Youth Impact is committed to protecting the privacy and personal data of everyone we engage with, including program participants, caregivers, partners, employees, and donors. This policy explains what personal data we collect, how we use it, and the rights of individuals under Botswana’s Data Protection Act, 2024, as well as relevant data protection and safeguarding laws in the countries where we operate, and international standards such as the EU General Data Protection Regulation (GDPR).
1. Data Controller and Contact Details
Youth Impact
Global headquarters:
Plot 6789, Seboko
Ext. 21, Broadhurst
Gaborone, Botswana
Youth Impact is headquartered in Botswana but implements programs across multiple countries. While Youth Impact remains the overall data controller, we work with trusted local partners to ensure compliance with national data protection and child safeguarding requirements wherever we operate.
Youth Impact has designated a Data Protection Officer (DPO) responsible for advising on compliance with the Data Protection Act, 2024, monitoring internal practices, coordinating data-protection training, and acting as the primary contact point for the Information and Data Protection Commission.
2. Scope of this Policy
This policy applies to all personal data collected and processed by Youth Impact in connection with our programs, research, monitoring and evaluation, websites, and communications with partners and donors. It applies across all countries where Youth Impact operates.
3. What Information We Collect
We may collect the following categories of personal data:
-
Identity information: name, gender, age
-
Contact information: telephone number
-
Program information: attendance, learning progress, assessment results, caregiver feedback
-
Digital information: cookies, IP address, device type, browsing activity on our website
-
Employee and HR information: This covers personal, employment, and contact information about an individual, including identification, job and payroll details, attendance and leave records, performance and training history, disciplinary matters, and information about family or dependents.
-
Financial and Partner Information: Youth Impact also collects and processes limited financial information, including banking details for employees, volunteers, and partners; payment records; donor transaction data; and tax identification numbers.
In some cases, we may also collect sensitive personal data, such as health information, criminal or background checks for safeguarding or trust-sensitive roles. These data are processed only when strictly necessary, with the consent of the individual or under another lawful condition permitted by the Data Protection Act 18 of 2024.
We use essential cookies to ensure our website functions properly. We also use analytics and embedded content (e.g., YouTube, Readymag) to understand how visitors use our site and improve your experience. These non-essential cookies require consent, and may be accepted or rejected when visiting our site.
The exact information we collect may vary by country, depending on program design, local requirements, and participant consent.
Because many Youth Impact program participants are children, we take extra care to collect, store, and use children’s data responsibly. In school-based programs, children typically provide assent—verbal or implied agreement—to participate, with school or ministry-level authorisation in place in accordance with national education and research regulations. Where required, Youth Impact also seeks parental or caregiver consent, and always acts in line with local child-safeguarding laws and ethical research standards. In certain Ministry-approved programs, participation may be authorised at the institutional level, with students providing verbal or implied assent, consistent with Botswana’s ethical research standards.
4. How We Use Personal Data
We process personal data only for legitimate purposes, including:
-
Delivering our programs and services effectively
-
Monitoring, evaluation, research, and reporting
-
Communicating with program participants, partners, and donors and government stakeholders
-
Complying with legal and regulatory obligations, including meeting child protection and data protection requirements in each country where we operate
Youth Impact processes all personal data in accordance with the data-protection principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, and confidentiality. We will not use personal data for purposes unrelated to our mission without consent.
5. Legal Basis for Processing
We rely on one or more of the following lawful grounds:
-
Consent or assent of the data subject (e.g. when joining a program)
-
Necessity for performance of a contract or partnership
-
Compliance with a legal obligation
-
Legitimate interest in carrying out our charitable mission, provided rights and freedoms are respected
In limited circumstances, we may process personal data to protect a data subject’s vital interests, to perform a task carried out in the public interest, or for the exercise of official authority. Where processing relies on consent, individuals may withdraw that consent at any time.
6. Data Sharing and Transfers
Youth Impact does not sell or trade personal information. We may share limited personal data with trusted partners, service providers, or government stakeholders when this is necessary to deliver our programs, conduct research, or meet donor and accountability requirements. Whenever we share data, we ensure that only the minimum information needed is provided, and that partners handle it securely and only for the agreed purposes.
Because Youth Impact works across multiple countries, data collected in one country may be securely transferred across borders for storage, analysis, or reporting. Where data is transferred internationally, we use appropriate safeguards such as secure servers, password protected files, data-sharing agreements, and anonymisation where possible.
Youth Impact transfers personal data across borders only where the recipient country, organization, or international body provides an adequate level of protection or where appropriate safeguards are in place. Where necessary, Youth Impact will obtain the data subject’s consent prior to transfer. In all cases, we comply with Botswana’s Data Protection Act, 2024, relevant local laws, and international good practice to ensure that personal data remains protected and is only used responsibly.
7. Data Retention
We keep personal data only as long as it is necessary for the purpose for which it was collected, or as required by law, donor agreements, or ethical research standards. After this period, data will be securely deleted, anonymised, or pseudonymised so that individuals can no longer be identified. Retention practices may vary depending on the type of program, the requirements of our research partners and funders, and the laws of the country where the data was collected.
For employee records, certain information such as background checks is retained only for as long as necessary for verification or compliance purposes. Other employment data is stored throughout the duration of employment and retained for a limited period after termination to meet audit, reference, or legal compliance requirements. Youth Impact is formalizing its record retention schedules to ensure that all personnel data is securely deleted once no longer required.
In line with Botswana’s financial regulations, Youth Impact retains financial records, including payroll, tax submissions, and financial statements, for a minimum of eight years, and other financial records for at least five years, unless local laws require a longer period.
Youth Impact seeks to keep clear internal records of the types of personal data it collects, where and how such data are stored, and how long they are retained, consistent with the principles of the Botswana Data Protection Act, 2024.
8. Data Security
We take appropriate technical and organizational measures to protect personal data, including restricted access, secure storage, password protection and regular staff training on data protection. These measures include the use of encryption, two-factor authentication, and secure passwords for systems that handle financial data and other sensitive information.
Access to personal data is strictly limited to authorized personnel who require it to perform their duties. Where disclosure of employee information is necessary, Youth Impact does so only with the individual’s knowledge and, where appropriate, consent.
We also require our local partners in each country to apply equivalent safeguards, ensuring that personal data is handled with the same high standards of security and care, regardless of where it is collected or processed. In the unlikely event of a data breach, we will act promptly to contain the incident, assess risks, and notify affected individuals and regulators as required by law.
In the unlikely event of a personal data breach, Youth Impact will act promptly to contain the incident, assess risks, and notify the Information and Data Protection Commission within 72 hours where feasible, as well as any affected individuals if there is a high risk to their rights or freedoms.
9. Rights of Data Subjects
Under the Botswana Data Protection Act, you have the right to:
-
Access your personal data held by Youth Impact
-
Request correction of inaccurate or incomplete data
-
Request deletion of your data where appropriate
-
Object to restrict processing in certain cases
-
Request data portability where technically feasible
-
Withdraw consent at any time where processing is based on consent
You may also have additional rights under the laws of the country where you participate in a program, and Youth Impact makes every effort to respect these rights consistently across all countries where we work. To exercise these rights, please contact us at info@youth-impact.org.
10. Updates to This Policy
Youth Impact reviews this policy regularly to ensure it remains accurate and compliant with applicable laws and best practice. The latest version will always be available on our website.