Information with Integrity

Privacy Notice

Effective date: Jan 13, 2026

1. Introduction

1.1 The Citizen Entrepreneurial Development Agency, commonly known as CEDA, is dedicated to respecting and protecting your privacy. We are committed to safeguarding your personal data as our data subject or potential data subject by adhering to the requirements of the Botswana Data Protection Act (DPA), 2024. This Privacy Notice outlines the types of personal data collected by CEDA, as well as the purposes for which it is collected, used, shared, and retained. It also informs data subjects of their rights under the Act.

1.2 CEDA is the Data Controller for all personal data it collects and processes. This means CEDA determines the purposes and means of processing data of all data subjects, whether in physical or electronic form, and is responsible for ensuring compliance with data protection laws.

1.3 In certain scenarios, CEDA may jointly determine data processing purposes with other organisations, including regulators, government entities, or strategic partners. In such cases, both parties are Joint Controllers and share responsibility for the data.

1.4 CEDA may engage Data Processors who are third-party entities that process personal data on its behalf. These data processors enter into binding data processing agreements that specify their responsibilities and provide guidance on acceptable personal data processing procedures and security measures in accordance with CEDA data protection policies.

2. Who This Privacy Notice Applies To

2.1 This notice applies to all individuals whose personal data is processed by CEDA, including:

  • Customers and clients
  • Job Candidates
  • Suppliers and contractors
  • Business partners and stakeholders
  • Visitors to our premises or website
  • Any individuals engaging with CEDA’s services

3. Personal Data We Collect

3.1 This website may use cookies to improve user experience. You can disable cookies in your browser settings.

  • Identity details, for example full name, ID or passport number
  • Contact details, for example email address, phone number and postal address
  • Employment and professional details, for example Curriculum Vitae and educational certificates
  • Financial and banking details
  • System and access information, for example IP address and log data
  • Other data necessary for legal or operational purposes
  • Geo-location data – information that provides or contains a device’s location. For example, your internet protocol (IP) address or your cookies identifier
  • Behavioural data – analytics information that describes your behaviour
  • Personal relationship data – information about associations or close connections between individuals or entities that can determine your identity. For example, spouse or employer relationships
  • Communications data – information relating to you contained in voice, messaging, email, live chats and other communications we have with you. For example, service requests.

4. Purposes for Processing Personal Data

4.1 CEDA may collect and process your personal data for the following purposes:

  • For customer, supplier and employee onboarding
  • To fulfil contractual obligations
  • To comply with legal and regulatory requirements imposed on CEDA
  • To ensure security and access control
  • To support procurement and supplier management
  • To facilitate communications, stakeholder engagement, and complaints handling
  • For strategic and operational planning related to national energy supply

5.1 CEDA relies on various legal bases for processing your personal data, including:

  • Consent: where you have freely given specific and informed consent.
  • Contractual Necessity: to perform or enter into a contract with you.
  • Legal Obligation: to comply with applicable laws and regulations.
  • Legitimate Interests: for purposes such as business continuity and fraud prevention.
  • Vital Interests: to protect life or prevent serious harm.
  • Public Interest: where processing is necessary for tasks carried out in the public interest or in the exercise of official authority vested in CEDA.

6. Sharing of Personal Data

6.1 CEDA may share your personal data with the following:

  • Government agencies and regulators
  • Law enforcement where legally required
  • Third-party service providers under binding agreements
  • Financial institutions and auditors
  • Licensed and approved Credit Bureaus
  • Other parties where disclosure is necessary and lawful

7. International Data Transfers

7.1 Your personal data may be transferred to and processed in other countries outside Botswana. We prioritise countries recognised as having data protection standards equivalent to those in Botswana.

7.2 If we transfer your personal data to other countries, we will ensure that this is done in compliance with the Data Protection Act and there are appropriate safeguards in place concerning the protection of your data, such as by using appropriate contractual data processing agreements.

7.3 CEDA may rely on permitted derogations for the transfer, such as your explicit consent, the necessity of the transfer for the performance of your contract and CEDA’s legitimate interests.

8. Data Retention

8.1 The Agency shall retain personal data only for as long as necessary for the purpose collected and to comply with legal, regulatory, or contractual obligations, after which it is securely destroyed or anonymised.

9. Data Security

9.1 CEDA shall employ technical and organizational measures such as encryption of data in transit and at rest, role based access management controls to personal information, regular security assessments, and continuous employee training programs to protect data from unauthorized access, loss, or misuse.

10. Your Rights as a Data Subject

10.1 Under the Data Protection Act, 2024, any data subject shall have the following rights:

  • Right to be informed: You have the right to be informed of any personal data that we hold about you and how we are processing your personal data.
  • Right of Access: You have the right to receive confirmation from us on whether we hold personal data about you and to receive a copy of your personal data.
  • Right to Erasure: You may request deletion of your personal data.
  • Right to Rectification: You have the right to request rectification of any inaccurate or incomplete personal data we hold about you.
  • Right to object: You have the right to object to the processing of your personal data for direct marketing purposes.
  • Right to Portability: You may request a copy of your personal data in a structured, machine-readable format and request that it be transferred to another controller.
  • Right to withdraw Consent: Where processing is based on consent you have the right to modify or withdraw your consent at any point.
  • Right to lodge a complaint: You also have the right to lodge a complaint with the Information and Data Protection Commission. We encourage you to contact us first so we can resolve your concerns directly.

These rights are not absolute and are subject to conditions or limitations as specified in applicable law. We will process your request in accordance with the Botswana Data Protection Act. To protect your privacy and security, we will take steps to verify your identity before complying with the request.

11. Changes to this Privacy Notice

11.1 CEDA reserve the right to update or revise this Privacy Notice from time to time to reflect changes in our practices or legal requirements. All data subjects are therefore encouraged to review this Privacy Notice periodically for any updates.

12. How to Contact Us

12.1 For any data protection related requests, enquiries or breach of confidentiality please contact our Data Protection Officer at:

CEDA_Privacy_Notice.pdf (36.06 KB)