THUTO PLATFORMS – PRIVACY POLICY

Version 1.0.0

Effective Date: July 2026

Prepared and governed in accordance with the Botswana Data Protection Act 18 of 2024

Introduction

Thuto Platforms Proprietary Limited (“Thuto Platforms”, “we”, “us”, or “our”) is committed to safeguarding the privacy and protection of personal data entrusted to us by the individuals who use our services.

This Privacy Policy sets out, in a clear and transparent manner, how we collect, use, process, store, disclose, and protect your personal data in the course of providing our educational services through the Thuto Platforms mobile application and website (individually or collectively referred to as the “Platform”).

We process personal data in accordance with the principles and requirements of the Botswana Data Protection Act 18 of 2024 (“the Act”), ensuring that all processing is conducted lawfully, fairly, and transparently, and that the rights and freedoms of all data subjects are fully respected.

By accessing or using the Platform, you acknowledge that your personal data will be processed in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please discontinue use of the Platform.

If you are a parent or guardian of a user under the age of 18, please read this Privacy Policy carefully, paying particular attention to Section 9, which sets out important information about how we handle children’s personal data and your rights as a parent or guardian.

SECTION 1. WHO WE ARE

Thuto Platforms Proprietary Limited is the data controller responsible for all personal data collected through the Platform. We accept full responsibility for ensuring that your personal data is handled in compliance with applicable data protection laws.

Our registered details are as follows:

Registered Legal Name

• Thuto Platforms Proprietary Limited

Trading Name

• Thuto Platforms

Company Registration No.

• BW00005131675

Registered Address

• Plot 53915, Block 5, Gaborone, Botswana

Postal Address

• P O Box 20327, Francistown, Botswana

Privacy Contact Email

• DPO@thutoplatforms.co.bw

For all privacy-related queries, data subject access requests, complaints, or concerns, please contact our Data protection officer at DPO@thutoplatforms.co.bw. We will endeavor to respond to all correspondence promptly and transparently.

SECTION 2. THE THUTO PLATFORM

Thuto Platforms is an educational technology platform delivering curriculum-aligned learning content to students in Botswana. The primary service delivery channel is the Thuto Platforms mobile application, available on iOS and Android. The Thuto Platforms website may additionally serve as a point of information and access for users and prospective users; its role in direct content delivery continues to be developed.

The Platform currently offers:

•      Pre-recorded video lessons aligned to the Botswana General Certificate of Secondary Education (BGCSE) and International General Certificate of Secondary Education (IGCSE) syllabi.

•      Notes in PDF and text formats, accessible on-Platform for viewing. No content available on the Platform is downloadable or transferable to any external device or location.

All content on the Platform is strictly for on-Platform use only. Downloading, copying, recording, or redistributing any content is not permitted.

The following features are planned for future release and will be subject to updated privacy notices at the time of launch:

•      Assessments and quizzes.

•      Discussion forums and community features.

•      An AI-powered tutor or chatbot.

•      Parental dashboards enabling parents and guardians to monitor their child’s learning activity on the Platform.

Access to the Platform is offered on a seven-day free trial basis, followed by a monthly paid subscription.

SECTION 3. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to all personal data processed by Thuto Platforms in connection with:

•      The registration and onboarding of users on the Platform.

•      The provision and use of educational content and services.

•      Subscription management and payment processing.

•      User communications, notifications, and support services.

•      Platform analytics, security, and improvement activities.

This Privacy Policy applies regardless of the method used to access the Platform, including through the mobile applications, the website, or any other authorized digital interface.

This Privacy Policy applies to:

•      Students and learners using the Platform for educational content.

•      Parents and guardians who register on behalf of, or in connection with, minor users.

•      Any other individual whose personal data is processed by Thuto Platforms in the course of delivering its services.

SECTION 4. OUR DATA PROTECTION PRINCIPLES

We adhere strictly to the data protection principles established under the Act. All processing of personal data by Thuto Platforms is governed by the following principles:

•      Lawfulness, Fairness, and Transparency:

◦     Personal data is processed lawfully, in ways that are fair, and in a transparent manner that is understandable to data subjects.

•      Purpose Limitation:

◦     Personal data is collected for specified, explicit, and legitimate purposes and is not further processed in a manner incompatible with those purposes.

•      Data Minimization:

◦     We collect only personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.

•      Accuracy:

◦     We take reasonable steps to ensure that personal data is accurate and kept up to date. We encourage users to notify us of any changes to their personal data.

•      Storage Limitation:

◦     Personal data is retained only for as long as is necessary for the purposes for which it was collected, subject to applicable legal retention obligations.

