Vodacom Lesotho

Our privacy and cookies policy gets updated from time to time. Whenever we make a change, we'll post this on our website and let you know if there is a material change.

HOW TO USE THIS PRIVACY AND COOKIES POLICY
In this privacy policy, we explain how we collect, use, share and protect your personal information when you use our products and services and our website.

It is important to note that when you engage with us, you acknowledge that we require your personal information, as defined in Data Protection Act (DPA) and other related regulations, and need to process such personal information to provide products or services to you for purposes including to confirm, update and enhance our records, to confirm your identity and additional purposes as detailed below and in other supplementary privacy policies and statements linked to specific services that you subscribe to.

We are Vodacom (Pty) Ltd (referred to as a "Vodacom")
Our registered office is Vodacom Park NO:585 Mabile Road, Maseru Lesotho. We are registered in Lesotho under company number I95/236.
In this privacy policy:

• "we/us" means Vodacom (Pty) Ltd,
• "third party" means someone who is not you or us
• "Vodacom Group" means Vodacom Group Limited and any company or organisation in which Vodacom Group Limited owns more than 30% of the share capital
• "Vodafone Group" means Vodafone Group Plc and any company or other organisation in which Vodafone Group Plc owns more than 15% of the share capital
• "Personal information" refers to personal information about you as defined in DPA and includes without limitation MSISDN (Mobile Station International Subscriber Digital Network) information (a unique identifier that is linked to your mobile phone number), location information, call data records, usage information, race, gender, nationality, marital status, age, physical or mental health, disability, language, education, identity number, telephone number, email, postal address, biometric information, and financial, criminal or employment history.
• "Process (or processing)" means any operation or activity, whether automated or not, concerning personal information, including collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation, use, dissemination using transmission, distribution or making available in any other form, merging, linking, as well as blocking, degradation, erasure or destruction of information.

Our principles
We are committed to respecting your privacy.
We take data protection and privacy laws, as well as privacy and security, very seriously.
Here are our core Privacy Commandments.
We aim to put these commandments at the heart of everything we do.`

The information we collect about you and how we collect it varies depending on the products and services you use and subscribe to, how you've used them, how you've interacted with Vodacom even if you're not a customer, or what we've obtained from a third party with permission to share it with us. To find the privacy supplement for our products and services please go to the privacy and our “products and services” section of this privacy portal. Vodacom subsidiaries may have their own privacy statement governing the customer's use of a particular product. Vodacom will process your personal information based on:

• The performance of your contract or to enter into the contract and to take action on your requests. For example, so you can make calls and texts, and browse the internet on your phone, we process things like the numbers you dial, how much data you're using, and when you're doing it so we can provide connectivity. This also enables us to generate your bill, based on your usage. We also need to conduct credit checks when you apply for a product or service.
• Vodacom's legitimate business interests, for example, fraud prevention, prevention of tax evasion and financial crime, maintaining the security of our network and services, direct marketing, and the improvement of our services. Whenever we rely on this lawful basis to process your personal information, we assess our business interests to make sure they do not override your rights. Additionally, in some cases, you have the right to object to this processing. For more information, visit the 'Your rights' section of this privacy policy.
• Protecting your legitimate interests - for example, providing notifications regarding network availability and performance in your area, notification of emergency services, and fraud prevention. For more information, visit the 'Your rights' section of this policy.
• Compliance with a mandatory legal obligation, including, for example, accounting and tax requirements, which are subject to strict internal policies, procedures, and your right to restrict usage of your personal information, which control the scope of legal assistance to be provided. We are also required to also process your personal information according to legislation.
• The consent you provide where Vodacom does not rely on another legal basis. Consent may be withdrawn at any time. When you give your consent, you will be given details on how to change your mind or visit the 'Your rights' section of this privacy policy for more information.

