Your Legal Path to Great Results
Effective Date: 1st January 2025
Last Updated: 17 October 2026
Mhlanga Legal ("the Firm", "we", "us" or "our") is a legal practice established in the Republic of Botswana, providing professional legal, notarial, conveyancing, advisory and related services to individuals, businesses, institutions and other organisations.
We recognise that privacy, confidentiality and the protection of personal information are fundamental to the relationship of trust between an attorney and a client.
We are committed to respecting and protecting the privacy of individuals whose personal information we collect, access, use, store, disclose or otherwise process in the course of our professional activities.
This Privacy and Data Protection Notice ("Notice") explains how we process personal information, the purposes for which such information is processed, the legal grounds upon which processing is undertaken, the safeguards we apply and the rights available to individuals under applicable data protection laws.
Our processing activities are governed principally by the Data Protection Act, 2024 (Act No. 18 of 2024) of Botswana, together with applicable laws governing legal professional conduct, confidentiality, record keeping and regulatory compliance.
This Notice applies to clients, prospective clients, website visitors, service providers, professional associates, job applicants and other individuals who interact with the Firm.
For purposes of the Data Protection Act, 2024, Mhlanga Legal ordinarily acts as a Data Controller in relation to personal information collected and processed in connection with its legal practice and business operations.
Data Controller: Mhlanga Legal
Physical Address: Plot 9819 Nyerere Drive, Unit 5 Progress House, Partial, Gaborone, Botswana
Telephone: +267 74746881 / +267 316 3688
Where the Firm processes personal information on behalf of another data controller, the respective rights and obligations of the parties shall be determined by the applicable contractual arrangements and data protection legislation.
Depending on the nature of our engagement or interaction, we may collect and process the following categories of personal information:
Full names, identity or passport numbers, dates of birth, nationality, residential and postal addresses, telephone numbers, email addresses and other identifying information.
Information relating to legal disputes, contractual arrangements, property ownership, financial transactions, employment relationships, family matters, court proceedings, regulatory investigations and other matters relevant to the provision of legal services.
Banking details, payment records, invoices, transaction histories, asset and liability information and other financial information necessary for client administration, conveyancing, billing, legal representation or compliance.
Where necessary and legally permissible, we may process sensitive personal information, including health information, biometric information, information concerning criminal allegations or proceedings, and other protected categories of personal data.
Such information shall be processed only where an appropriate lawful basis and any additional statutory conditions are satisfied.
When individuals access our website or communicate electronically with the Firm, we may collect information such as IP addresses, browser types, device information, website usage information, contact-form submissions and correspondence records.
The extent of such collection depends on the technologies and services actually used by our website.
Clients and staff may access a secure online portal operated by the Firm. It holds matter information, documents, and payment and trust records, and is protected by secure sign-in and restricted access. Personal information in the portal is processed on the same basis, and with the same rights and safeguards, as described in this Notice.
We may obtain personal information:
Where information is obtained indirectly, we shall comply with applicable transparency requirements, subject to lawful exemptions and restrictions, including those relating to confidentiality and legal professional privilege.
Mhlanga Legal processes personal information for specified, explicit and legitimate purposes, including:
To provide legal advice, prepare legal documents, represent clients in court or other proceedings, conduct legal research, negotiate transactions and perform conveyancing, notarial and related professional services.
To conduct client identification, verification, conflict-of-interest assessments, due diligence and other procedures required by applicable professional and regulatory obligations, including anti-money laundering requirements.
To communicate with clients, manage legal instructions, schedule consultations, provide matter updates, respond to enquiries and maintain professional relationships.
To prepare invoices, receive and account for payments, maintain financial records, administer client funds and comply with accounting, tax and other applicable legal obligations.
To maintain website functionality, respond to online enquiries, monitor website performance, prevent misuse and maintain the security of our electronic systems.
To manage employees, recruitment processes, professional service providers, business operations and other legitimate administrative functions.
To communicate information about our legal services, legal developments, publications, events and professional activities where permitted by law.
Where consent is required for direct marketing, we shall obtain appropriate consent and provide a means of withdrawing it.
