight where a light-aircraft or riding operator needs it, and disability) is a special category of personal information under the Act. Dietary needs can sometimes reveal religious belief. We ask only for what Suppliers need, and we handle it with extra care.
• Emergency contacts: the name and phone number of someone we can contact if there is an emergency during your Trip. Please tell them that you have given us their details.
• Insurance details: your insurer's name, policy number and emergency assistance number.
• Payments: DPO Pay processes card payments under its own security standards. We receive confirmation of the amount, date, the last four digits of the card and the payment status, but never the full card number or security code. For bank transfers, we see the payer's name and bank reference.
• Partner bank details: account details for payouts are stored securely. Our staff see only part of the account number (for example the last four digits) unless their role is to make or verify payouts.
• Unearth Gives: donors' names, contact details, amounts given and the project chosen, and whether they want to be named publicly.
• Calls and video calls: we do not record calls unless we tell you at the start and you agree.

Where we get it from

• Mostly from you, or from the Lead Traveller when you travel on someone else's booking.
• From Suppliers, for example a camp's report of an incident or a change to your flight.
• From travel agents, tour operators or companies that book with us on your behalf.
• From DPO Pay and our bank, to confirm payments.
• From public sources such as company registers, for Partners.

3. Why we use it, and our legal basis

Where we rely on legitimate interests, we have balanced our interests against your rights and you can object (see section 9). Where we rely on consent, you can withdraw it at any time; this does not affect what we did before, but it may mean a Supplier cannot meet a particular need.

4. Who we share it with

• Suppliers on your itinerary: the lodges, camps, airlines, transfer and activity operators who need your details to provide your services. Some are outside Botswana, for example in Zimbabwe, Zambia, Namibia or South Africa.
• DPO Pay, to process card payments.
• Our technology providers: Triton Networking Technology (Botswana), which hosts and supports our website, and our email provider.
• Our AI provider: questions you type to Zoe, our AI assistant, are sent to Anthropic (United States), which generates the answer for us. Please do not type passport, payment or health details into Zoe. Zoe's conversations are not saved in your Unearth account.
• Professional advisers and authorities: our accountants, auditors, lawyers and insurers, and authorities where the law requires it.

We require everyone we share information with to keep it secure and use it only for the agreed purpose.

More about how we share

• Suppliers receive only what they need for your services, for example names, ages and passport numbers for flights and park permits, and dietary or medical needs for camps. Each Supplier is responsible for how it uses your information under its own privacy policy and the law that applies to it.
• Automatic translation: when you choose another language on our website, page text and, where you use it, message text may be sent to Anthropic to translate it. Translation is done for us and on our instructions.
• How Anthropic may use information: Anthropic acts as our service provider (processor). Under our arrangements, it may use what is sent only to provide the service to us. It may not use it for advertising or sell it.
• Our staff and agents see only what their role needs. Everyone who works for us is bound by confidentiality.
• Emergency services and medical providers: if there is an emergency during your Trip, we may share your health, insurance and emergency contact details with doctors, evacuation services, your insurer and your emergency contact.
• Authorities: immigration, police, tax, wildlife and other public authorities, where the law requires it or to protect someone's safety.
• Business changes: if our business or part of it is sold or reorganised, the new owner may receive the information it needs to continue serving you, under this policy.
• We do not share personal information with advertisers, and we do not sell it.

5. Information sent outside Botswana

Travel often means sharing information across borders, for example with a lodge at Victoria Falls or an airline in South Africa. We transfer personal information outside Botswana only as the Data Protection Act allows: where the country has been approved, where the transfer is necessary for your contract, where you have consented, or with appropriate safeguards in place.

• Transfers to Suppliers outside Botswana are usually necessary to perform your contract.
• Our AI and translation provider Anthropic is in the United States, and some email and cloud services may store information in other countries. For these, we rely on contractual safeguards that require the provider to protect personal information to a standard at least equivalent to the Act, and on other safeguards the Act allows.
• You can ask us for more information about the safeguards for a particular transfer.

6. How long we keep it

• Booking, payment and accounting records: as long as tax and company laws require, generally up to seven years after your trip.
• Enquiries that do not become a booking: up to two years, so we can help if you come back.
• Medical, dietary and accessibility information: deleted or anonymised within one year after your trip unless you ask us to keep it.
• Photos and films you send us: while they are published, then deleted within 30 days after you withdraw permission or we remove them. We keep the email that gave permission for up to two years after that, in case of a dispute.
• People shown in a published photo or film who did not send it can ask us to remove it at any time, and we will.
• Your account: until you ask us to close it, after which we keep only what we must keep by law.

When information is no longer needed we delete it securely or anonymise it so that it no longer identifies anyone.

7. How we protect it

We use encrypted connections, access controls so that staff see only what their role needs, secure payment through DPO Pay, regular software updates and backups. If a personal data breach is likely to put your rights at risk, we will notify the Information and Data Protection Commission and, where required, you.