We will collect your personal information when you, for example:

• Buy or use any of our products and services
• Use our network or other Vodacom products and services
• Register for a specific product or service
• Subscribe to newsletters, alerts, or other services from us
• Contact us through various channels, or ask for information about a product or service
• Take part in a competition, prize draw, or survey
• Visit or browse our website or other Vodacom Group websites
• Have permitted other companies to share information about you
• Where your information is publicly available
• Are the customer of a business that we acquire
• Visit our business premises
• When using the M-Pesa APP, we collect contacts you mark as favourites in order to provide you with an enhanced experience while sending money to your contacts

We are required to take all reasonably practicable steps to ensure your personal information is complete, accurate, not misleading, and updated regularly. To ensure this, we will always endeavour to obtain personal information from you directly. Where we are unable to do so, we will make use of verifiable independent third-party data sources who have the necessary authority to provide us with such information. We also collect information from certain organisations, where appropriate and to the extent, that we have legal grounds to do so. These include fraud-prevention agencies, business directories, credit check reference/vetting agencies, billing calculating agencies, and connected network providers. We may also collect information about you on CCTV when you visit our premises or on other security cameras as part of our security and crime prevention measures.Understanding what you want (the use of cookies)We use cookies (small text files stored in your browser) and other techniques such as web beacons (small, clear picture files used to follow your movements on our website). This, in turn, helps us make our Website relevant to your interests and needs. They also help us find information once you have logged in or help us link your browsing information to you and your personal information, for example, when you choose to register for a service. We may use a persistent cookie (a cookie that stays linked to your browser) to record your details so we can recognise you if you visit our Website again. Cookies by themselves cannot be used to discover your identity. Cookies do not damage your computer. You can set your browser to notify you when you receive a cookie. This enables you to decide if you want to accept it or not. If you choose not to accept cookies from our Website this may limit its functionalities or performance. For more details on how we use cookies and your rights in respect thereof, please refer to the "Our Cookies Policy" section which can be accessed here.`

The types of information we may process are, where applicable:

• Your name, address, phone and/or mobile number, date of birth, gender, information about your property or household, and email address. Where you have provided us with the personal information of a third party (for example your spouse or family member), you guarantee that such third- party has given you consent to provide us with their personal information. Where you provide us with the personal information of a person under the age of 18 years (a minor), you confirm that you have the necessary legal authority or legal competency, to provide their personal information to us.
• Your credit or debit card information, information about your bank account, and other banking information. For example, you'll have to give us this information when you open an account with us. We'll collect the personal information necessary to process a payment whenever you make a purchase.
• Your traffic data. This is data we see as part of providing you with connectivity, like the numbers you call, the time and duration of the call or how you are using data.
• Your location data. This can be precise where it uses Global Positioning System (GPS) data or by identifying nearby mobile phone masts and Wi-Fi hotspots and you enable location-based services or features. It can also be less precise where, for example, a location is derived from your IP address or data such as a postcode or name of a town or city.
• Your correspondence with us, such as a note or recording of a call you make to one of our contact centres.
• Your account information, such as dates of payment owed or received, subscriptions you use, account numbers, or other information related to your account or included in My Vodacom.
• Credential information - we'll collect passwords, hints, and similar security information used for authentication and access to accounts and services.
• Your preferences for particular products, services, and lifestyle activities when you tell us what they are, or we assume what they are, based on how you use the products and services.
• See the 'Cookies' section for details on what we collect using cookies, web beacons, and other technologies

• Photographs and images when attending any of our events or functions or accessing premises with surveillance cameras.
• Information we obtain from other sources, such as credit agencies, fraud prevention agencies, and other data providers. This includes demographic data and interest-based data.

We'll also get information about how you use our products and services, such as:

• The level of service that you receive - for example, network or service faults and other events that may affect our network services or other services.
• Details of your use of the specific services or products, for example, every time you use your mobile phone, a record is kept. This includes the number you called or sent a text or picture message, the duration, date, and time of that call, text or picture message and your approximate location at the time that the communication takes place (based on the location of the nearest cell tower that you sent that call from). The same is also recorded every time you receive an incoming call or message. We don't, however, keep a record of the content of your calls or messages.
• Vodacom may send you personalised marketing or show you personalised advertising if you have given permission for cookies and similar technologies to collect information such as categories of websites you have browsed on your mobile device or pc, for example, sports, music, or news. You can opt-out of advertising on websites you browse through cookies management. In the case of marketing, see 'To opt-out of marketing messages' in the 'Your rights' section of this privacy policy.

