Terms & Policies

1. Introduction

Broadhurst 4x4 (Pty) Ltd ("we", "us", "our", or "the Company") is committed to protecting the privacy and personal data of our customers, suppliers, credit applicants, sureties, and other individuals whose personal data we process.

This Privacy Policy explains how we collect, use, store, share, and protect personal data in compliance with the Data Protection Act, 2024 (Act No. 18 of 2024) ("the Act"), the Credit Information Act, 2021 (Act No. 15 of 2021), and the Cybercrime and Computer Related Crimes Act, 2018.

This policy applies to all personal data processed by us, whether collected through credit applications, account management, service delivery, or any other business interaction. It should be read in conjunction with our General Trade Terms and Conditions.

2. Data Controller Details

The data controller responsible for the processing of your personal data is:

Any queries, requests, or complaints regarding this policy should be directed to the email or physical address above, marked for the attention of the Accounts Department.

3. Personal Data We Collect

3.1 Credit Applicants and Account Holders

• Full names, identity or passport numbers, nationality, and date of birth.
• Physical and postal addresses, telephone numbers, and email addresses.
• Company registration details, VAT numbers, TIN numbers, and trade type.
• Banking details, including bank name, account number, branch, and account type.
• Financial information, including credit history, trade references, and auditor details.
• Marital status (for suretyship purposes, specifically whether married in community of property).

3.2 Sureties and Guarantors

• Full names, identity or passport numbers, nationality, and date of birth.
• Physical and postal addresses, telephone numbers, and email addresses.
• Marital status and spouse details (where married in community of property).

3.3 Suppliers, Contractors, and Business Contacts

• Contact names, telephone numbers, and email addresses.
• Banking details for payment purposes.

3.4 Walk-In Customers and Service Customers

• Full name, telephone number, and email address as provided at point of sale or on job cards.
• Vehicle details including registration, make, model, and VIN where relevant.
• Marketing communication preferences (opt-in or opt-out).

3.5 Visitors to Our Premises

• Name, vehicle registration, and contact details (where a visitor register is maintained).

4. How We Collect Personal Data

• Directly from you when you complete a credit application, place orders, request a quotation, or communicate with us.
• At point of sale, through invoices, job cards, quotations, and service records.
• From third parties, including credit bureaus, trade references, banks, and auditors, with your consent.
• From publicly available sources, such as company registration records held by CIPA.
• Through the ordinary course of our business relationship, including transaction records and payment history.
• Through our website, when you submit enquiry forms, request quotations, or subscribe to our mailing list.

5. Purpose and Legal Basis for Processing

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may result in us being unable to continue providing credit facilities or services to you.

5A. Direct Marketing

We may send you direct marketing communications about our products, services, promotions, and special offers by email, SMS, WhatsApp, telephone, or other electronic means — only where you have given prior consent, or as a soft opt-in for similar products you have previously purchased.

You have the right to opt out at any time, free of charge, by:

• Replying "STOP" to any SMS or WhatsApp marketing message;
• Clicking the "unsubscribe" link in any marketing email;
• Contacting our accounts department in writing; or
• Informing any member of staff at point of sale.

We action opt-out requests within 5 business days. Opting out does not affect transactional communications relating to your account, orders, services, or invoices. We do not sell, rent, or share your personal data with third parties for their own marketing.

6. Sharing of Personal Data with Third Parties

• Credit bureaus — as required by the Credit Information Act, 2021.
• Debt collection agents and attorneys — for overdue accounts.
• Insurance providers — for credit insurance, claims, or insuring goods in transit.
• Legal advisors — in legal proceedings or enforcement of rights.
• Auditors and accountants — for financial reporting and compliance.
• Regulatory authorities — including BURS and the Information and Data Protection Commission, where required by law.
• Banks — for verifying banking details.
• Marketing service providers — bound by confidentiality and security obligations.

We do not sell, rent, or trade your personal data for any third party's marketing purposes.

7. Cross-Border Data Transfers

We generally process and store personal data within Botswana. Any cross-border transfer will comply with Section 74 of the Act, including: (a) the receiving country has been determined to have adequate protection; (b) appropriate safeguards are in place; or (c) the transfer falls within a recognised derogation, such as your explicit consent. A copy of any data transferred outside Botswana will be retained within Botswana for the duration of processing.

8. Data Retention

After the retention period, paper records are shredded and electronic records permanently deleted.

9. Your Rights as a Data Subject

• Right of Access — confirm and obtain a copy of data we hold about you.
• Right to Correction — correct inaccurate or incomplete data.
• Right to Erasure — subject to our legal retention obligations.
• Right to Restriction — restrict processing in certain circumstances.
• Right to Object — including an absolute right to object to direct marketing.
• Right to Data Portability — receive your data in a machine-readable format.
• Right Not to be Subject to Automated Decision-Making — we do not use automated decisions in credit assessment.

To exercise any of these rights, write to Broadhurst 4x4 — Accounts Department, accounts@broadhurst4x4.com. We respond within 30 days and may require proof of identity.

10. Security of Personal Data

• Physical security of premises where personal data is stored, including locked filing cabinets and restricted access.
• Access controls on electronic systems, including password protection and role-based access.
• Secure disposal of paper records by shredding.
• Contractual obligations on third-party service providers to maintain appropriate security.

In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify the Information and Data Protection Commission within 72 hours of becoming aware, and notify you without undue delay.

11. Complaints

If you are not satisfied with how we have handled your personal data, you may lodge a complaint with the Information and Data Protection Commission, c/o Botswana Communications Regulatory Authority (BOCRA), Plot 50671, Independence Avenue, Private Bag 00495, Gaborone — www.bocra.org.bw.

12. Changes to This Policy

We reserve the right to update or amend this Privacy Policy from time to time. Material changes will be communicated to affected data subjects in writing or by making the updated policy available on our website. The date of the most recent revision is shown at the top of this page.

13. Governing Law

This Privacy Policy is governed by the laws of the Republic of Botswana, including the Data Protection Act, 2024 (Act No. 18 of 2024).