Lesotho Messaging Privacy Policy

Last updated: 23/08/2024

This Privacy Policy gets updated from time to time; whenever we make a change, we'll post this on our website and let you know. We have revised our privacy policy as we are introducing some new features, new products, and new ways of working.

How to use this privacy policy

In this policy, we explain how we collect, use, share and protect your personal information when you use our products and services and our website.

You can find the privacy supplements for all our products and services by visiting the Privacy Portal | Vodacom Lesotho.

Who we are

We are Vodacom (Pty) Ltd (referred to as "Vodacom").

Our registered office is Vodacom Park NO:585 Mabile Road, Maseru Lesotho. We are registered in Lesotho under company number I95/236.

In some circumstances, Vodafone Group Services Limited (VGSL) controls the processing of your personal information jointly with us. The registered office of VGSL is Vodafone House, The Connection Newbury, Berkshire RG14 2FN. We are registered in England under company number 03802001. Unless otherwise specified in a separate privacy statement, the way your personal information is processed will remain compatible with the wording of this privacy statement.

In this privacy policy:

• "we/us" means Vodacom Lesotho;
• "third party" means someone who is not you or us;
• "partner organisation" means external third party business entity that provides value-added services; and
• "Vodacom Lesotho" means an electronic communications service provider of telecommunications network services and products and manages personal and traffic data related to its customers' use of its communications network (both enterprise and consumer), and other customer information relating, but not limited to, customer care, customer management, customer insight and analysis, and marketing business functions.

How to contact us

Our principles

Vodacom is committed to respecting your privacy. We take privacy, security and complying with data protection and privacy laws seriously. We have set out our core Privacy Commitments in our Privacy portal. We aim to put these commitments at the heart of everything we do.

Personal information we collect about you

Directly from you

The information we collect about you and how we collect it can vary depending on the products and services that you use and subscribe to, how you have used the products and services, and how you have interacted with Vodafone even if you aren't a customer, or what we have obtained from a third party.

We will collect your personal information when you, for example:

• Sign up to any of our products or services;
• Use our network or other Vodacom Lesotho products or services;
• Contact us through various channels for support or ask for information about products or services;
• Visit or browse our website; and
• If you are a non-Vodacom customer and contact a Vodacom customer or a Vodacom customer care team.

From third parties

Information collected not directly from you includes information we obtain from other sources, such as credit agencies, fraud-prevention agencies, and from other data providers. This includes demographic data, interest-based data, and internet browsing behaviour.

The types of information we may have, where applicable:

• Contact details: Such as your name, address, phone and/or mobile number and email address;
• Financial details: Such as your credit or debit card information, information about your bank account and other banking information - for example, you'll have to give us this information when you open an account with us. We'll collect the data necessary to process a payment whenever you make a purchase;
• Your traffic data: Every time you use your mobile phone, a record is kept. This includes the number you called or sent an SMS or MMS to, the length, date and time of that call, SMS or MMS, the amount of data you are using and your approximate location at the time that the communication takes place (based on the location of the nearest cell that you sent that call or message from). The same is also recorded every time you receive an incoming call or message. This is data we see as part of providing you with connectivity; we don't, however, keep a record of the content of your calls or messages.
• Information about your device or connectivity: Such as IP address, IMEI and MSISDN.
• Your location data: This can be precise where it uses Global Positioning System (GPS) data or by identifying nearby mobile phone masts and Wi-Fi hotspots and you enable location-based services or features. Or less precise where, for example, a location is derived from your IP address or data such as a post code or name of a town or city;
• Your contact with us: Such as a note or recording of a call you make to one of our contact centres, a Live Chat an email or letter sent, or other records of any contact with us;
• Your account information: Such as your date of birth, gender, dates of payment owed or received, subscriptions you use, account numbers or other information related to your account or included in My Vodacom app;
• Credential information: We'll collect passwords, hints and similar security information used for authentication and access to accounts and services;
• Your preferences: For products, services and lifestyle activities when you tell us what they are, or we assume what they are, based on how you use the products and services;
• Cookies: See the Cookies Policy for details on what we collect using cookies, web beacons and other technologies, including advertising data;
• Your browsing history: If you have given your permission, Vodacom collects the categories of website you have browsed on your mobile, device or PC, for example Sports, Music or News. However, we don't have a history of the sites you browse, as this is limited for a short period of time to enable the connection to be made. We use these interests to send you personalised marketing or show you personalised advertising. You can opt out of advertising through Cookies or, in the case of marketing, your privacy settings.
• Information about how you use our products and services: Such as the level of service that you receive - for example, network or service faults and other events that may affect our network services or other services; or your viewing history if you use our V-Live products for example.