We will use, process, and analyse your personal information for the following purposes:
To provide you with your services
Processing your order and providing you with your products and services

• To process the products and services you've bought from us, install equipment at your property or deliver equipment to you, and keep you updated with the progress of your order.

Billing and customer care

• To bill you for using our products and services, or to take the appropriate amount of credit from you.
• Contact you if the billing information you provided us with is about to expire or we're not able to take payment.
• To respond to any questions or concerns you may have about our network, products, or services.

Service messages
We will contact you with customer service messages to keep you updated with current information about the products and services you've taken. For example, changes to our terms and conditions or service interruptions.
Providing roaming services

• To improve your roaming experiences, to ensure that we're meeting our commitments around fair use, to detect and resolve fraudulent use of our networks (and our partners' roaming networks), and to solve technical issues if you are experiencing any.
• To understand how Vodacom is performing in providing roaming services, whether roaming services and related products are working as intended, or whether improvements are needed to make roaming better. Vodacom uses personal information such as your name, email address, password, mobile phone number, and call records to do this. Vodacom creates aggregated and statistical management reports from this information that do not identify you individually. Vodacom may also take this personal information and de-identify it so that a more in-depth analysis of our roaming services can be undertaken. This helps Vodacom to develop its roaming services for customers without individually identifying users.

To improve our service
Improving and innovating our products and services

• We collect anonymous, de-identified, or aggregated information to improve the service we offer to everyone. None of these analytics can identify you individually or link back to you in any way.
• We conduct surveys to understand various aspects of our interaction with you, the use of our services and products, and the network.

Managing our networks and understanding network usage

• To protect our networks and manage the volumes of calls, texts, and other uses of our networks. For example, we identify peak periods of use so we can try and ensure the networks can handle the volume at those times.
• To understand how you use our networks, products, and services. That way we can seek to review and improve these, and develop more interesting and relevant products and services, as well as personalising our products and services.

Marketing and tailoring our service to you
Marketing

• As our customer, we will contact you to keep you informed about new and existing products and services, competitions, prize draws, and other promotions and we may use your personal information to run those competitions, prize draw, events, and promotions, only to the extent that you have not, at any stage, objected to receiving such marketing communications. We may also, with your consent, send you newsletters or white papers and occasionally invite you to participate in market research. We tailor these messages based on the products and services you've bought from us in the past and we will only provide you with marketing content regarding our products and services that are similar to or related to the products and services previously provided to you.
• With your permission, we can use your calling and messaging activities, location information, and browsing information to further tailor our messages to you. To opt-in please dial the *276# on your Vodacom mobile and choose the applicable options. Alternatively, you can contact a member of our customer services team at 114.
• If you have given your permission, we will also contact you to let you know about the products and services of Vodacom Group companies including Vodacom Financial Services, products and services, and those of other companies which we think may interest you.
• There are various ways that we may do this - including by email, post, phone, text, picture message, or notifications through our apps.
• You can control your marketing permissions and the personal information we use to tailor these communications at any time. See 'To opt-out of marketing messages' within the 'Your rights' section of this privacy policy.

Advertising online

• To deliver advertising that is relevant to you, you'll also see targeted advertising online based on the use of cookies. This is known as interest-based advertising. It can be on websites belonging to the Vodacom Group, those of other organisations as well as other online media channels such as social media sites. We may also combine data collected via the cookies with other data we have collected. If you don't want any information processed through the use of cookies, check the 'Cookies' section in this Privacy Portal. It explains how to control and opt-out of cookies.
• Remember that opting out of interest-based advertising doesn't stop advertisements from being displayed - it's just that they won't be tailored to your interests.
• You will also see advertising on your social media, for example in your Facebook or Twitter feed. If you don't want to receive this advertising, go to the relevant platform's ad settings.