• Staff accounts are protected by strong passwords and, where available, two-step sign-in.
• Sensitive fields such as Partner bank details are partly hidden from staff who do not need them.
• We train our staff on data protection and on spotting fraud, such as fake payment requests.
• No system is completely secure. Please keep your account password private and tell us at once if you think your account or information has been misused.

If there is a data breach

If we discover a breach of security that affects personal information, we will act quickly to contain it and assess the risk. We will notify the Commission within the time the Act requires. Where the breach is likely to result in a high risk to you, we will also tell you without undue delay, explain what happened and what you can do to protect yourself.

8. Automated decisions

We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you. Zoe's answers and our automatic translations are tools to help you; a person at Unearth makes every booking, pricing and Partner vetting decision.

9. Your rights

You may ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong or incomplete;
• delete information we no longer need or have no right to keep;
• stop using your information for direct marketing, or object to other processing;
• withdraw a consent you have given (this does not affect what we did before).

Email info@unearthbotswana.co.bw. We will reply within 30 days and may ask you to prove your identity. If you are not happy with our answer you can complain to the Information and Data Protection Commission of Botswana.

• You may also ask us to restrict our use of your information while a concern is checked, and, where the Act gives this right, to receive information you gave us in a commonly used electronic format.
• Requests are free, unless they are clearly unfounded or excessive, in which case the Act may allow us to charge a reasonable fee or refuse.
• Some information we must keep by law, or to deal with a legal claim, even if you ask us to delete it. We will explain if this applies.
• If we cannot reply within 30 days because a request is complex, we will tell you why and when we will reply.
• Someone else, such as a family member, may make a request on your behalf if they show us your written authority.
• We encourage you to contact us first so we can try to resolve your concern, but you may complain to the Commission at any time.

10. Zoe, our AI assistant

• When you chat with Zoe, the text you type and Zoe's replies are sent to our AI provider to generate answers, as described in section 4.
• Your conversation may be kept in your browser while your session is open, so that Zoe can follow it. We do not save it in your Unearth account or use it for marketing.
• To protect the service from misuse, we limit how many messages can be sent in a period. To do this we keep short-lived technical records, such as an anonymised device or network identifier and the number of messages sent.
• Please do not share passport numbers, payment details, health information or other sensitive information with Zoe. If you need to give us this information, send it to your specialist.
• If you ask Zoe to pass your enquiry to a specialist and give your contact details, we treat that as an enquiry under this policy.

11. Marketing

We send news and offers only if you have agreed. Every email includes a way to unsubscribe, and you can also reply "stop" on WhatsApp or tell your specialist.

• We will still send you service messages about a booking or enquiry, such as confirmations, payment reminders and travel updates, even if you opt out of marketing.
• We do not use your information to show you advertising on other websites.

12. Children

Our website is not for children. We collect children's details only from a parent or guardian, and only what is needed for the trip.

• Nobody under 18 may open an Unearth account, make a booking, chat with Zoe or send us photos or films.
• The Lead Traveller confirms that they are the parent or guardian of each child on the booking, or have the parent's or guardian's authority to give us the child's details.
• We do not publish photos or films in which a child can be recognised unless a parent or guardian has agreed.
• If we learn that we have collected information from a child without proper consent, we will delete it.

13. Cookies and similar storage

We use only the cookies and browser storage needed to run the website: to keep you signed in, remember your saved trip and choices, and protect forms against misuse. We do not use advertising cookies. If we add analytics in future, we will update this policy.

These items are strictly necessary for the website to work, so we do not ask for consent to use them. You can clear them in your browser settings, but parts of the website may then stop working.

14. Photos and films

• If you send us photos or films for our Through Your Lens gallery, we use them and your credit details as described in sections 2, 3 and 6 and in our Website Terms of Use.
• You must have the agreement of every person who can be recognised in them, and of a parent or guardian for anyone under 18.
• If you appear in a photo or film on our website or social media and want it removed, email info@unearthbotswana.co.bw. We will take it down promptly, and within 10 working days at the latest, whoever sent it.
• We remove location details from published images where they could put wildlife at risk, such as the location of rhino.

15. Partners

• We use the details of Partner contact people to vet the Partner, manage listings and bookings, pay the Partner and keep business records.
• Where we send a Partner details of Guests, the Partner becomes responsible for that information as a separate controller, under the Partner Agreement and the law that applies to it.

16. Changes to this policy

We may update this policy. The current version and date are shown at the top of this page, and we will tell account holders about important changes.

If you have any question about this policy, contact us at info@unearthbotswana.co.bw or on +267 73 776 447.

Questions about this document? Contact Unearth Botswana (Pty) Ltd at info@unearthbotswana.co.bw or +267 73 776 447.