•      Integrity and Confidentiality:

◦     Appropriate technical and organizational measures are implemented to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage.

•      Accountability:

◦     We take responsibility for, and are able to demonstrate compliance with, all of the above principles.

SECTION 5. PERSONAL DATA WE COLLECT

We collect and process the following categories of personal data. The table below sets out each category, the specific data items it includes, and the primary purpose for which it is collected.

Category

Identity Data

• First Name, Surname & date of birth.

• User identification, account creation, eligibility verification, and application of appropriate protections for minor users.

Contact Data

• Mobile number (primary account identifier, subject to OTP verification). For users under 16, the parent or guardian's mobile number is collected in place of the learner's.

• Account authentication, OTP verification, account security, and account recovery.

Educational Data

• Academic level (PSLE, JCE, BGCSE, or IGCSE).

• Routing the learner to the correct curriculum content and dashboard.

Profile Data

• Profile picture, uploaded by the user after account creation.

• Account personalization and user identification within the Platform.

Account & Authentication Data

• Login credentials, including password (stored in encrypted form; never accessible in plain text).

• Account security and authentication.

Usage Data

• Content viewed, time spent on the Platform, and engagement patterns.

• Service improvement, personalization of learning experience, and analytics.

Technical & Device Data

• IP address, device type, browser type, operating system, and mobile network information.

• Platform optimization, security monitoring, fraud detection, and technical support.

We do not collect sensitive personal data (including health data, biometric data, or data revealing racial or ethnic origin, political opinion, or religious belief) unless expressly provided by a user in the course of contacting us.

The only user-generated content collected by the Platform is the profile picture uploaded voluntarily by the user after account creation. No other user-generated content is collected or stored.

Where a parent or guardian provides us with personal data relating to a minor user, that parent or guardian confirms that they have the legal authority to do so and that the minor’s personal data will be processed in accordance with this Privacy Policy.

It is important that the personal data we hold about you is accurate and current. Please notify us of any changes to your personal data at DPO@thutoplatforms.co.bw within 30 days of any change.

SECTION 6. HOW WE COLLECT YOUR PERSONAL DATA

We collect personal data through the following methods:

•      Direct Collection:

◦     Information you provide when registering for an account, completing your profile, contacting our support team, or otherwise engaging with the Platform directly.

•      Automated Collection:

◦     Data collected automatically through cookies, system logs, session tracking, and analytics tools when you interact with the Platform. See Section 10 for full details on cookies and tracking technologies.

•      Third-Party Sources:

◦     We may receive limited personal data from third-party service providers such as payment processors, for the sole purpose of confirming transaction status or resolving account issues. We do not purchase or acquire personal data from data brokers or unrelated third parties.

We ensure that all data collection methods are lawful, transparent, and proportionate to the purposes for which data is collected.

SECTION 7. LEGAL BASIS AND PURPOSE OF PROCESSING

The Act requires us to have a lawful basis for every instance of personal data processing. The table below sets out our processing activities, the categories of personal data involved, and the applicable legal basis for each.

 Processing Activity

Data Categories

Legal Basis

Account creation and management

• Identity Data, Contact Data, Educational Data

• Performance of a contract — necessary to register and maintain your user account.

Delivery of educational content and services

• Identity Data, Educational Data, Usage Data

• Performance of a contract — necessary to provide the educational services you have subscribed to.

Personalization of learning experience

• Educational Data, Usage Data, Profile Data

• Legitimate interests — to improve learning outcomes and the relevance of content presented to users.

Payment processing and subscription management

• Identity Data, Contact Data

• Performance of a contract — necessary to manage your subscription and process payments.

Technical & Device Data, Contact Data

• Technical & Device Data, Account.

• Legitimate interests — to protect the Platform and its users from unauthorized access and misuse.

Analytics and platform improvement

• Usage Data, Technical & Device Data

• Legitimate interests — to understand how users engage with the Platform and improve its performance and content.

Service communications and notifications

• Contact Data

• Performance of a contract and legitimate interests — to keep you informed about your account, subscription, and Platform updates.

Compliance with legal obligations

• All categories, as applicable

• Legal obligation — to comply with the Data Protection Act 18 of 2024 and other applicable Botswana law.

Responding to data subject requests

• All categories, as applicable

• Legal obligation and legitimate interests — to uphold your rights under the Act.

7.1 Change of Purpose

We will only use your personal data for the purposes for which it was collected. If we need to process your personal data for a purpose that is materially different from, or incompatible with, the original purpose, we will notify you in advance and explain the lawful basis that applies. Where required, we will seek your consent before proceeding.

