Privacy Notice for Supplier or Tenant Representatives
Letlole La Rona Limited (“LLR,” “we,” “us,” or “our”) is the data controller responsible for deciding why and how your personal data is processed. We process your data in the context of our relationship with a tenant or supplier organisation, which may be a company, partnership, or sole proprietorship. You may be connected to that organisation as a representative, director, shareholder, partner, or, in the case of a sole proprietorship, in your personal capacity.
You can contact us at P.O. Box 700 ABG, Gaborone or +267 318 0301 or info@letlole.com, or by contacting our Data Protection Officer at dpo@letlole.com.
This privacy notice explains how we collect, use, and share your personal data in connection with that business relationship. It also informs you of your rights in relation to your data and how you may exercise them.
We primarily collect your personal data indirectly, through information provided by the supplier or tenant organisation (e.g. in onboarding or contractual documentation), or through publicly available records and third-party sources such as company registries, compliance screening tools, or official filings. In some cases, particularly where the supplier is a sole proprietor, we may collect personal data directly from you. That data forms part of our records and is processed in accordance with this notice.
| PURPOSE OF PROCESSING | EXAMPLES OF PERSONAL DATA PROCESSED | LEGAL BASIS |
|---|---|---|
| Assessing a job applicant’s suitability for a role | Full name, ID copies, proof of address, designation, ownership status | Compliance with a legal obligation (Financial Intelligence Act for AML and KYC) |
| Conducting due diligence (AML/KYC) | Identity documents, proof of income, proof of residence, beneficial ownership details, credit check results | Compliance with a legal obligation (Financial Intelligence Act for AML and KYC) |
| Managing supplier or tenant relationships | Contact details, business structure, correspondence history | Legitimate interest (effective communication, engagement, and business operations) |
| Maintaining accurate records and supplier/tenant database | Personal and business-related information | Legitimate interest (accountability, governance, and regulatory preparedness) |
- regulatory or supervisory authorities (e.g. Financial Intelligence Agency), for legal compliance and AML/KYC obligations;
- legal and audit professionals, to support investigations, compliance, or legal advice;
- MRI Software Company, to manage and store supplier/tenant onboarding, contracts, and payment records
- TransUnion, to conduct credit and background screening as part of due diligence processes;
- IT and systems providers, to host, secure, and manage documentation and communication related to the relationship; and
- third-party onboarding and compliance screening platforms , for verification and background checks (e.g., sanctions, beneficial ownership).
- MRI Software Company, our property management system provider, may process personal data in South Africa. South Africa is recognised under the Data Protection Act as having an adequate level of data protection, meaning its laws offer protections equivalent to those in Botswana.
- TransUnion, which supports our due diligence and screening processes, also hosts personal data in South Africa, which is likewise covered by an adequacy decision.
When personal data is transferred to a country without an adequacy decision, we ensure appropriate safeguards are in place to maintain compliance with the Data Protection Act.
- Right of access – request confirmation and a copy of your personal data.
- Right to rectification – correct inaccurate or incomplete data.
- Right to erasure – request deletion of your data in specific cases.
- Right to restriction – limit processing in defined situations.
- Right to data portability – receive your data in a structured format.
- Right to object – object to processing based on legitimate interests.
- Right to withdraw consent – if applicable, you may withdraw consent without affecting prior lawful processing.
These rights may be limited depending on the legal basis and processing context. To exercise them, please contact us. You also have the right to lodge a complaint with the Information and Data Protection Commission.
