Privacy Statement
Version 1.0 · effective 8 October 2026 · Beta Clean (Pty) Ltd, Gaborone, Botswana
This statement explains what personal data Beta Clean (Pty) Ltd of Gaborone, Botswana, collects about the people who use Stratum ESG, why, who sees it, and the rights you have under the Botswana Data Protection Act, 2024.
1. Who we are and what this covers
Beta Clean (Pty) Ltd ("Beta Clean", "we") of Block 6, Gaborone, Botswana (P.O. Box 20327, Bontleng, Gaborone) runs Stratum ESG and is the controller of the personal data described here.
This statement covers:
- users of the platform: client staff, auditors, partners' staff and Beta Clean staff;
- directors, beneficial owners and contacts named in company (KYC) details;
- visitors to the Stratum ESG website.
It does not cover the ESG data that clients put on the platform about their own employees or others. Clients control that data; how we handle it for them is set out in the Data Protection Statement.
2. The personal data we collect
| Category | What | Where it comes from |
|---|---|---|
| Account | Name, work email, password (stored only as a secure hash), organisations, roles and department | You, or the person who invited you |
| Security | Authenticator app enrolment; passkeys (a public key, the name you give it and when it was used; your fingerprint, face or passcode is checked by your device and never reaches us); sign-in times, one-time codes (stored as hashes), IP address, browser | Your use of the platform |
| Acceptance records | Which version of our legal documents you accepted, the name you typed, when, your IP address and browser | You, when you accept |
| Activity | Actions you take in a workspace, recorded in its audit log with your name and role; daily count of your clicks | Your use of the platform |
| KYC | Directors' and beneficial owners' names, ID type and number, nationality, ownership share; contact names, emails and phones; identity documents | The client or partner submitting KYC |
| Billing | Billing contacts, bank payment references | Clients and partners |
| Support | What you tell us when you contact us | You |
We do not collect special categories of personal data about users, and we do not use automated decision-making that has legal or similar effects on you.
3. Why we use it and on what basis
| Purpose | Data used | Legal basis under the Act |
|---|---|---|
| Create and run your account; let you into the right workspaces | Account, security | Performing our contract with you and your organisation |
| Keep the platform and your data secure; stop misuse | Security, activity | Our legitimate interest in security; our legal duty to secure data |
| Keep a tamper-evident record of changes for your organisation and its auditors | Activity | Performing the contract; legitimate interest in reliable records |
| Record your acceptance of our terms | Acceptance records | Performing the contract; establishing and defending legal claims |
| Verify clients and partners (KYC) and prevent fraud and money laundering | KYC | Our legal obligations; legitimate interest in knowing who we deal with |
| Meter usage, invoice and collect payment; pay partners | Activity (click counts), billing | Performing the contract; tax and accounting law |
| Send service emails: confirmations, sign-in links, upload codes, invoices, notices of changes | Account | Performing the contract |
| Answer support requests | Support | Performing the contract; legitimate interest |
| Improve the platform using statistics that identify no one | Anonymised activity | Legitimate interest |
We do not send marketing emails without your consent, and you can withdraw consent at any time. We never sell personal data.
4. Cookies and usage metering
Stratum ESG uses only strictly necessary cookies: the ones that keep you signed in and protect your session. There are no advertising or third-party tracking cookies.
| Cookie or record | Purpose | Lasts |
|---|---|---|
| Supabase session cookies (sb-...) | Keep you signed in; refresh your session securely | Session token 1 hour, renewed while you use the platform; cleared on sign-out |
| Click meter | Counts your clicks inside an active workspace so the workspace can be billed (1 token per click) | Stored as a daily count per user and workspace; no record of what you clicked |
The click meter is part of how the service is priced, so it cannot be switched off while you use a workspace.
