Last updated: 25 September 2026
In short: we collect the details you give us when you get in touch so we can reply and, if you go ahead, make your piece. We don't sell your information. We only use analytics cookies if you agree to them. You can ask to see, correct or delete your information at any time by contacting our Data Protection Officer, Lebogang Gaetsaloe.
- Who we are
- Our Data Protection Officer
- What we collect
- Why we use it and our legal basis
- Who we share it with
- Transfers outside Botswana
- How long we keep it
- How we protect it
- Your rights
- Cookies and analytics
- Children
- Complaints
- Changes to this policy
1. Who we are
Origin Africa Diamonds ("Origin Africa", "we", "us") is a diamond sourcing and bespoke jewellery business based in Gaborone, Botswana. We are the data controller for the personal information described in this policy, which means we decide how and why it is used.
Contact: enquires@originofafrica.com · +27 78 508 3483 · Gaborone, Botswana.
This policy is written to meet the requirements of the Data Protection Act, 2024 (Act No. 18 of 2024) of Botswana, which came into force on 14 January 2025.
2. Our Data Protection Officer
We have appointed a Data Protection Officer (DPO) who is responsible for how we handle personal information and is your point of contact for any question or request about it.
Data Protection Officer: Lebogang Gaetsaloe
Email: enquires@originofafrica.com (please use the subject line "For the Data Protection Officer")
Post / in person: Origin Africa Diamonds, Gaborone, Botswana
You can contact the DPO directly about any matter covered by this policy.
3. What we collect
Information you give us
- Enquiries: when you use our enquiry form, we collect your name, email address, phone number (optional), what you are interested in, your message, the page you sent it from, and a record that you agreed to this policy.
- Conversations: messages and call details when you contact us by WhatsApp, phone or email.
- Commissions and purchases: if you go ahead, the details we need to complete your order, such as your preferences and design notes, ring size, delivery address, and records of payments.
- Identity checks: where the law requires us to verify who we are dealing with (for example, anti-money-laundering rules that apply to dealers in precious stones), copies of identity documents and related information.
Information collected automatically
- Technical data: our web host's servers record basic technical information such as your IP address, browser type and the pages requested, to keep the site running and secure.
- Analytics: only if you accept analytics cookies, Google Analytics records how you use the site (pages visited, approximate location, device type). See Cookies and analytics.
Your name, email address and a short message are needed for us to reply to an enquiry. Everything else on the form is optional. If you don't give us the details we need to complete an order or a legally required identity check, we won't be able to go ahead with that order.
We do not ask for sensitive personal information (for example, health information or religious beliefs), and we ask you not to send it to us.
4. Why we use it and our legal basis
We only use personal information where the Act gives us a lawful basis to do so:
| What we do | Legal basis |
|---|---|
| Reply to your enquiry and arrange a consultation | Steps you have asked us to take before entering into a contract, and your consent |
| Source your stone, design, make and deliver your piece, and provide aftercare | Performance of our contract with you |
| Verify identity and keep business, tax and transaction records | Compliance with a legal obligation |
| Understand how visitors use the website (Google Analytics) | Your consent, given through the cookie banner |
| Keep the website secure and block spam and abuse | Our legitimate interest in protecting our business and our visitors |
| Send you news about new stones or events | Only with your consent. You can object or withdraw at any time, and we will stop. |
Where we rely on your consent, you can withdraw it at any time, as easily as you gave it, by emailing the DPO or using the "Cookie settings" link at the bottom of every page. Withdrawing consent does not affect anything we did before you withdrew it.
We do not make decisions about you based solely on automated processing, and we do not use profiling.
5. Who we share it with
We never sell your personal information. We share it only where needed:
- Sylvera London, our design and manufacturing partner, when you commission a piece, so it can design and make it.
- Grading laboratories (GIA or IGI) when you request a grading report. We send them the stone, and only the minimum personal information they require.