Research and analytics
We use a variety of analytics methods including what is commonly referred to as "Big data analytics". Big data analytics are mathematically driven analysis techniques on large and varied data sets (that is why it is "big" data) to uncover hidden patterns and unrevealed trends. Vodacom Analytics is an end-to-end insight platform that offers responses to questions from businesses and public entities by analysing Vodacom network data. It isn't about individuals - it's about overall patterns, rather than any one person. Vodacom Analytics doesn't identify you or give anyone information that would enable them to contact you.
At Vodacom, we take governance of big data analytics seriously. Our data scientists are required to adhere to a Code of Ethics. We have a strict use case process that requires that privacy and data protection law checks are carried out before any use case commences. We also have strict rules ensuring that personal information is protected at the appropriate stage in the process.
We use our analytics to, for example:

• Conduct market research and carry out research and statistical analysis, including monitoring how customers use our networks, products, and services;
• Frame our marketing campaigns and determine how we might personalise those;
• Provide reports to third parties (such reports don't contain information that may identify you as an individual). These can be to third parties such as content providers, research companies, and advertisers or as part of Vodacom analytics.

Credit checks, fraud prevention, and security
We will sometimes need to profile you and make an automated decision, for credit, fraud, and security purposes. When we conduct such profiling or automated decision-making activities, we will do so in accordance with the provisions of the relevant legislation or lawful requirement
Credit checks and ID

• We will carry out a credit check when you apply for a contract for any products or services with us.
• We will also use your personal information for identity verification purposes, access to your account, and general account management. We sometimes supplement the information we collect about you with information from other sources (for example, home affairs, the voters roll, and credit reference agencies) to assess the accuracy of the information that we hold.

Fraud prevention and security

• We will process your personal and traffic data to protect against and detect fraud, to protect and detect misuse or damage to our networks, and to recover debts or trace those who owe us money resulting from the use of our services.

Where applicable, we share information about you with:

• Companies in the Vodacom and Vodafone Group, are located across the globe, including but not limited to the European Economic Area (EEA), Egypt, India, and the US, for reporting purposes and where they are involved in providing products and services that you have signed up for
• Partners, suppliers, or agents involved in delivering the products and services you've ordered or used
• Companies who are engaged to perform services for, or on behalf of, Vodacom Group Limited, Vodafone Limited, or Vodafone Group which companies may be located outside of the borders of Lesotho
• Credit reference, fraud-prevention or business-scoring agencies, or other credit scoring agencies
• Debt collection agencies or other debt-recovery organisations
• Law enforcement agencies, government bodies, regulatory organisations, courts, or other public authorities if we have to, or are authorised to by law
• A third party or body where such disclosure is required to satisfy any applicable law, or other legal or regulatory requirements
• Emergency services (if you make an emergency call), including your approximate location
• Third parties for joint promotions with that third party. They'll be responsible for their own compliance with applicable privacy laws
• Other third parties when you are signing up to their service and it is used by them for authentication and fraud-prevention purposes
• Third parties that we advertise with, to serve you advertisements online (e.g. Facebook, Google). You can opt out of this by managing your account permissions. To do this see the 'Your Rights' section below.
• Third parties that we use to serve you marketing.

Fraud management and law enforcement

• We will release information if it's reasonable for the purpose of protecting us against fraud, defending our rights or property, or protecting the interests of our customers.
• We also may need to release your information to comply with our legal obligation to respond to the authorities' lawful demands. Your personal information shall only be provided when we in good faith believe we are obliged to do so in accordance with the law and pursuant to an exhaustive evaluation of all legal requirements.

