OLYMPUS PAY

Privacy Policy

How we collect, use, and protect your personal information.

Last updated: June 2026

Effective: 1 July 2026

Olympus Pay Proprietary Limited · BW00009700756
Regulated under the Bank of Botswana Regulatory Sandbox

About This Policy

This Privacy Policy explains how Olympus Pay Proprietary Limited ("Olympus Pay", "we", "us", or "our") collects, uses, shares, and protects your personal information when you use our digital banking platform, mobile application, and related services (collectively, the "Services"). We are committed to protecting your privacy and handling your personal data with transparency, integrity, and care. This policy is written in plain language so you can understand exactly what we do with your information and what choices you have. By opening an Olympus Pay account or using our Services, you confirm that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, you should not use our Services.

Who We Are and How to Contact Us

Olympus Pay Proprietary Limited (Registration No. BW00009700756) is the data controller responsible for your personal information. We operate under the supervision of the Bank of Botswana Regulatory Sandbox as a Digital Bank. Our registered address is in Botswana. For privacy-related enquiries, you can reach our Data Protection Officer at: Email: privacy@olympuspay.co Complaints: complaints@olympuspay.co We take all data-related requests and complaints seriously and will respond within 30 days of receipt.

Information We Collect

We collect information that is necessary to provide you with safe, compliant banking services. This includes:

Information You Provide

When you apply for or use an Olympus Pay account, we collect: your full legal name, date of birth, national identity number or passport details, residential and business address, email address, mobile phone number, business registration details and company documents, director and shareholder information, source of funds and source of wealth documentation, selfie photographs and identity document scans for identity verification, and any other information you choose to provide in communications with us.

Information Collected Automatically

When you use our app or services, we automatically collect: device identifiers (device ID, model, operating system), IP address and approximate location, login timestamps and session duration, transaction data including amounts, recipients, references, and timestamps, app usage patterns and feature interactions, and push notification preferences.

Information from Third Parties

We may receive information about you from: identity verification providers (for KYC/AML checks), credit reference agencies, fraud prevention and sanctions screening databases, your employer or business partners (where relevant), publicly available sources such as company registries and government databases, and payment networks involved in processing your transactions.

How We Use Your Information

We use your personal information for the following purposes:

To verify your identity and complete the account opening process in accordance with Know Your Customer (KYC) requirements under Botswana law.
To provide, operate, and maintain your Olympus Pay account and all associated services including payments, transfers, and card services.
To detect, investigate, and prevent fraud, money laundering, terrorist financing, and other financial crimes.
To comply with our legal and regulatory obligations under the Bank of Botswana Regulatory Sandbox, the Banking Act, 2023, the Financial Intelligence Act, and other applicable Botswana laws.
To communicate with you about your account, transactions, product updates, and important notices.
To provide customer support and resolve disputes or complaints.
To improve and develop our products and services through analysis of usage patterns.
To conduct sanctions screening against international watchlists (OFAC, UN, EU, and local sanctions lists).
To personalise your in-app experience and deliver relevant product recommendations.
To meet tax reporting obligations and respond to lawful requests from tax authorities.

Legal Bases for Processing

We process your personal data on the following legal grounds under the Botswana Data Protection Act 2018 and applicable financial regulation:

Contract

Processing is necessary to perform the contract we have with you — that is, to provide your Olympus Pay account and the banking services you have requested.

Legal Obligation

We are required by law to process certain data. This includes Anti-Money Laundering (AML) checks, KYC verification, sanctions screening, transaction monitoring, and regulatory reporting to the Bank of Botswana and financial intelligence authorities.

Legitimate Interests

We process data where we have a genuine business interest, such as fraud prevention, security monitoring, and improving our services — provided these interests are not overridden by your rights.

Consent

For certain processing activities such as marketing communications and optional analytics, we rely on your consent. You may withdraw consent at any time by contacting us or updating your notification preferences in the app.

Sharing Your Information

We do not sell your personal information. We share your data only in the following circumstances:

Service Providers

We work with carefully selected third-party providers who process data on our behalf, including: identity verification providers, cloud computing and infrastructure services, payment processing networks, customer support platforms, and fraud detection tools. All service providers are contractually bound to process data only as instructed by us and to maintain appropriate security standards.

Regulatory and Legal Authorities

We are required to share information with: the Bank of Botswana (our primary regulator), the Financial Intelligence Agency of Botswana (for AML/CFT compliance), the Botswana Unified Revenue Service (BURS) for tax reporting, law enforcement agencies when legally compelled, and other regulatory authorities where required by applicable law. We will inform you of any disclosure requests unless legally prohibited from doing so.

Payment Counterparties

When you make or receive a payment, limited information (such as your name and account reference) may be shared with the recipient's bank or payment provider to execute the transaction.

