Privacy Policy

1) Data Controller & Contact

Data Controller: Sleep Easy (Pty) Ltd, UIN: BW00000420813. Registered address: The Hub, iTowers, CBD Plot 54368, Gaborone, Botswana. Email: sales@innospace.co.bw. Phone: +267 398 1902.

2) Scope

This policy covers data collected online (our website/app) and offline (front desk interactions, events, paper forms) relating to enquiries, bookings, memberships, long-term contracts, payments and support.

3) Information We Collect

• Identity & contact: name, date of birth, email, phone, company name, role, signatures.
• Government & proofs (where required): ID/passport details or image for KYC/verification. ID documents are stored securely with restricted access and retained only as long as needed for verification, our legal obligations, and the duration of your account; you may request deletion (see Your Rights).
• Booking & membership data: dates, times, offices/rooms, plan type, history and status.
• Payments: limited card metadata, tokens, billing address; card numbers are handled by our PCI-compliant payment processor and are not stored in our systems.
• Device & usage: log data, pages viewed, approximate location, cookies or similar technologies for essential operation, analytics and security.
• Communications: support requests, emails, forms, survey responses.

4) Why We Use Your Data (Lawful Bases)

• Contract: to process bookings, memberships, long-term requests and payments; to provide access and support.
• Legitimate interests: to secure our premises/platform, prevent fraud/abuse, improve services, and send essential service notices.
• Consent: marketing communications; storing payment methods for future charges (you can withdraw consent at any time).
• Legal obligations: tax, accounting, and regulatory requirements.

5) Sharing, Sub-processors & International Transfers

We do not sell personal data. We share data only with the trusted service providers that help us run InnoSpace, namely:

• Supabase — database, authentication and secure file storage.
• DPO Pay — payment processing (card data is handled by DPO; we do not store card numbers).
• Microsoft Azure (Azure AI Document Intelligence) — automated reading and verification of identity documents (see below).
• Our email/SMTP provider — transactional and (where you opt in) marketing email.
• Groq — the website chat assistant (see below).

Some of these providers process data on servers outside Botswana. Where data is transferred internationally, we rely on appropriate safeguards (contractual clauses and provider security certifications).

Identity verification: when you register and upload an identity document (passport or Omang), the document image is sent to Microsoft Azure’s Document Intelligence service to extract and verify the details (for KYC, age verification and fraud prevention). This is an international transfer of sensitive data, carried out under the safeguards above. The image is stored privately with restricted access and retained only as described in Retention below.

AI chat assistant: our website chat assistant is powered by Groq. When you use the chat, the questions you type are sent to that provider to generate a reply, and may be processed on servers outside Botswana under appropriate safeguards. We do not send your account, payment or identity-document data to the chat provider. Please do not enter personal, financial or sensitive information into the chat — it is intended for general questions about our spaces, pricing and policies.

6) Retention

We keep data only as long as necessary for the purposes above:

• Identity documents: retained for the life of your account and deleted within 90 days of account closure, unless we are required to keep them longer to meet a legal obligation.
• Booking, membership and financial records: retained for the statutory period required by Botswana tax and accounting law (currently up to 7 years).
• Account & contact data: retained while your account is active and for a reasonable period afterwards.
• Access logs & operational telemetry: retained for a short period for security and troubleshooting.

When data is no longer needed, we delete or anonymise it.

7) Security

We use administrative, technical and physical measures to protect data (least-privilege access, encryption in transit, hardened infrastructure, monitoring). No method is 100% secure; we continuously improve our controls.

Data breach notification: in the event of a personal-data breach that is likely to result in a risk to your rights, we will notify the Information and Data Protection Commission and affected individuals without undue delay, as required by the Botswana Data Protection Act, 2024.

8) Cookies & Similar Tech

We use a small number of cookies and similar technologies. When you first visit, our cookie banner lets you accept or reject non-essential cookies and change your preferences at any time.

Essential cookies are required for the site to function; declining them may impact core functionality. Analytics cookies are only used with your consent.

9) Your Rights

Subject to law, you may request access, correction, deletion, restriction or objection to processing, and portability where applicable. You can withdraw consent (e.g., marketing or stored card) at any time. To exercise rights, contact us at sales@innospace.co.bw. You may also lodge a complaint with the Information and Data Protection Commission, the supervisory authority under the Botswana Data Protection Act, 2024.

10) Children

Our services are intended for business/working adults. We do not knowingly collect data from children.

11) Changes to this Policy

We may update this policy from time to time. We’ll post changes here and adjust the “Last updated” date. Significant changes may be notified through the app/site.