We shall not process personal information for purposes incompatible with those for which it was originally collected unless further processing is permitted by law.
We process personal information only where a lawful basis exists under applicable legislation.
Depending on the circumstances, processing may be necessary for:
Where processing is based on consent, individuals may withdraw that consent in accordance with the law. Withdrawal shall not affect the lawfulness of processing undertaken before the withdrawal.
The Firm does not rely on consent as the sole lawful basis for all processing undertaken in the course of legal representation.
As a legal practice, Mhlanga Legal recognises its professional duty to preserve the confidentiality of information entrusted to it by clients.
Information received in the course of legal representation is handled in accordance with applicable professional obligations, the law of legal professional privilege and relevant statutory requirements.
Access to confidential client information is restricted to authorised personnel and other persons who have a legitimate and lawful reason to access such information.
We shall not disclose confidential or privileged client information except where:
Nothing in this Notice shall be interpreted as waiving legal professional privilege or authorising disclosure contrary to the Firm's professional duties.
We do not sell personal information.
Where necessary and lawful, personal information may be disclosed to:
Any disclosure shall be limited to information reasonably necessary for the relevant purpose and shall be subject to appropriate legal, contractual, confidentiality and security safeguards.
Where third parties process personal information on our behalf, we shall take appropriate steps to ensure that their processing arrangements comply with applicable data protection requirements.
Mhlanga Legal may, where necessary, engage foreign correspondent attorneys, international legal advisers, technology providers or other professional service providers.
This may involve the transfer of personal information outside Botswana.
Any international transfer shall be undertaken in accordance with the Data Protection Act, 2024, and subject to applicable requirements governing cross-border transfers.
Where required, we shall implement appropriate safeguards, contractual protections, authorisations or other lawful transfer mechanisms to protect personal information.
The Firm shall not assume that the use of an international service provider automatically authorises the transfer of personal information outside Botswana.
Mhlanga Legal is committed to maintaining appropriate technical and organisational measures designed to protect personal information against unauthorised access, unlawful processing, accidental loss, destruction, alteration or disclosure.
Depending on the nature and sensitivity of the information, these measures may include:
While we take reasonable and appropriate steps to protect personal information, no electronic transmission or storage system can be guaranteed to be entirely free from security risks.
We retain personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, subject to applicable legal, professional, contractual and regulatory obligations.
Retention periods may depend on:
Upon expiry of the applicable retention period, personal information shall be securely deleted, destroyed, anonymised or otherwise disposed of in accordance with applicable law and the Firm's retention procedures.
Where retention is required by law or necessary for the establishment, exercise or defence of legal claims, an individual's request for deletion may be subject to lawful restrictions.
Subject to the requirements, conditions and exemptions contained in the Data Protection Act, 2024, individuals may exercise the following rights in relation to their personal information:
The right to receive information concerning the collection and processing of their personal data.
The right to request confirmation of whether their personal information is being processed and to obtain access to such information, subject to applicable legal limitations.
The right to request correction of inaccurate personal information and completion of incomplete information where appropriate.
The right to request deletion of personal information where the statutory requirements for erasure are satisfied.
The right to request restriction of processing in circumstances recognised by law.
The right to object to certain processing activities, including processing based on legitimate interests and processing for direct marketing, where applicable.
The right to receive personal information in an appropriate structured, commonly used and machine-readable format, and to request transmission to another controller where the statutory conditions are satisfied.
The right to applicable protections concerning decisions based solely on automated processing, including profiling, where such decisions produce legal or similarly significant effects.
Where processing is based on consent, the right to withdraw consent without affecting the lawfulness of prior processing.
Requests to exercise these rights may be directed to the Firm using the contact details provided in this Notice.
We may require reasonable verification of identity before responding to a request to prevent unauthorised disclosure.
Certain rights may be restricted where necessary to protect legal professional privilege, the rights of other persons, legal proceedings or other interests recognised by law.
Mhlanga Legal maintains procedures intended to identify, assess, contain and respond to actual or suspected personal data breaches.
Where a breach occurs, we shall assess its nature, scope, potential consequences and associated risks to affected individuals.
