Privacy notice

01Who we are

Open Source Community Botswana (“OSCB”, “we”, “us”) is Botswana’s first open source community, based in Gaborone. We run BOSL, a showcase and directory for open work made for Botswana.

For the purposes of the Data Protection Act, 2024 and the GDPR, OSCB is the data controller for the personal data described in this notice. That means we decide what data is collected and why.

To be completed on registration

OSCB is currently an unincorporated community association and its formal registration is in progress. Once registration completes, this section must be updated with the registered entity name, registration number and registered address. Until then, the contact details below are the way to reach us about your data.

Contact for data protection matters

info@oscbotswana.co.bw

Gaborone, Botswana

02What this covers

This notice applies to this website, to signing in, to the projects you post and to correspondence you send us.

It does not cover other websites we link to. Every project links to work hosted elsewhere, such as GitHub, GitLab, a journal or a data portal. Those sites run under their own privacy policies.

03What we collect

When you sign in

You sign in with GitHub or Google. The provider tells us your email address (we only accept one the provider has verified), your name, the address of your profile picture, and an account identifier that is unique to that provider. We do not receive your password, and we do not read your repositories, contacts or other account data.

We also record when your account was created, and any role you hold on BOSL (for example reviewer or administrator).

The projects you post

A project listing is public. It shows what you type into the form: the name, summary and description, the type, sectors and licence, the source link, the details for that type of work (for example authors or file format), and the maintainer name and contact you give. Use a project or role address instead of a personal one if you prefer. Everything you enter is shown to anyone who opens the page.

Your name from GitHub or Google is also public. It appears next to the project as “Posted by” and on a contributor page that lists your projects. Your email address and profile picture are never shown. Accounts with no listed project have no public page.

For software on GitHub or GitLab, our server also reads public details about the repository, such as its language, licence and recent activity. That is information about the project, not about visitors.

Verification and moderation

If you ask for a project to be verified, we keep the request, the reviewer’s criteria results and written feedback. The feedback is shown to you and to the BOSL committee. We keep an audit log of actions that change a project’s status or visibility, recording who did it, what, and when. If you report a listing, we keep your report and its reason, and administrators can see who made it.

Email correspondence

If you email us, we receive your email address, your name if you give it, and whatever you write. We keep the thread so we can answer you and follow up.

Server logs

The BOSL application writes operational logs of each request: the page requested, the result and how long it took. They do not include IP addresses. Our hosting provider and any reverse proxy in front of the site may keep ordinary access logs that do. A page that embeds a BOSL badge makes its readers’ browsers load the badge from this site, so those requests appear in the same logs. They carry no cookies.

To be confirmed before launch

Name the hosting provider, where the site and its database are hosted, and what the provider logs and for how long. Replace this notice with the specifics.

04Why we use it, and our lawful basis

Both the Data Protection Act, 2024 and the GDPR require a specific lawful reason for every use of your personal data. Here is ours, purpose by purpose.

Our processing purposes and the lawful basis for each.
What we do	Data used	Lawful basis
Sign you in and let you edit your listings	Email, name, provider account identifier	Legitimate interests: providing the service you chose to use. GDPR Art. 6(1)(f).
Publish the projects you post	Everything you enter in the project form, including the maintainer contact	Consent, given when you submit the form. You may withdraw it by editing or removing the listing, or by emailing us.
Review a project when you ask for verification	The project, the request, reviewer results and feedback	Consent, given when you request the review.
Keep an audit trail and handle reports	Actor, action, time, report details	Legitimate interests: keeping the library trustworthy, and responding to abuse.
Keep the website running and secure	Operational logs and request limits	Legitimate interests: operating and protecting the site.
Answer your email	Your email address and message	Legitimate interests: replying to someone who contacted us.

We do not use your data to make decisions about you by automated means alone, and we do not profile you.

05Cookies and tracking

Browsing BOSL sets no cookies. There is no analytics, no advertising pixel, no tracking script and no third-party font or embed. Your browser contacts no one except this site when you load a page.

When you sign in, or start to, we set one cookie, bosl_session. It is strictly necessary: it keeps you signed in and protects your actions against forgery. It is signed so it cannot be altered, it cannot be read by scripts, it is not used for tracking, and it expires after a set period or when you sign out. Because it is strictly necessary, it does not need a consent banner.

If we ever add analytics or any other non-essential technology, we will ask for your consent before it runs, and this notice will be updated to say exactly what it does.

07Sending data abroad

GitHub and Google process sign in data on infrastructure that is likely to sit outside Botswana, and our own hosting may too. That can make some of the processing a cross-border transfer of personal data.

Under the Data Protection Act, 2024, transferring personal data out of Botswana is restricted: the destination must offer an adequate level of protection, as assessed by the Information and Data Protection Commission, or another lawful condition must apply. Under the GDPR, Chapter V sets out equivalent requirements.

To be confirmed before launch

Confirm where the site is hosted and which lawful transfer condition applies, then state it here plainly.

08How long we keep it

We keep personal data only as long as it is useful for the purpose we collected it, then delete it.

Your account and your listings: while your account exists. You can ask us to delete your account and listings at any time, and we will do so within 30 days.
Email correspondence: up to 24 months from the last message in the thread.
Operational logs: for a short period set by our hosting setup.

To be confirmed by the committee

Set how long verification records and the audit log are kept after a project is removed or an account is deleted, and state the period here.

09Your rights

You have the following rights over your personal data. They come from the Data Protection Act, 2024 in Botswana and from the GDPR if you are in the EU or EEA. We apply them to everyone regardless of where you are.

Access: ask what data we hold about you and get a copy.
Rectification: have data that is wrong or incomplete corrected.
Erasure: ask us to delete your data.
Restriction: ask us to pause using your data while a dispute is sorted out.
Objection: object to use based on legitimate interests.
Portability: receive the data you gave us in a common machine-readable format.
Withdraw consent: where we rely on consent, withdraw it at any time. This does not undo what we did lawfully beforehand.
Not be subject to automated decisions: we do not make decisions about you by automated means, so there is nothing here to opt out of.

Exercising these rights is free.

10Using your rights

Email info@oscbotswana.co.bw and tell us what you want. You do not need to use any particular wording or form.

We will reply within 30 days. If your request is complicated and we need longer, we will tell you within those 30 days and explain why. We may ask you to confirm your identity, so that we do not hand your data to someone else.

11Complaints

If you think we have mishandled your data, please tell us first: we would rather fix it. You can also complain to a regulator, and you do not have to come to us before you do.

In Botswana

The Information and Data Protection Commission supervises the Data Protection Act, 2024 and handles complaints from data subjects in Botswana.

In the EU or EEA

You may complain to the data protection supervisory authority of the country where you live or work, or where you think the problem happened.

12Security and breaches

We keep the amount of personal data we hold small, restrict access to the people who need it, and rely on the security controls of the established services we use. No system is perfectly secure, and we will not claim otherwise.

If a breach occurs that is likely to present a risk to you, we will notify the Information and Data Protection Commission within 72 hours of becoming aware of it, as the Data Protection Act, 2024 and the GDPR both require, and we will tell you directly where the risk to you is high.

13Under-18s and changes

If you are under 18, please check with a parent or guardian before posting. Anything you publish on a project page is public. A parent or guardian may contact us at any time to see what we hold about their child, or to have it deleted.

If we change how we handle personal data, we will update this page and change the date at the top. Where a change materially affects you (new purposes, new recipients, or anything requiring your consent), we will tell you directly rather than rely on you noticing.

This notice was last updated on 7 October 2026.