- Secure logistics providers, such as Ferrari Group, when your piece or stone is delivered, so they can deliver it to you.
- Service providers who run our website and communications on our behalf: our web hosting company, our email provider, Google (analytics, only with your consent) and WhatsApp (Meta) if you choose to message us there.
- Professional advisers and authorities, such as our accountants, lawyers, regulators, law enforcement or tax authorities, where the law requires it or to establish or defend legal claims.
Our service providers may only use your information to provide their services to us.
6. Transfers outside Botswana
Some of the organisations above are based outside Botswana. For example, Sylvera London's workshops include Dubai, in the United Arab Emirates, and Google and Meta process data in the United States and elsewhere. Our website and email may also be hosted outside Botswana.
We transfer personal information outside Botswana only as the Data Protection Act, 2024 allows. That means one of the following applies:
- the country has been recognised as providing an adequate level of protection
- appropriate safeguards are in place, such as approved contract clauses
- the transfer is necessary to perform your contract, for example sending your design to our workshop
- you have given your explicit consent
You can ask the DPO for more information about the safeguards we use.
7. How long we keep it
- Enquiries that don't lead to an order: deleted automatically 24 months after we receive them.
- Client and order records: kept for as long as you are a client and afterwards for as long as the law requires us to keep business, tax and anti-money-laundering records.
- Analytics data: kept in Google Analytics for no longer than 14 months.
- Server logs: kept by our host for a short period for security, usually no more than a few weeks.
When we no longer need information, we delete it or make it anonymous.
8. How we protect it
We use appropriate technical and organisational measures to protect your information. These include encrypted (HTTPS) connections, access limited to the people who need it, password and login protection on our systems, and spam and abuse filtering on our forms.
If a personal data breach happens that is likely to put your rights at risk, we will notify the Information and Data Protection Commission within 72 hours where feasible. If the risk to you is high, we will also tell you without undue delay.
9. Your rights
Under the Data Protection Act, 2024 you have the right to:
- Access: ask for a copy of the personal information we hold about you. The first copy is free.
- Correction: have inaccurate or incomplete information corrected.
- Erasure: ask us to delete your information where there is no good reason for us to keep it.
- Restriction: ask us to limit how we use your information, for example while a correction is checked.
- Portability: receive information you gave us in a structured, commonly used format, or have it sent to another organisation, where the Act allows.
- Objection: object to us using your information on the basis of legitimate interests. You can always object to direct marketing, and we will stop.
- Withdraw consent at any time, where we rely on your consent.
- Not be subject to decisions based solely on automated processing. We don't make any.
- Complain to the Information and Data Protection Commission (see below).
How to use your rights: email the DPO at enquires@originofafrica.com. We may need to confirm your identity before acting on a request. We will respond without undue delay and within one month.
If a request is complex, the Act allows that period to be extended. If that happens, we will tell you within the first month and explain why. Requests are free unless they are clearly unfounded or excessive. If we can't do what you ask, we will explain why and remind you of your right to complain.
10. Cookies and analytics
Cookies are small files stored on your device. When you first visit, a banner asks which cookies you accept. You can change your choice at any time using the "Cookie settings" link at the bottom of every page.
| Type | What it does | Needs your consent? |
|---|---|---|
| Necessary | Remembers your cookie choices and keeps the site secure and working. These do not track you. | No |
| Analytics (Google Analytics) | Tells us which pages are visited and how, so we can improve the site. Google may process this data outside Botswana. | Yes |
We do not use advertising cookies. With your consent, Google Analytics also records a small number of events, such as a form being sent or a WhatsApp button being tapped.
11. Children
Our website and services are intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has sent us their details, please contact the DPO and we will delete them.
12. Complaints
If you have a concern about how we handle your information, please contact our DPO first so we can try to put it right.
You also have the right to complain to the regulator, the Information and Data Protection Commission of Botswana.
13. Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. If we make significant changes, we will make them clear on this page.