Where notification is required under applicable law, we shall notify the relevant regulatory authority and affected individuals within the prescribed requirements and timeframes.
We shall also take appropriate remedial steps to contain the breach, mitigate its consequences and reduce the likelihood of recurrence.
Our website may use cookies and similar technologies to support website functionality, improve user experience, analyse website performance and maintain security.
Cookies are small files that may be stored on a visitor's device when accessing a website.
Our website uses only the cookies and similar technologies necessary for it to work. We do not use advertising or visitor-tracking cookies.
Where cookies or comparable technologies are deployed, their use shall be governed by applicable data protection requirements.
Where legally required, visitors shall be provided with appropriate information and an opportunity to consent to non-essential processing or manage their preferences.
Visitors may also manage certain cookies through their browser settings.
Further information regarding the categories and purposes of cookies used by our website may be provided in a separate Cookie Notice.
Our website may contain links to websites, resources or services operated by third parties.
Mhlanga Legal does not control the privacy practices of independent third-party websites and is not responsible for their processing activities.
Visitors are encouraged to review the privacy notices of third-party websites before submitting personal information.
In the course of providing family law, estate planning, guardianship and other legal services, Mhlanga Legal may process personal information relating to children.
We recognise that children's personal information requires particular care and protection.
Such information shall be processed only where a lawful basis and any applicable additional requirements are satisfied, including requirements relating to parental responsibility, guardianship, consent and the protection of children's interests.
We shall implement appropriate safeguards having regard to the nature and sensitivity of the information and the circumstances of the legal engagement.
Individuals who communicate with Mhlanga Legal by email, website contact form or other electronic means acknowledge that electronic communications may involve inherent security risks.
We take reasonable measures to protect electronic correspondence and confidential information.
However, individuals are encouraged not to submit highly sensitive personal information through unsecured website forms or communication channels unless an appropriate secure method has been provided.
The submission of an enquiry through our website or by email does not, by itself, establish an attorney-client relationship.
An attorney-client relationship arises only upon the Firm's acceptance of professional instructions in accordance with applicable engagement procedures.
From time to time, Mhlanga Legal may publish legal updates, professional articles, event announcements and information about its services.
Personal information used for direct marketing shall be processed only where permitted by applicable law.
Where consent is required, it shall be obtained through an appropriate affirmative action.
Individuals may object to direct marketing or withdraw their consent, as applicable, by contacting the Firm or using any unsubscribe mechanism provided in the relevant communication.
We shall not treat the submission of a general legal enquiry as automatic consent to receive promotional communications.
Mhlanga Legal may use approved technological tools to support legal research, document preparation, administration and other professional activities.
Where such tools involve the processing of personal information, their use shall be subject to applicable confidentiality, security and data protection requirements.
Confidential or privileged client information shall not be disclosed to external technology providers without an appropriate lawful basis, necessary safeguards and compliance with professional obligations.
Where automated decision-making or profiling is undertaken, applicable statutory protections shall be observed.
Individuals who believe that their personal information has been processed unlawfully or contrary to this Notice may submit a complaint to Mhlanga Legal.
We encourage individuals to contact us in the first instance so that their concerns may be assessed and addressed appropriately.
Individuals also retain the right to lodge complaints with the Information and Data Protection Commission of Botswana, subject to applicable statutory procedures.
Nothing in this Notice limits any rights or remedies available under the Data Protection Act, 2024, or other applicable law.
Mhlanga Legal reserves the right to amend or update this Notice from time to time to reflect changes in legislation, regulatory requirements, professional obligations, technology or business operations.
Any revised Notice shall be published on our website with an updated revision date.
Where applicable law requires additional notification or consent in relation to material changes, we shall comply with those requirements.
For questions, concerns or requests relating to this Notice or the processing of personal information, please contact:
MHLANGA LEGAL
Attorney | Notary Public | Conveyancer
Address: Plot 9819 Nyerere Drive, Unit 5 Progress House, Partial, Gaborone, Botswana
Telephone: +267 74746881 / +267 316 3688
Privacy Contact: Thandiwe Phiri
Your Legal Path to Great Results
© 2026 Mhlanga Legal. All rights reserved.