Data Protection Statement
Version 1.0 · effective 8 October 2026 · Beta Clean (Pty) Ltd, Gaborone, Botswana
This statement sets out how Beta Clean (Pty) Ltd of Gaborone, Botswana, protects personal data that customers put on Stratum ESG, and the commitments it makes as their processor under the Botswana Data Protection Act, 2024 (Act No. 18 of 2024). Every user accepts it before using the platform.
1. Purpose and scope
1.1 This statement applies to personal data contained in Customer Data on Stratum ESG: ESG values, evidence, disclosures and reports that relate to identifiable people.
1.2 It forms part of the Terms and Conditions and works as the data processing agreement between Beta Clean and each Customer. How Beta Clean handles its own users' account data is covered by the separate Privacy Statement.
1.3 Words such as controller, processor, data subject, personal data, sensitive personal data and personal data breach have the meanings given in the Act.
2. Roles
For ESG data the Customer is the controller and Beta Clean is its processor. For the data Beta Clean needs to run its own business (accounts, billing, KYC, security logs) Beta Clean is the controller.
| Data | Controller | Processor | Covered by |
|---|---|---|---|
| Customer Data: ESG values, evidence, disclosures, narratives, reports | Customer | Beta Clean | This statement |
| User accounts: name, email, role, sign-in and security data | Beta Clean | Supabase, Resend | Privacy Statement |
| Customer and Partner KYC: company details, directors, beneficial owners, documents | Beta Clean | Supabase | Privacy Statement |
| Billing: tokens, usage, invoices, payments | Beta Clean | Supabase | Privacy Statement |
| Audit logs and acceptance records | Beta Clean (kept as evidence for both parties) | Supabase | Both |
The Customer is responsible for having a lawful basis to put personal data on the platform, for telling its own employees and others what it does with their data, and for the instructions it gives through its use of the platform.
3. What we process for the Customer
Most ESG data is aggregate and not personal: litres of fuel, kWh, tonnes of waste. Personal data appears mainly in evidence documents and in social and governance metrics.
| Category | Examples | Data subjects |
|---|---|---|
| Aggregate workforce figures | Headcount by gender, injury rates, training hours, pay ratios | Usually none identifiable |
| Evidence documents | Payroll extracts, incident reports, invoices, meter readings with names | Employees, contractors, suppliers |
| Governance disclosures | Board members, committee members, executives' roles and remuneration | Directors and senior managers |
| Report contacts | Foreword author, report contact name and email | Customer staff |
| Notes and comments | Free-text notes by contributors and reviewers | Customer staff, and anyone named in them |
Purpose: solely to provide the platform to the Customer: storing, calculating, reviewing, reporting and exporting its ESG information.
Duration: for the term of the agreement, then the export and deletion periods in clause 10.
Sensitive personal data: the platform is not designed for health, biometric or other sensitive personal data about named individuals. The Customer should report such matters in aggregate and redact evidence where it can.
4. Our commitments as processor
As processor, Beta Clean will:
- Process Customer personal data only on the Customer's documented instructions, which are these terms and the Customer's use of the platform, and tell the Customer if it believes an instruction breaks the Act.
- Ensure everyone who can access it is bound by confidentiality.
- Apply the security measures in clause 5.
- Use sub-processors only as set out in clause 6.
- Transfer data outside Botswana only as set out in clause 7.
- Notify the Customer of personal data breaches as set out in clause 8.
- Help the Customer answer data subject requests (clause 9), and with data protection impact assessments and consultations with the Information and Data Protection Commission where they concern the platform.
- Return and delete data at the end of the service (clause 10).
- Make available the information needed to show compliance, and allow reasonable audits (clause 11).
Beta Clean will not sell Customer personal data, use it for its own purposes, or combine it with other data, except anonymised statistics that identify no one.
5. Security measures
Beta Clean applies technical and organisational measures suited to the risk, as the Act requires of controllers and processors.
| Area | Measures |
|---|---|
| Access control | Each Workspace is isolated in the database by row-level security; five roles; owners and admins can limit people by department to sections of the workspace and pillars of data, and contributors to sites; auditors see approved data only; partners see no ESG data |
| Authentication | Passwords of at least 10 characters with breached-password checks; optional authenticator app; optional passkeys (fingerprint, face or device passcode, checked on the device, with only a public key stored); sessions expire after an hour without refresh |
| Document uploads | Three factors: sign-in, authenticator app or passkey, and a one-time email code valid 10 minutes |
| Storage | Private storage; files served only through links valid for 60 seconds |
| Encryption | TLS for all traffic with HSTS; encryption at rest provided by the hosting provider |
| Integrity | Tamper-evident SHA-256 hash chain over every change; immutable invoices and payments |
| Secrets | API keys and one-time codes stored only as hashes; server keys never sent to browsers |
| Application security | Strict content security policy, no framing, no caching of private pages |
| Monitoring | Health checks; audit log of document views and downloads |
| People | Platform administration limited to named Beta Clean staff; confidentiality duties |
| Testing | Automated tests of the access rules on every change |
6. Sub-processors and where data is held
Beta Clean uses three sub-processors. Each is bound by written terms that protect the data at least as well as this statement.
| Sub-processor | Service | Data | Location |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage, scheduled jobs | All platform data | London, United Kingdom (AWS eu-west-2) |
| Vercel Inc. | Application hosting | Data in transit while pages are served; no permanent storage | London, United Kingdom (lhr1) |
| Resend, Inc. | Email delivery | User names and email addresses, email content | United States |
Beta Clean will give Customers at least 30 days' notice of a new or replacement sub-processor by email and on the platform. A Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Customer may close its Workspace and receive a refund of unused purchased Tokens.