How we use your personal information and our lawful basis to do so

We will use your personal information for a number of purposes ranging from enabling us to provide you with the products or services you have requested to ensuring we are keeping these secure from fraud.

We may use Artificial Intelligence (A.I.) to help us provide you with a requested product or service. If we use A.I. we will do so responsibly, and where necessary we will disclose that the content is generated by A.I.

Whenever we use your personal information, we do so based on a specific lawful bases under data protection law listed below:

• The performance of your contract or to enter into the contract and to take action on your requests: For example, so you can make calls and texts, and browse the internet on your phone, we process things like the numbers you dial, how much data you're using and when you're doing it so we can provide connectivity. This also enables us to generate your bill, based on your usage. We also conduct credit checks when you apply for a product or service, which is operated on a bill pay basis to verify your suitability for entry into such a contract.
• Legitimate interests of Vodacom: For example, fraud prevention, maintaining the security of our network and services, direct marketing, and improvement of our services. Whenever we rely on this lawful basis to process your data, we assess our legitimate interests to make sure they do not override your rights. Additionally, in some cases you have the right to object to this processing.
• Compliance with a mandatory legal obligation: Including for example accounting and tax requirements, which are subject to strict internal policies (such as retention periods) and procedures.
• Consent: Where you have provided it by your own free will. Consent may be withdrawn at any time.

1. To provide you with your service

It is necessary for us to process your personal information to enable us to provide you with your service. By service we mean any services or products that you buy or use such as broadband, mobiles, use of our apps or smart tech products.

How is your information used?	What data is used?	Lawful basis
To process your order and provide you with your products and services To process the products and services you've bought from us, keep you updated with the progress of your order, and provide the relevant products or services. This includes other services not included in your agreement with us (e.g. PayPal).	Contact details, Account information, Financial details	Performance of your contract
Billing and Customer Care To bill you for using our products and services, to take the appropriate amount of credit from you, contact you if billing info is about to expire, and respond to any questions or concerns.	Account information, Financial details, Your contact with us	Legitimate interest, Performance of your contract
Service messages We will contact you with customer service messages to keep you updated with current information regarding products and services you've purchased (e.g. terms changes, upgrades, roaming).	Contact details, Account information	Soft opt-in legitimate interests, Performance of your contract

2. To improve our service

We collect information such as on your use of our products and services on an aggregated or anonymous basis in order to help us manage and improve the services we offer to everyone.

How is your information used?	What data is used?	Lawful basis
Improving and innovating our products and services We anonymise, de-identify or aggregate information in order to improve the service we offer to everyone. None of these analytics are linked back to you in any way.	Anonymised/aggregated: Financial details, Traffic data	Consent
Improving and innovating our products and services through third parties We collect and combine information in order to monitor your use of products and services to improve quality. We provide this to third parties (e.g., content providers) but reporting does not identify individuals.	Anonymised/aggregated: Account information	Legitimate Interest
Manage our networks and understand network usage To protect our networks and manage volumes of calls/data. To understand how you use our networks so we can develop better products.	Traffic data, Location data	Consent
Improving roaming services To improve your roaming experiences and understand how Vodafone is performing in providing roaming services. Vodafone creates aggregated management reports from this information.	Anonymised/aggregated: Contact details, Credential information, Traffic data	Legitimate interest

3. Marketing and tailoring our service to you

We process your personal information for marketing and advertising purposes, such as to let you know about new products or services and send you special offers. You can control your Marketing permissions at any time by visiting the nearest Vodacom shop.

How is your information used?	What data is used?	Lawful basis
Marketing (Personalised) We process data to send you marketing communications. We can further tailor these messages using your calling and messaging activities, location information and browsing information, if you have authorised us.	Contact details, Your preferences, Browsing history, Account information, Location data	Consent
Marketing (General) As our customer, we will keep you informed generally about new products and services. We tailor these messages based on the sorts of products and services you've bought from us.	Contact details, Account information, Questionnaire answers	Legitimate interest
Personalised/targeted advertising online To deliver advertising that is relevant to you based on cookies (interest-based advertising).	Cookie data, Browsing history, Account information	Consent
Research and analytics We use "Big data analytics" to uncover patterns and trends. We use this for market research and to provide reports to third parties (which don't identify you).	Account information	Legitimate interest

4. Profiling, Fraud Management and Security

How is your information used?	What data is used?	Lawful basis
Credit checks and ID We will carry out a credit check when you apply for a contract. We also use your info for identity verification.	Financial details, Account information, Credential information	Performance of your contract
Fraud Prevention, Security and Debt Collection We process traffic data to protect against fraud, misuse of networks, and to recover debts.	Traffic data, Account information, Financial details	Legitimate interest
Network Security To protect/detect damage to our networks or resolve technical issues.	Anonymous/aggregated contact details, Traffic data	Legitimate interest
Physical Security We may use CCTV footage to safeguard our stores and sites.	Images, Video footage	Legitimate interest

