Khama III Memorial Museum

1. Purpose

Khama III Memorial Museum respects the privacy of users of its digital archive website and is committed to protecting the personal information entrusted to it. This policy explains what personal information the museum collects, why it is collected, how it is protected, how long it is retained and the rights available to users.

The policy also establishes a fixed six-month account period to support secure, controlled access to the museum's digital collections while reducing the amount of personal information retained by the museum.

2. Scope

This policy applies to personal information collected when a person registers for, signs into or manages an account on the Khama III Memorial Museum digital archive website.

It applies to museum employees, authorised administrators, contractors and service providers who may handle personal information on behalf of the museum.

3. Legal Framework and Accountability

The museum processes personal information in accordance with the Botswana Data Protection Act, 2024 (Act No. 18 of 2024), which commenced on 14 January 2025, and any applicable regulations or lawful directions issued under it.

For the purposes of the Act, Khama III Memorial Museum is responsible for determining why and how personal information collected through the digital archive website is processed.

The museum will designate an appropriate staff member or office to receive privacy questions, requests and complaints. The contact details must be published on the website and kept current.

4. Personal Information Collected

The museum asks users to provide only the following personal information when registering for digital archive access:

• Name
• Email address

The system will also record the account creation date and expiry date so that the six-month retention and deletion rule can be applied. These dates are used only for account administration, security and automatic deletion.

The museum does not intentionally collect sensitive personal information through the standard website registration process.

5. Purpose of Collection and Use

The museum collects and uses a user's name and email address only to:

• Create and administer the user's digital archive account;
• Identify the account holder and support secure access to the archive;
• Send essential account, access, security or expiry communications;
• Respond to account-related enquiries or requests; and
• Protect the website and digital collections against unauthorised access or misuse.

The museum will not use personal information for a purpose that is incompatible with these stated purposes unless the user is first informed and the processing is otherwise lawful.

6. Lawful and Fair Processing

Personal information will be collected and processed lawfully, fairly and transparently. The museum will collect only the information that is adequate, relevant and necessary for the stated purpose.

A clear privacy notice will be displayed at the point of registration. Users must be able to read this policy before submitting their information. Where the museum relies on consent, consent must be freely given, informed and indicated by a clear affirmative action.

7. Prohibited Uses

The museum will not use a user's personal information for:

• Advertising or direct marketing;
• Commercial sale, rental or trading of personal information;
• Behavioural profiling or targeted advertising;
• Automated decision-making about the user;
• Training, testing or improving artificial intelligence or machine-learning systems; or
• Any unrelated research or secondary purpose without an appropriate lawful basis and clear notice.

8. Storage and Access

Personal information will be stored in the museum-controlled digital archive website database. The database must be hosted and administered in a manner approved by the museum and consistent with Botswana's data-protection requirements.

Access to personal information will be limited to authorised personnel who require it for account administration, technical support, security or compliance. Personal information will not be disclosed to unrelated third parties.

Where an approved technology or hosting provider processes information on behalf of the museum, the provider must act only on the museum's documented instructions, protect the information and must not use it for its own purposes.

9. Six-Month Account Validity and Automatic Deletion

Each digital archive account will remain valid for a maximum period of six months from the date on which the account is created.

At the end of the six-month period, the account and its associated personal information will be automatically deleted, whether the account has been active or inactive.

The deletion will include:

• The user's name;
• The user's email address;
• The user's account record; and
• Account administration information directly linked to that account, unless its retention is required by law or necessary for a documented security or legal matter.

The museum should display the account expiry date to the user after registration and may send an expiry reminder before deletion. A user who still requires access after expiry may register for a new account.

Deletion from the active website database will occur automatically. Any residual copy held temporarily in a secure backup will not be used for any other purpose and will be overwritten or securely removed through the museum's normal backup-retention cycle.

10. Information Security

The museum will use appropriate technical and organisational safeguards to protect personal information and the digital archive against accidental loss, alteration, unauthorised access, disclosure, destruction or misuse.

Safeguards may include:

• Role-based access controls and least-privilege access;
• Strong authentication and password-management controls;
• Encryption for information transmitted between users and the website;
• Secure database and server configuration;
• System logging, monitoring and security updates;
• Secure backups and recovery procedures;
• Confidentiality obligations for authorised staff and service providers; and
• Periodic review of user accounts, permissions and deletion processes.

11. User Rights

Subject to the Botswana Data Protection Act, 2024, a user may request to:

• Be informed about how the museum processes their personal information;
• Access the personal information held about them;
• Correct inaccurate or incomplete personal information;
• Request deletion of their account before the six-month expiry date;
• Object to or request restriction of processing where applicable;
• Withdraw consent where processing is based on consent; and
• Submit a complaint regarding the museum's handling of personal information.

The museum may request reasonable proof of identity before acting on a request. Requests will be handled within the period required by applicable law.

12. Cookies and Essential Technical Information

The website may use only cookies or similar technical tools that are necessary for sign-in, account security, session management and the reliable operation of the digital archive.

The museum will not use advertising cookies or tracking technologies to create behavioural profiles. If non-essential analytics or other technologies are introduced in the future, this policy and the website notice must be updated and any legally required consent must be obtained.

13. Data Breaches

A suspected loss, unauthorised disclosure or compromise of personal information must be reported immediately to the museum's designated data-protection contact. The museum will investigate, contain and document the incident and will notify affected users and the relevant authority where required by law.

14. Changes to This Policy

The museum may update this policy when its website, security practices or legal obligations change. The current version will be published on the website with its effective date and last-updated date.

Where a change materially affects how personal information is collected, used, shared or retained, the museum will provide an appropriate notice to users before the change takes effect, where practicable.

15. Contact and Complaints

Questions, requests or complaints concerning personal information may be directed to:

A user may also lodge a complaint with Botswana's Information and Data Protection Commission where the user believes that personal information has been processed contrary to applicable law.