Privacy Notice

• Subscriber data: the name + email of the person who signed your organisation up; the consent record (IP address, user agent, version) that proves we asked your permission first.
• Tenant data: everything you enter into the app — customer/vendor records, invoices, payments, employee payslips, transactions, audit logs, KYC profiles. Your organisation chooses what goes in; we hold it on your behalf.
• Operational data: error logs, usage counts (transactions per month) and the standard request metadata our hosting providers collect.

We use these third parties strictly to operate the service. Each is bound by their own DPA. We name them so you can satisfy DPA 2018 cross-border transfer requirements with your accountant or auditor.

Cross-border transfers to providers outside Botswana use standard contractual clauses + our own age-encrypted backups (private key never leaves Botswana) as the safeguard required by DPA 2018 s.48.

• Accounting records (journals, invoices, payslips, financial statements): 7 years after the period they relate to — Companies Act 2003 s.218.
• Tax records (VAT201, PAYE, WHT schedules): 5 years — Income Tax Act s.122 / VAT Act.
• KYC / FIA records: 5 years after the customer relationship ends — Financial Intelligence Act 2022.
• Audit trail: matches the longest of the above (7 years) — it is the evidence your records were not tampered with.
• Subscriber + consent records: while your subscription is active, plus 5 years.

• Show you what data we hold about you (right of access, s.18) — we respond within 30 days.
• Correct anything wrong (right to rectification, s.19).
• Delete data that is no longer needed (right to erasure, s.19) — except where retention above is legally required.
• Object to processing for direct marketing (we don't do this) (s.21).

Email privacy@ledgeriq.africa. If we cannot resolve a complaint, you can refer it to the Information and Data Protection Commissioner.