Mergers and acquisitionsIf we become involved in a proposed or actual merger, acquisition, or any form of sale of assets, we may use and disclose your personal information to third parties in connection with the evaluation of the transaction. Any acquiring company would have access to your personal information.Third parties that we work withWhere you've purchased Vodacom products and services using a third party or partner organisation, we often need to exchange information with them as part of managing that relationship and your account - for example, to be able to identify your order and be able to pay them. If we have a contract with a service provider or contractor to provide us with services or provide a service on our behalf, and they may have access to your personal information, we do not authorise them to use or disclose your personal information except in connection with providing their services. We ensure that all our service providers and contractors align with our policies and requirements. We collect and combine the information to monitor your use of products and services, and that of our other customers, as well as to help us to improve the quality of our products and services.Third-party products that you buy through your Vodacom accountWhere you buy a third-party product or service through your Vodacom account (such as Charge to Bill service for mobile), the contract for it is with the party selling that product or service. Vodacom is only charging the amount directly to your bill as part of its arrangements with the seller (or with a third party authorised by the seller). As part of this, you're agreeing that Vodacom may pass certain personal information to such parties to complete your purchase. The seller's terms and conditions and privacy and cookies policies will apply to how it uses your personal information - please read them carefully.`

You may connect third-party devices to your SIM. These include mobile phone devices or connected devices such as smart speakers or smartwatches. When you connect your SIM to these devices those third parties may record your SIM details or your interaction with the network. The third-party device manufacturers will process your personal information in accordance with their privacy policies and we recommend that you read these before choosing to connect.`

We may also need to transfer your information to other Vodafone or Vodacom group companies or service providers in countries outside Lesotho, in which case we will fully comply with applicable data protection legislation. This may happen if our servers or suppliers and service providers are based outside Lesotho, or if our services are hosted in systems or servers in Vodacom or Vodafone Operating Companies outside Lesotho including the United Kingdom, European Economic Area (EEA) or India, and/or if you use our services and products while visiting countries outside Lesotho. Countries in the United Kingdom and EEA are considered to have adequate data protection laws which are similar to those of Lesotho, however, we will make sure that your information is protected and enter into appropriate agreements to achieve this. If you are visiting this Website from a country other than Lesotho the various communications will necessarily result in the transfer of information across international boundaries. Where we transfer your personal information outside of the borders of Lesotho, we will ensure that the third party recipient is subject to a law, binding corporate rules, or binding agreement which provides an adequate level of protection for your personal information that is substantially similar to the data protection laws applicable to Lesotho.`

We may not retain your personal information any longer than is necessary for achieving the purpose for which your personal information was collected or subsequently processed, unless:

• The retention of your personal information is required or authorised by law
• We reasonably require your personal information for a lawful purpose related to our function or activities
• The retention of your personal information is required by a contract that we enter into with you
• You or competent person consent to the retention of personal information relating to a child.

• Keeping your personal information secure
• We have specialised security teams who constantly review, improve, and ensure the implementation of appropriate, reasonable technical and organisational measures to protect your personal information from unauthorised access, accidental loss, disclosure, or destruction. We are required in terms of DPA to notify you and the Information Regulator if any of your personal information has been compromised.
• Communications over the internet (such as emails) aren't secure unless they've been encrypted. Your communications may go through some countries before being delivered, as this is the nature of the internet.
• We cannot accept responsibility for any unauthorised access or loss of personal information that is beyond our control.
• We'll never ask for your secure personal or account information by an unsolicited means of communication. You're responsible for keeping your personal and account information secure and not sharing it with others.
• Our website may provide links to third-party websites. We cannot be responsible for the security and content of such third-party websites. You are therefore required to make sure you read that company's privacy and cookies policies before using or putting your personal information on their site.
• The same applies to any third-party websites or content you connect to using our products and services.
• You may choose to disclose your information in certain ways such as social plug-ins (including those offered by Google, Facebook, Twitter, and Pinterest) or using third-party services that allow you to post reviews or other information publicly, and a third party could use that information.
• Social plug-ins and social applications are operated by the social network themselves and are subject to their terms of use and privacy and cookies policies. You should make sure you're familiar with these.
• UNAUTHORISED THIRD PARTY ACCESS TO YOUR INFORMATION
• Despite the security measures we have in place to protect your personal information, (firewalls, password access, and encryption methods) you acknowledge that it may be accessed by an unauthorised third party, e.g. as a result of illegal activity.