If you wish to object to any such change of purpose, or to any processing based on legitimate interests, you may contact us at DPO@thutoplatforms.co.bw 

SECTION 8. AUTOMATED PROCESSING AND ARTIFICIAL INTELLIGENCE

We may use automated systems, including AI-based tools, to support the delivery of educational services on the Platform. These may include systems that:

•      Personalize the learning experience by recommending content based on usage patterns.

•      Analyze engagement and performance data to support service improvement.

•      Monitor Platform activity for security and fraud prevention purposes.

Where such automated systems are used, they are subject to human oversight and do not produce decisions that have legal or similarly significant effects on users without appropriate review. You have the right to object to automated processing and to request human review of any decision that materially affects you. See Section 13 for full details of your rights.

As we develop our AI-powered tutor and other intelligent features, we will update this Privacy Policy to reflect on how such tools process personal data, prior to their launch.

SECTION 9. CHILDREN’S PERSONAL DATA

This section is of critical importance. The Platform serves students as young as 10 years of age. The Act imposes strict obligations on the processing of children’s personal data, and Thuto Platforms takes these obligations seriously.

9.1 Age and Access

The Platform is accessible to users aged 10 and above. Under the Act, a child is defined as any person under the age of 18. The processing of a child’s personal data in connection with information society services requires consent from a parent or legal guardian, except where the child is 16 years of age or older and capable of providing their own informed consent.

9.2 Consent Framework

Our current consent framework operates as follows:

•      Users aged 16 and above may register and consent on their own behalf.

•      Users under the age of 16 are required to have the express consent of a parent or legal guardian prior to registering or using the Platform. We verify parental consent through OTP verification — a one-time code is sent to the parent or guardian's registered mobile number, which must be entered to activate the account. This constitutes verifiable consent under Section 29(2) of the Act.

We are committed to implementing more robust age verification and parental consent mechanisms as the Platform develops. We reserve the right to request additional verification documentation and to suspend or terminate accounts where valid consent cannot be established.

9.3 Parental and Guardian Rights

Parents and legal guardians have the following rights in relation to their child’s personal data held by Thuto Platforms:

•      The right to access the child’s personal data.

•      The right to request correction or deletion of the child’s personal data.

•      The right to withdraw consent for the processing of the child’s personal data at any time.

•      The right to object to any processing of the child’s data that is not strictly necessary for the delivery of educational services.

To exercise any of these rights, parents and guardians may contact us at DPO@thutoplatforms.co.bw.

9.4 Parental Dashboard

We are developing a parental dashboard that will allow parents and guardians to monitor their child’s learning activity on the Platform. Upon launch, this feature will be accompanied by a dedicated privacy notice. Parents and guardians wishing to exercise any rights in the interim should contact us directly.

9.5 Our Commitment to Child Safety

We do not use children’s personal data for marketing, profiling, or any purpose beyond what is strictly necessary for their educational use of the Platform. If we become aware that a child’s personal data has been collected without appropriate consent, we will take immediate steps to delete it.

SECTION 10. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies to operate, secure, and improve the Platform. A cookie is a small data file placed on your device when you access the Platform, which helps us recognize you and understand how you use our services.

We use the following types of cookies:

•      Essential cookies:

◦     Strictly necessary for the Platform to function, including maintaining your login session and enabling secure access. These cannot be disabled without impairing Platform functionality.

•      Analytics cookies:

◦     Used to understand how users interact with the Platform, including which content is accessed, session duration, and navigation patterns. We currently use Google Analytics for this purpose.

You may manage your cookie preferences through your device or browser settings. Please note that disabling essential cookies will affect your ability to use the Platform. We will introduce a dedicated cookie preference centre as the Platform develops.

We do not use cookies for the purpose of serving third-party advertising on the Platform.

SECTION 11. SHARING AND DISCLOSURE OF PERSONAL DATA

We do not sell, rent, or trade your personal data to any third party. We share your personal data only where necessary and in strict accordance with this Privacy Policy, with the following categories of carefully selected third-party service providers:

 •      Cloud hosting and infrastructure providers:

◦     To host and store Platform data and infrastructure securely.

•      Payment processors:

◦     To process subscription payments on our behalf. Payment card and mobile money data is handled directly by our payment processor and is not stored by Thuto Platforms.

•      Email and SMS communication providers:

◦     To deliver account-related communications and service notifications.

•      Analytics providers:

◦     Including Google Analytics, to analyses Platform usage and support service improvement.

We are in the process of finalizing agreements with specific third-party service providers. Once confirmed, a list of our primary data processors will be made available on request. All third-party processors are:

•      Contractually bound to process personal data only for the specific purposes for which they are engaged by us.

•      Required to maintain appropriate confidentiality and security measures.

