Privacy Policy

Bantu Plaza is operated from Plot 11866 Ntshinoge, Mochudi, Botswana. For privacy matters: info@bantuplaza.com.

• Account data: name, email, password (hashed), date of birth, role (student or tutor).
• Profile data (tutors): bio, city, country, languages taught, hourly rate, availability, profile photo, date of birth (to enforce the 18+ baseline and 21+ minimum for tutors who opt in to “Kids welcome”), and the “Kids welcome” opt-in itself.
• Guardian / minor data (parent & guardian accounts only): if you register on behalf of a child in your care, we record the child’s first name and date of birth and a timestamp + IP of your consent. We do not collect the child’s surname, address, school, or other identifiers. You are the data controller for your child’s data; we process it as your processor for the limited purpose of delivering lessons you book.
• Booking data: lessons booked, datetimes, lesson type, status. Bookings made by a guardian account are flagged with the child’s first name so the tutor can address the lesson correctly.
• Learning progress data: for the progress-tracking feature, your tutor records what was covered in each lesson, your CEFR level and skill competencies, suggested next steps, and milestones reached. This is visible to you and your tutor and is used to show your progress and issue milestone learning credits.
• Attendance log: Bantu Plaza does not record lessons. For every lesson we keep a lightweight attendance log – who joined, for how long, and any reconnections – to help with support and dispute resolution.
• Direct messages: when you send or receive a message through your Bantu Plaza dashboard we store the sender, recipient, timestamp and message body in our database. Messages are normally readable only by the sender and recipient; Bantu Plaza’s trust-and-safety staff may review messages where there is a credible safeguarding concern (every such review is recorded in the audit log as dm_admin_read). We do not share message content with any third party except where required by valid legal process.
• Payment data: processed by WooCommerce and the payment gateway (e.g. PayPal). We do not store full card numbers – only the order id, amount, currency and last-4 digits where available.
• Technical data: IP address, browser, pages visited (used for security, fraud detection and analytics).
• Audit log: when staff perform governance actions (approve a tutor, issue a refund, hide a review, send an announcement, change commission rates) we record the staff member’s account, the action, the affected record and the request IP. The audit log retains the most recent ~200,000 events and prunes older rows daily.

• Performance of a contract – to deliver the lessons you book.
• Legitimate interests – to keep the Platform secure, prevent fraud and improve the service.
• Legal obligation – to retain accounting and tax records (Botswana Income Tax Act).
• Consent – for optional marketing emails. You can withdraw consent at any time.

We share the minimum data necessary with: the payment gateway (PayPal / card processor), our email provider (for transactional emails), and the tutor or student you have booked with. We do not sell personal data.

Some of our service providers are located outside Botswana. Where personal data is transferred outside Botswana we rely on contractual safeguards consistent with the cross-border transfer requirements of the Data Protection Act, 2024 (No. 18 of 2024) of Botswana.

Where you reside in South Africa, the Protection of Personal Information Act, 2013 (POPIA) may also apply to our processing of your personal data. Where you reside in the European Union or United Kingdom, the General Data Protection Regulation (GDPR) / UK GDPR may also apply. In each case you retain the rights granted by whichever law affords you the greatest protection – including the right to access, rectify, erase, restrict, or port your data, and the right to lodge a complaint with your local supervisory authority (the Information Regulator in South Africa, the relevant national data-protection authority in the EU, or the Information Commissioner's Office in the UK).

We retain personal data for as long as it is needed for the purposes set out in section 3, and for as long as we are required to retain it by Botswana law (in particular accounting and tax records under the Income Tax Act). Specifically:

• Active accounts: retained while the account exists.
• Closed accounts: when you ask us to delete your account, we anonymise your booking history (your user id is removed from each lesson record so the lesson can still be counted in tutor totals, but the lesson is no longer linked to you) and delete your profile data. Order and accounting records retained as required by tax law (typically 7 years).
• Audit log: retained as a rolling buffer of the most recent ~200,000 governance events; older events are pruned daily.
• Anonymised aggregates: retained indefinitely for service analytics.

To request deletion, email info@bantuplaza.com.

• Access – request a copy of your personal data.
• Rectification – correct inaccurate data.
• Erasure – ask us to delete your data (subject to legal retention obligations).
• Restriction & objection – ask us to limit or stop processing.
• Portability – receive your data in a portable format.
• Complaint – lodge a complaint with the Information and Data Protection Commission of Botswana.

Email info@bantuplaza.com to exercise any of these rights, or use our data & privacy requests page to submit a data-export or account-deletion request directly. We respond within 30 days.

We use HTTPS, password hashing, rate-limited authentication and least-privilege access controls. No system is 100% secure – we will notify you and the Commission of a personal data breach without undue delay, as required by section 30 of the Act.

Bantu Plaza accounts must be held by someone aged 18 or over. Learners aged 8–17 may use the Platform only through their parent or legal guardian’s account, with the parent / guardian acting as the data controller for the child’s information. We do not knowingly create a separate account in a child’s own name, and we do not collect children’s data directly from children.

When a parent or guardian indicates at sign-up that the account is for a child, we collect the child’s first name and date of birth (so we can confirm the learner is at least 8 years old and route the account to “Kids welcome” tutors only) and a timestamp + IP record of the parent / guardian’s consent. We do not collect the child’s surname, address, school, or other identifiers. The parent / guardian may delete or correct any of this data at any time by emailing us at info@bantuplaza.com.

We do not record lessons. Bantu Plaza does not record video or audio of lessons, for children or adults. We keep children safe in other ways: a learner aged 8–17 can only be booked by a parent or guardian, only with a tutor who carries the “Kids welcome” badge (21+, age-checked and granted the badge by our team; the tutor declares they have no record of offences against a child and agrees to provide a police-clearance certificate if we ask — we do not run a check ourselves), and all contact stays on the platform. A parent or guardian books the lesson and is the point of contact, and you can report any concern to us at any time at info@bantuplaza.com.

This posture is taken with reference to the Children’s Act, 2009 of Botswana, the heightened-protection principle for children’s data in the Data Protection Act, 2024 (No. 18 of 2024), section 34 of POPIA (South Africa) for children resident in South Africa, and Article 8 of GDPR for children resident in the EU / UK.

If you believe a person under 18 has registered an account in their own name (rather than through a parent / guardian account), please tell us and we will delete the account without delay.

We will post the date of the latest revision at the top of this page. Material changes will be emailed to active accounts at least 7 days before taking effect.