5. To comply with mandatory legal obligation

How is your information used?	Applicable Legislation
Accounting and tax requirements	Companies Act No. 18 of 2011; Income tax Order 1993; Value added tax act 2001
Law enforcement purposes We may need to release your information to comply with authorities' lawful demands.	Criminal procedure and evidence act 1981; Penal Code Act 2012; Prevention of corruption/economic offences act 1999
Complaint handling purposes	Consumer protection guideline 2022; Vodacom Lesotho consumer protection code
Sharing caller ID and location data with emergency services	Criminal procedure and evidence act 1981; Penal Code Act 2012

How we share your personal information

Where applicable, we share information about you with:

• Companies in the Vodafone Group.
• Partners or agents involved in delivering the products and services you've ordered or used.
• Companies who are engaged to perform services for, or on behalf of, Vodafone Limited, or Vodafone Group.
• Credit reference, fraud-prevention or business-scoring agencies, or other credit scoring agencies.
• Debt collection agencies or other debt-recovery organisations.
• Law enforcement agencies, government bodies, regulatory organisations, courts, or other public authorities if we have to, or are authorised to by law.
• Emergency services (if you make an emergency call), including your approximate location.
• Third parties for joint promotions with that third party.
• Partner organisations we've carefully chosen so they can contact you about their products and services (we'll ask for your consent first).
• Third parties that we advertise with, such as Facebook, in order to serve you advertisements online.

International Data Transfers

We may need to transfer your information to other Vodafone Group companies (for instance our Vodafone Intelligence Solutions centres located in Egypt, Hungary, Albania and India, who provide customer support) or service providers in countries outside Lesotho and the European Economic Area (EEA). The EEA consists of countries in the European Union, Switzerland, Iceland, Liechtenstein and Norway: they are considered to have equivalent laws when it comes to data protection and privacy.

If Vodafone sends your information to a country that is not in the EEA, we will make sure that your information is properly protected. We will always ensure to conduct a transfer impact assessment and ensure that there is a proper legal agreement that covers the data transfer.

How long we keep your personal information for

We'll store your information for as long as we must by law. If there's no legal requirement, we'll only store it for as long as we need to.

We're required by law to keep certain personal information about how you use our services for 12 months. Some account information will be held for 1 year from the end of your contract with us.

We'll keep some personal information for a reasonable period after your contract with us has finished in case you decide to use our services again.

Keeping your personal information secure

We have specialised security teams who constantly review and improve our measures to protect your personal information from unauthorised access, accidental loss, disclosure, or destruction.

Communications over the internet (such as emails) aren't secure unless they've been encrypted. Your communications may go through a number of countries before being delivered, as this is the nature of the internet.

We cannot accept responsibility for any unauthorised access or loss of personal information that is beyond our control. We'll never ask for your secure personal or account information by an unsolicited means of communication.

Your rights

• Right to correct personal data: You have the right to have information held about you corrected if it is not accurate. Visit any Vodacom Lesotho shop to rectify such information.
• Right to access personal data: You have the right to make a request for a copy of the personal data that Vodacom holds about you. You can visit any Vodacom Lesotho shop.
• Right to data portability: You have the right to be able to take with your data you provided to us in certain circumstances.
• Right to object to processing: Where we rely on our legitimate interests, please visit the nearest Vodacom shop.
• Right to withdraw consent: You can withdraw your consent any time after giving it.
• Right to restrict use of your data: If you feel the data we hold on you is inaccurate or believe we shouldn't be processing your data, please contact our customer care team.
• Right to erasure: In certain circumstances you have the right to request that we erase personal data of yours that we hold.

To opt out of Marketing messages:

If you no longer want to receive marketing messages from Vodafone, you can elect to opt out of all marketing communications or only selected methods (SMS, phone or post).

There are various ways to opt out:

• Dial the relevant products USSD to manage your permissions.
• Contact our customer care team.
• Tell the adviser if you receive a marketing call.
• Visit the nearest Vodacom shop.

Opting out does not mean that you won't any longer receive service-related messages. You will continue to receive those (unless we have indicated otherwise).

How to lodge a complaint

If you want to contact us about any of your rights or if complain about how we use your information, contact our customer care team, or visit the nearest Vodacom shop. We'll do our best to help but if you're still unhappy, you can contact Lesotho communications authority (LCA).