•      Obligated to comply with applicable data protection laws.

•      Not permitted to use your personal data for their own independent purposes.

We may also disclose personal data in the following circumstances:

•      To regulatory authorities, courts, law enforcement agencies, or government bodies, where required or authorized by law.

•      Where disclosure is necessary to establish, exercise, or defend our legal rights.

•      In the event of a merger, acquisition, or sale of all or substantially all of our assets, in which case the acquiring party will be required to honour this Privacy Policy.

We do not share your personal data with third parties for their own marketing, advertising, or commercial purposes.

SECTION 12. Cross-Border Transfers of Personal Data

Our cloud hosting and third-party service providers are primarily located outside Botswana, including in the United States of America. As a result, your personal data may be transferred to, and processed in, countries outside Botswana.

 In accordance with Section 43 of the Act, we take the following measures to ensure your personal data is adequately protected in all cross-border transfers:

•      We maintain a copy of all personal data within Botswana for the duration of processing, in compliance with the Act.

•      We transfer personal data outside Botswana only to service providers that offer an adequate level of data protection, or with whom we have put in place appropriate contractual safeguards, including data processing agreements.

•      We conduct due diligence on all international service providers to confirm that appropriate data protection standards are upheld.

•      We ensure that all cross-border transfers are made in accordance with the applicable provisions and exemptions under the Act.

 By using the Platform, you acknowledge that your personal data may be processed in countries outside Botswana under the safeguards described above.

SECTION 13. YOUR RIGHTS UNDER THE DATA PROTECTION ACT

In accordance with the Botswana Data Protection Act 18 of 2024, you have the following rights in relation to your personal data. Thuto Platforms is committed to upholding and facilitating the exercise of each of these rights.

•      Right of Access:

◦     To obtain confirmation of whether your personal data is being processed, and to request a copy of that data together with information on how it is being used.

•      Right to Rectification:

◦     To request the correction or updating of inaccurate, incomplete, or outdated personal data.

•      Right to Erasure (Right to be Forgotten):

◦     To request the deletion of your personal data where there is no lawful basis for its continued processing. This right is subject to applicable legal and regulatory retention obligations.

•      Right to Restriction of Processing:

◦     To request the suspension of processing of your personal data in certain circumstances, including where the accuracy of the data is contested or the processing is unlawful.

•      Right to Data Portability:

◦     To receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another data controller, where technically feasible and where processing is based on consent or contractual necessity.

•      Right to Object:

◦     To object to processing your personal data based on legitimate interests, including any profiling carried out for such purposes. You also have the right to object at any time to the processing of your personal data for direct marketing purposes.

•      Right to Withdraw Consent:

◦     Where processing is based on your consent, to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

•      Right against Automated Decision-Making, Including Profiling:

◦     Not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects concerning you, except where permitted by law.

•      Right to Grievance Redressal:

◦     To access appropriate and effective mechanisms for resolving complaints or concerns relating to the handling of your personal data by Thuto Platforms.

•      Right to Lodge a Complaint with the Regulatory Authority:

◦     To lodge a complaint with the Information and Data Protection Commission of Botswana if you believe your personal data has been processed in violation of the Act.

•      Right to Compensation:

◦     To seek compensation for any material or non-material damage suffered because of unlawful processing of your personal data, in accordance with applicable law.

13.1 How to Exercise Your Rights

To exercise any of the rights set out above, please submit a written request to our Data Protection Officer at DPO@thutoplatforms.co.bw. We may request specific information from you to verify your identity and confirm your right to access the requested personal data. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

We will respond to all verified requests within 30 days of receipt. Where a request is particularly complex or involves multiple requests, we may extend this period by a further 30 days. We will notify you of any such extension within the initial 30-day period and keep you informed throughout.

You will not be charged a fee for exercising your rights. However, we reserve the right to charge a reasonable administrative fee where requests are manifestly unfounded, repetitive, or excessive. Where this applies, we will notify you in advance.

SECTION 14. Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, and to comply with our legal, regulatory, and operational obligations.

Our retention periods are as follows:

•      Active account data:

◦     Retained for the full duration of your account and active subscription.

•      Post-account closure:

◦     Personal data is retained for a period of five (5) years following account closure or the last date of account activity, whichever is later, to satisfy legal, regulatory, and record-keeping obligations.

•      Extended retention:

◦     We may retain personal data beyond the standard periods above where necessary for legal proceedings, the exercise or defence of legal claims, compliance with regulatory requirements, or dispute resolution.

Where personal data is no longer required, we will securely delete or anonymize it. Once anonymized, data can no longer be associated with you as an individual and may be used indefinitely for research or statistical purposes without further notice to you.

