Privacy Policy (Botswana)

1. Introduction & Scope

Puma Energy Botswana ("Puma Energy", "we", "our" or "us"), in its capacity as a data controller, processes personal data of customers who opt into the PRIS loyalty programme and use its related mobile application ("PRIS App"). This Privacy Policy (the "Policy") sets out the principles and practices adopted by us regarding the collection, use, retention, disclosure and other matters relating to the transparent processing personal data.

This Policy applies to:

• Individuals registering for the PRIS loyalty program
• Individuals making use of and/or transacting through the PRIS App and cards; and
• Any person who otherwise communicates with us in relation to the PRIS loyalty programme

By using the PRIS App, you acknowledge that you have read and understood this Policy.

2. Categories of Personal Data Collected

For the purposes of providing, maintaining and improving the PRIS loyalty programme, Puma Energy may process the following categories of information:

• Identity and Contact Information: including but not limited to your full name, government-issued identification number, mobile number, postal and/or email address.
• Loyalty Account and Transactional Information: including your PRIS wallet ID, accumulated balance, top-up history, redemptions, station identifiers, location and time of transactions, rewards earned and redeemed, and promotional campaigns opted into.
• Device and Technical Information: including your device type, device unique identifiers and operating system, the version of the PRIS App in use, limited diagnostic or error reporting, IP address, session logs and location of usage.
• Marketing and Communications Preferences: including records of your decision to opt into or out of receiving marketing communications from Puma Energy.

3. Manner of Collection

We collect your personal information through the following lawful means:

• Direct provision by you: including registration data, transaction instructions, and communication initiated by you with Puma Energy.
• Automated collection: including limited device, log and usage information generated when you access or interact with the PRIS App or our support channels.
• Authorized partners: where required to process loyalty points, payments or top-ups, Puma Energy may receive information from authorized third parties such as mobile money operators or payment processors.

4. Purpose of Processing

Your personal data will only be processed for legitimate, lawful and specific purposes associated with the PRIS loyalty programme, which may include:

• Administering, operating and maintaining the PRIS App and loyalty programme;
• Verifying your identity and eligibility to participate in PRIS loyalty programme;
• Recording and executing transactions, rewards and redemptions;
• Preventing, detecting and responding to fraudulent activity, misuse or security incidents;
• Providing customer support and responding to queries or complaints;
• Complying with statutory and regulatory obligations applicable to Puma Energy;
• Sending and managing marketing communication based on your preferences.

5. Legal Basis for Processing

Puma Energy processes personal data for the PRIS loyalty programme on the following lawful bases:

• Consent in respect of participating in the PRIS loyalty programme and direct marketing.
  • In relation to direct marketing, our communication channels are email, SMS and WhatsApp. You may grant or withhold consent separately for each channel on the PRIS App by unsubscribing.
  • In relation to geolocation for store-finding, contextual offers or fraud prevention, you may consent through explicitly enabling location services for the PRIS App on your device.
• Legitimate interest where processing is reasonably required to protect Puma Energy's rights, prevent fraud or improve services, to the extent that such interests are not overridden by your fundamental rights.
• Legal obligation as and when required

6. Data Sharing & Disclosure

Puma Energy may disclose personal information to the following authorised recipients:

• Puma Energy group companies and affiliates, on a need-to-know basis;
• Service providers who support the PRIS App (including IT, hosting, maintenance, payment processors), subject to binding confidentiality and data protection obligations;
• Regulatory authorities, law enforcement bodies or courts of competent jurisdiction, where disclosure is required or permitted by law;
• Professional advisors, such as auditors and lawyers and third parties involved in a corporate transaction such as a merger, acquisition or sale of assets, in which case safeguards will be applied to ensure continuity of protection;

7. Cross‑Border Transfers

Your personal information may be transferred to, and stored in, countries outside Botswana for purposes of IT hosting or group-level administration. Transfers of personal data are undertaken to jurisdictions with adequate level of protection. Where such transfers are to jurisdiction without adequate level of protection, Puma Energy will rely on appropriate safeguards, in particular Binding Corporate Rules and Standard Contractual Clauses.

8. Data Retention & Accuracy

We retain personal data for as long as is necessary to fulfil the purposes described in this Policy, including to meet legal, regulatory, tax, accounting or evidentiary requirements. Thereafter, information is securely deleted or anonymized per internal policies & procedures.

It is your responsibility to ensure that personal data provided to Puma Energy is accurate, complete and up to date. Puma Energy shall not be liable for consequences arising from your failure to update such information.

9. Your Rights

Subject to applicable law, you may exercise the following rights:

• Request access to the personal data held about you;
• Request correction of inaccurate or incomplete data;
• Request deletion where personal data is no longer required;
• Object to certain forms of processing, including direct marketing;
• Withdraw consent previously given (without affecting lawfulness of prior processing)

Requests should be directed to the Contact Us form or prisafrica@pumaenergy.freshdesk.com and will be addressed in accordance with statutory timelines. Puma Energy reserves the right to refuse or charge a fee for manifestly unfounded or excessive requests.

10. Security Measures

Puma Energy implements appropriate technical and organizational measures to ensure the integrity and confidentiality of personal data, including encryption in transit, access restrictions, secure storage facilities, and periodic review of security protocols. While we take reasonable precautions, no system is completely secure, and Puma Energy disclaims liability for unauthorised access beyond our reasonable control.

In the event of a data breach likely to result in material risk to your rights or freedoms, Puma Energy will notify you and, where applicable, the relevant supervisory authority within the period required by law.

11. Cookies & Similar Technologies

The PRIS App may use cookies or similar technologies for core operational purposes (such as maintaining session state) and for limited analytical purposes. You may disable cookies through your device settings, but please note this may impair the functionality of the PRIS App. You can refer to the cookie policy of Puma Energy here (https://pumaenergy.com/privacy-policy/).

12. Children

The PRIS App and loyalty programme are not intended for use by individuals below the legal age of majority in Botswana. Puma Energy does not knowingly collect information from minors without parental or guardian consent. Should such personal data be inadvertently collected, Puma Energy will promptly delete it on being notified.

13. Compulsory Data & Consequences of Non‑Provision

Certain categories of information are compulsory for the establishment and operation of a PRIS account, including but not limited to name, mobile number and national identification details. Failure to provide such information will render Puma Energy unable to provide you with access to the PRIS App or its services. Optional information may be provided at your discretion, and refusal to provide optional information will not restrict your ability to participate in PRIS.

Puma Energy holds the sole discretion to determine the categories of information required, the purposes for which such information is processed, and the conditions under which PRIS services are provided.

14. Amendments to this Policy

Puma Energy may amend this Policy from time to time to reflect changes in law, regulation or operational practices. Material changes will be notified through the PRIS App or other reasonable communication methods. Continued use of the PRIS App following such notice shall constitute acceptance of the amended Policy.

15. Contact & Complaints

For questions, requests or complaints regarding this Policy, please contact:

If you are dissatisfied with Puma Energy's response, you have the right to escalate the matter to the applicable data protection authority in Botswana.