If Beta Clean moves hosting to Docker on its own or another provider's servers, it will update this list.
7. Cross-border transfers
Customer Data is hosted in the United Kingdom, so it leaves Botswana. The Act allows such transfers only where the destination gives adequate protection, as recognised by the Minister or authorised by the Information and Data Protection Commission, or where another lawful ground or safeguard applies.
Beta Clean transfers Customer personal data to the United Kingdom (hosting) and, for email delivery only, to the United States, and only on a ground the Act allows: to a country recognised as giving adequate protection, or with written contractual safeguards with each sub-processor and, where the Act requires it, the authorisation of the Information and Data Protection Commission.
Beta Clean will not transfer Customer personal data to any other country without updating this statement and giving notice under clause 6. A Customer that needs its data held in Botswana or South Africa may ask about a Galaxy workspace with a chosen hosting region.
8. Personal data breaches
Beta Clean will tell an affected Customer of a personal data breach without undue delay, and in any case within 48 hours of becoming aware of it, so the Customer can notify the Commission within the Act's 72 hours.
The notice will say, as far as then known:
- what happened and when;
- the categories and approximate number of people and records affected;
- the likely consequences;
- what Beta Clean has done and proposes to do to contain it and limit harm;
- a contact for more information.
Beta Clean will add details as they become known, cooperate with the Customer's notifications to the Commission and to people at high risk, and keep a record of every breach. Where Beta Clean is itself the controller (clause 2), it notifies the Commission directly within 72 hours where the Act requires.
9. Helping with data subject requests
People whose data is in Customer Data may ask to access, correct or delete it, or object to its use. Those requests are the Customer's to decide.
- If Beta Clean receives such a request directly, it will pass it to the Customer within 5 business days and will not answer it itself unless the Customer asks.
- The platform lets the Customer find, export, correct and delete values, notes and evidence itself.
- Where the Customer cannot do something itself, Beta Clean will help on request, at no charge for reasonable requests.
- Approved data in a locked period and audit log entries are kept as records. A correction is made by reopening and amending, which leaves the history visible.
10. Retention, return and deletion
| What | Kept for | Then |
|---|---|---|
| Customer Data in an active Workspace | As long as the Customer keeps it | Customer may delete drafts and evidence at any time |
| Customer Data after the agreement ends | 30-day export window | Deleted from the live platform within 90 days; removed from backups as they expire |
| Audit log entries | Life of the Workspace, then 8 years | Deleted |
| Invoices, payments, KYC records, acceptance records | 8 years after the year they relate to (Botswana tax and company law) | Deleted |
| API request logs | 13 months | Deleted automatically |
| One-time upload codes | Until used or expired (10 minutes); stored as hashes | Purged |
On request, Beta Clean will confirm deletion in writing.
11. Audits and records
11.1 Beta Clean keeps a record of its processing for each Customer, and of every personal data breach.
11.2 Customers can verify much of this themselves: the audit log shows every change and download in their Workspace and can be re-checked against its hash chain at any time.
11.3 Once a year, or after a breach, a Customer may audit Beta Clean's compliance with this statement, by questionnaire or, on 30 days' notice, through an independent auditor bound by confidentiality, at the Customer's cost. Beta Clean may meet the request with third-party certifications or reports of its sub-processors where they cover the point.
11.4 Beta Clean will cooperate with the Information and Data Protection Commission in the performance of its duties.
12. Contact, redress and changes
12.1 Data Protection Officer: Onkabetse Gwamulumba, Beta Clean (Pty) Ltd, Block 6, Gaborone, Botswana; P.O. Box 20327, Bontleng, Gaborone; +267 77402001; [email protected].
12.2 Redress. A Customer or data subject with a concern should first contact the Data Protection Officer, who will acknowledge it within 5 business days and respond within 30 days. Anyone may also complain to the Information and Data Protection Commission of Botswana in Gaborone, and may seek a remedy in the courts of Botswana sitting in Gaborone. Disputes between Beta Clean and a Customer are resolved as set out in clause 18 of the Terms and Conditions.
12.3 Changes: new versions are published with a version number and effective date, with 30 days' notice of material changes. Every user must accept the new version before continuing to use the platform.
12.4 Order of precedence: on personal data, this statement prevails over the Terms and Conditions.