5. Who we share it with
| Recipient | What they see | Why |
|---|---|---|
| Other members of your workspace | Your name, email and role; your actions in the audit log | So the team and its auditors know who did what |
| Your organisation's owners and admins | As above, plus your acceptance and access settings | To manage access |
| Your organisation's partner, if any | The organisation's name, status, KYC status and billing; not your activity or ESG data | To support the client and calculate shares |
| Supabase (database, sign-in, storage) | All platform data | Hosting |
| Vercel (application hosting) | Data passing through while pages are served | Hosting |
| Resend, Inc. (email, United States) | Your name and email; the email content | Sending service emails |
| Banks | Payment references | Receiving and making payments |
| Authorities, courts, regulators | What the law requires | Legal obligations |
If Beta Clean's business is sold or restructured, personal data may pass to the new owner under the same protections, and we will tell you.
6. Transfers outside Botswana
The platform is hosted in London, United Kingdom, so your personal data is stored outside Botswana, and service emails are sent through Resend in the United States. We transfer personal data only where the Act permits: to a country recognised as giving adequate protection, or with written safeguards with each provider and, where the Act requires it, the authorisation of the Information and Data Protection Commission.
We do not otherwise transfer your personal data abroad. If that changes, we will update this statement first.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account | While you have access to any workspace or partner account, then 12 months |
| Security logs and IP addresses | 13 months |
| One-time upload codes | Until used or 10 minutes, as hashes only |
| Acceptance records | Life of your account plus 8 years |
| Audit log entries naming you | Life of the workspace plus 8 years; they cannot be edited, because they are the record |
| KYC records | 8 years after the business relationship ends |
| Billing records | 8 years (Botswana tax law) |
| Support correspondence | 3 years |
When a period ends we delete the data or make it anonymous.
8. How we protect it
Your data sits in a database that enforces, row by row, who may see it. Traffic is encrypted, passwords and codes are stored only as hashes, document uploads need three separate checks, and every change is sealed in a tamper-evident audit log. Only named Beta Clean staff can administer the platform. The Data Protection Statement lists the measures in full.
You can help by using a strong, unique password, setting up an authenticator app or a passkey, and never sharing codes or sign-in links.
9. Your rights
Under the Act you have the right to:
| Right | What it means here |
|---|---|
| Be informed | This statement, and notice before any new use |
| Access | Get a copy of the personal data we hold about you |
| Correction | Have inaccurate data corrected; you can change your name and password yourself |
| Deletion | Have data deleted when we no longer need it, subject to the records we must keep (section 7) |
| Objection and restriction | Object to processing based on our legitimate interests, or ask us to limit it while a complaint is resolved |
| Withdraw consent | Where we rely on consent, withdraw it at any time |
| Object to direct marketing | Stop marketing at any time; we do not send it without consent |
| Complain | Complain to the Information and Data Protection Commission |
How to use them: email our Data Protection Officer at [email protected] with the subject "Data request". We may ask you to confirm your identity. We will answer within 30 days, free of charge for reasonable requests.
Audit log entries and acceptance records cannot be changed, because they are evidence; where they are wrong, we add a correction rather than editing the record. Requests about ESG data your employer put on the platform go to your employer, as controller; we will pass them on.
10. Children, changes, contact and redress
Children. Stratum ESG is a business service for adults. It is not intended for anyone under 18, and we do not knowingly collect children's personal data.
Changes. We publish new versions with a version number and effective date, and give at least 30 days' notice of material changes. You must accept the new version before continuing to use the platform.
Data Protection Officer. Onkabetse Gwamulumba, Beta Clean (Pty) Ltd, Block 6, Gaborone, Botswana; P.O. Box 20327, Bontleng, Gaborone; +267 77402001; [email protected].
Complaints and redress. Please contact our Data Protection Officer first so we can put things right; we acknowledge complaints within 5 business days and respond within 30 days. If you are not satisfied, you may complain to the Information and Data Protection Commission of Botswana in Gaborone at any time, and you may seek a remedy in the courts of Botswana sitting in Gaborone.