In determining appropriate retention periods, we consider the nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, and the purposes for which the data is processed.

SECTION 15. How We Protect Your Personal Data

We implement robust technical and organizational security measures to protect your personal data against unauthorized access, loss, alteration, disclosure, or destruction. These measures include:

•      Encryption of personal data in transit and at rest.

•      Access controls and authentication protocols limiting data access to authorized personnel only.

•      Continuous monitoring, detection, and incident response systems.

•      Regular system audits and security assessments.

•      Regular data backups to prevent loss.

Despite these safeguards, no system can guarantee absolute security. We strongly encourage users to protect their account credentials and to contact us immediately if they suspect any unauthorized access to their account.

15.1 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of data subjects, we will:

•      Take immediate steps to contain, investigate, and remediate the breach.

•      Notify the Information and Data Protection Commission within 72 hours of becoming aware of the breach, as required by the Act.

•      Notify affected users directly, without undue delay, where the breach is likely to result in a high risk to their rights and freedoms.

If you become aware of any suspected data breach or security vulnerability involving the Platform, please report it immediately to our Data Protection Officer at DPO@thutoplatforms.co.bw.

SECTION 16. CONTENT, INTELLECTUAL PROPERTY, AND PLATFORM SECURITY

All content available on the Platform, including video lessons, notes, assessments, and any other educational materials, is the exclusive intellectual property of Thuto Platforms Proprietary Limited, or is used under license.

Users are granted a limited, non-exclusive, non-transferable license to access and view Platform content solely for their personal educational use. In particular:

•      No content on the Platform is downloadable to any external device or location.

•      Content may not be copied, recorded, screenshotted, redistributed, shared outside the Platform, or used for any commercial purpose.

•      Account sharing is not permitted. Each account is for the exclusive use of the registered individual.

Any unauthorized use, reproduction, or distribution of Platform content may constitute a breach of our Terms of Service and applicable intellectual property law, and may result in account suspension or termination.

 SECTION 17. THIRD-PARTY SERVICES AND LINKS

The Platform may, from time to time, contain references or links to third-party websites, tools, or services. These third-party services are governed by their own privacy policies and terms of use. Thuto Platforms is not responsible for the data handling practices of any third party, and we encourage users to review the privacy policies of any third-party services they access.

Our inclusion of or reference to a third-party service does not constitute an endorsement of that service or its privacy practices.

SECTION 18. Complaints and Regulatory Rights

We take all privacy-related concerns seriously and are committed to resolving complaints promptly and fairly.

18.1 Internal Complaints Resolution

If you have a concern or complaint about how we have handled your personal data, we ask that you contact our Data Protection Officer in the first instance. Many concerns can be resolved quickly and informally through direct engagement.

•      Email: DPO@thutoplatforms.co.bw

•      Postal Address: Plot 53915, Block 5, Gaborone, Botswana

We will acknowledge receipt of your complaint promptly and aim to provide a substantive response within 30 days. We will keep you informed of progress throughout the resolution process.

18.2 Escalation to the Regulatory Authority

If you are not satisfied with our response, or if you believe that your rights under the Act have been infringed, you have the right to lodge a formal complaint with the Information and Data Protection Commission of Botswana (“the Commission”) at any time.

We encourage users to engage with us directly before approaching the Commission, as we are committed to resolving all concerns fairly and transparently. However, your right to approach the Commission is unconditional and may be exercised at any time.

SECTION 19. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically to reflect changes in our data practices, new Platform features, or changes in applicable law. All updates will be posted on the Platform and will take effect from the date indicated on the updated document.

Where changes are material, we will notify you by prominent notice on the Platform and, where possible, by direct communication to your registered contact details, prior to the changes taking effect.

Continued use of the Platform following the effective date of any update constitutes acceptance of the revised Privacy Policy. If you do not agree with any changes, you should discontinue use of the Platform and may request deletion of your account and personal data in accordance with Section 13.

SECTION 20. CONTACT US

For all privacy-related enquiries, data subject access requests, concerns, or complaints, please contact our Data Protection Officer:

•      Email: DPO@thutoplatforms.co.bw

•      Registered Address: Plot 53915, Block 5, Gaborone, Botswana

•      Postal Address: P O Box 20327, Francistown, Botswana

We are committed to responding to all enquiries promptly, professionally, and in full compliance with the Botswana Data Protection Act 18 of 2024.

Thuto Platforms Proprietary Limited · BW00005131675 · Plot 53915, Block 5, Gaborone, Botswana · DPO@thutoplatforms.co.bw

© 2026 Thuto Platforms Proprietary Limited. All rights reserved.