In the unlikely event of such access, we will notify you, where possible, via email, SMS, or using the address you have provided us with, within a reasonable time of us becoming aware of such occurrence.`

Below we set out details on how you can exercise your rights. If you have a question or cannot find the answer, please contact our Customer Services team at 114.
Right to access personal information
You have the right to request a record or description of the personal information that Vodacom holds about you. This includes the right to request Vodacom to confirm, free of charge, whether or not we hold any personal information about you; as well as information about the categories of third parties who have or have had, access to your personal information. To make this request as an individual or an authorised third party, visit our Subject Access Rights page of this Privacy Portal which gives details on how to do this. Alternatively, you can contact our Customer Services team at 114.
Right to correct personal information
You have the right to correct information held about you if it's not accurate, out-of-date, excessive, irrelevant, or misleading. If the information we hold about you is inaccurate or needs to be updated, you can log in to My Vodacom to update it or you can contact our Customer Service team at 114.
Right to object to the use of personal information
You have the right, in certain circumstances, to object to Vodacom processing your personal information. For Vodacom to provide you with products and services, Vodacom is required to process your personal information and as such the provision of your personal information is mandatory and you may not object to the same in order to continue using our products or services. For more information or to exercise this right, please contact our Customer Services team at 114. If this relates to an automated decision performed on you (this means with no human involvement), please let us know and we will review your request.
To opt-out of marketing messages
If you no longer want to receive marketing messages from Vodacom, you can choose to opt-out at any time. If you've previously opted in to receive personalised content based on how and where you use our network, you can also opt-out at any time.
The easiest way to opt-out is by using our marketing preferences page, found under your My Vodacom account settings.
There are also various other ways to opt-out:

• Contact our customer services team at 114.
• Click the link at the end of a marketing email, text, or picture message to unsubscribe from that channel
• Tell the customer care agent if you receive a marketing call
• Disable push notification messages, including marketing messages, at any time in our apps by changing the notification settings on your device or by uninstalling the app
• Contact our customer care team for guidance
• If you're opted out of marketing, you may still receive service-related messages.

Please note: You may still receive marketing messages for up to an hour after opting out while we update our records.
You may have received marketing from Vodacom even if you're not a customer or have never had contact with us. This is a result of third-party marketing lists which Vodacom may acquire from time to time, stating that you have given permission to be contacted by other organisations. If you've registered with us to opt-out of marketing from Vodacom, you shouldn't receive such communications. If you still do, we ask that you let us know immediately by contacting our customer care team on 114. This will only stop marketing from us and not stop the third parties from sharing your personal information unless you contact them directly.
How to lodge a complaint
If you want to contact us about any of your rights or should you believe that Vodacom has used your personal information contrary to applicable law, you undertake to first attempt to resolve any concerns with Vodacom directly. Kindly contact our customer care team on 114. We will do our best to help.
Right to restrict the use of your personal information
If you feel that the personal information we hold on you is inaccurate, or you believe we shouldn't be processing your personal information, please contact our Customer Services team on 114 to discuss your rights. In certain circumstances, for example where you contest the accuracy of your information, or where Vodacom no longer requires your information for achieving its purpose but must maintain it for purposes of proof, you have the right to ask us to restrict processing.
Right to deletion
Vodacom strives to only process and retains your personal information for as long as we need to. In certain circumstances, for example, where you indicate that your personal information is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully, you have the right to request that we erase your personal information that we hold. If you feel that we are retaining your personal information longer than we need, it is worth first checking that your contract with Vodacom has been terminated, which you can do with Customer Services on 114. If your contract with Vodacom has been terminated, we may still have lawful grounds to process your personal information.`

We are continually improving our methods of communication and adding new functionality and features to this Website and to our existing products and services. Because of these ongoing changes, changes in the law and the changing nature of technology, our data protection practices will change from time to time. If and when our data protection practices change, we will update this privacy policy to describe our new practices. If we do, we will notify you the next time you visit this site or interact with us through any of our other communication channels.
We encourage you to check this page regularly.
Please see all the history of changes in the section below:

History of changes	Changes	Date of update
Privacy statement	Upgrading to the Group standards	21/06/22