Fraud Prevention

We participate in industry fraud prevention schemes and may share information with other financial institutions, credit bureaus, and fraud intelligence networks to protect you and other customers from financial crime.

Business Transfers

If Olympus Pay is acquired, merged with another company, or transfers part of its business, your data may be transferred as part of that transaction. We will notify you of any such change before it occurs.

International Data Transfers

Your data is primarily stored and processed in Botswana. Where we transfer data internationally — for example, to cloud service providers or identity verification partners based outside Botswana — we ensure that appropriate safeguards are in place. These include contractual protections (Standard Contractual Clauses or equivalent) and ensuring the recipient country provides an adequate level of data protection. If you would like more information about the specific safeguards in place for any international transfer, please contact us at privacy@olympuspay.co.

Data Retention

We retain your personal data for as long as you hold an Olympus Pay account and for a period after account closure as required by law. Specifically:

Transaction records and account information are retained for a minimum of 7 years after account closure, as required under Botswana financial regulation and the Financial Intelligence Act.
Identity verification documents (KYC records) are retained for a minimum of 5 years after the end of the business relationship, or longer if required by a regulatory authority.
Communication records (emails, in-app messages, support tickets) are retained for up to 5 years.
Marketing preferences and consent records are retained for as long as you hold an account and up to 2 years after.
Device and access logs are retained for up to 2 years for security and fraud investigation purposes.

Your Rights

Under the Botswana Data Protection Act 2018, you have the following rights regarding your personal data. To exercise any of these rights, contact us at privacy@olympuspay.co with your full name and account reference. We will respond within 30 days.

Right of Access — You can request a copy of all personal data we hold about you.
Right to Rectification — You can ask us to correct inaccurate or incomplete personal data.
Right to Erasure — You can ask us to delete your personal data where it is no longer necessary, subject to our legal retention obligations.
Right to Restrict Processing — You can ask us to temporarily stop using your data while a dispute is being resolved.
Right to Data Portability — You can request your data in a machine-readable format to transfer to another provider.
Right to Object — You can object to processing based on our legitimate interests, including profiling for direct marketing.
Right to Human Review — Where we make automated decisions about you (such as fraud risk scoring), you can request a human review of that decision.
Right to Withdraw Consent — Where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
Right to Lodge a Complaint — You may file a complaint with the relevant Botswana data protection authority if you believe we have mishandled your data.

Security

We take the security of your personal and financial data extremely seriously. Our security measures include:

End-to-end encryption for all data in transit using TLS 1.3.
AES-256 encryption for all data at rest.
Multi-factor authentication (MFA) for all account access and sensitive transactions.
Role-based access controls ensuring only authorised staff can access customer data.
Continuous real-time fraud monitoring and transaction screening.
Regular penetration testing and security audits by independent third parties.
Row-level security (RLS) enforced at the database layer, ensuring strict data isolation between customers.
Incident response procedures with mandatory regulatory notification in the event of a data breach.

Automated Decision-Making and Profiling

We use automated systems for fraud detection, transaction risk scoring, identity verification, and credit assessment. These systems analyse patterns in transaction data, device information, and behavioural signals to protect you and our platform from financial crime. Where an automated decision significantly affects you — for example, a transaction being blocked or an account being restricted — you have the right to request a human review of that decision. To do so, contact us at support@olympuspay.co. We do not use your personal data to make automated credit decisions that determine your access to core banking services without human oversight.

Children's Privacy

Our Services are intended solely for individuals who are 18 years of age or older and for businesses registered under Botswana law. We do not knowingly collect or process personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@olympuspay.co and we will delete that information promptly.

Cookies and Tracking Technologies

Our web and mobile applications do not use third-party advertising cookies. However, we do use device identifiers, analytics SDKs, and session tokens to provide and improve our services, maintain security, and understand how you use the app. These are essential for the operation of the service and cannot be disabled without disrupting core functionality. We do not use third-party advertising trackers or share your usage data with advertising networks.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or best practices. When we make material changes, we will notify you via the app and by email at least 30 days before the changes take effect. The updated version will always show the "Last Updated" date at the top of the page. Your continued use of our Services after the effective date of any update constitutes your acceptance of the revised policy. If you do not agree with the changes, you should close your account before the effective date.

Olympus Pay Proprietary Limited

Registration No. BW00009700756

This entity operates under the Bank of Botswana Regulatory Sandbox as a Digital Bank. Olympus Pay is not yet a fully licensed bank and operates under sandbox conditions approved by the Bank of Botswana.

For enquiries: legal@olympuspay.co
For data requests: privacy@olympuspay.co
For complaints: complaints@olympuspay.co