Privacy Policy
Version 1.0, effective 12 October 2026
How Olympus Pay collects, uses, shares, protects and retains personal data in Arubis, and the rights you have under the Data Protection Act, 2024.
1. Purpose and scope
This Privacy Policy explains how Olympus Pay Proprietary Limited ("Olympus Pay", "we", "us") handles personal data in connection with Arubis, its assistant Athena, our websites and the communications we send about them (together, the "Service").
We wrote it to meet the requirements of the Data Protection Act, 2024 of Botswana (the "Act") and the guidance of the Information and Data Protection Commission (the "Commission"), and to reflect the expectations of the international frameworks our customers often ask about, including the European Union General Data Protection Regulation where it applies to a particular customer. Where this Policy uses a term defined in the Act, such as "data controller", "data processor", "data subject" or "processing", it carries the meaning given in the Act.
Two different relationships exist, and it matters which one applies:
- For information about the people who sign up for and use Arubis (for example your name, email address and login activity), Olympus Pay is the data controller. This Policy describes that processing in full.
- For personal data contained in your books (for example the names and contact details of your customers, suppliers and employees, and the content of invoices and receipts), your business is the data controller and Olympus Pay is your data processor. We process that data only on your documented instructions, as set out in the Data Processing Addendum. If you are a customer or supplier of an Arubis user and want to exercise your rights, you should contact that business first; we will help them respond.
This Policy does not cover Olympus Banking or Olympus Merchant Services, which have their own privacy notices, although some data flows between those services and Arubis when you choose to link them. Those flows are described in section 6.
2. Who we are and how to contact us
The data controller for the processing described in this Policy is Olympus Pay Proprietary Limited, a company incorporated in Botswana.
You can contact us about privacy, including to exercise any of your rights, at privacy@olympuspay.co. Where the Act requires us to designate a data protection officer, that officer can be reached at the same address.
If you are not satisfied with our response, you may complain to the Information and Data Protection Commission of Botswana. We would appreciate the chance to resolve your concern first, but you do not need to contact us before contacting the Commission.
3. The personal data we collect
We collect personal data in three ways: you give it to us, it is generated when you use the Service, and, occasionally, we receive it from others.
Information you give us:
- Account details: your name, email address, phone number, password (stored only as a salted hash managed by our authentication provider), job title and the organisations you belong to.
- Business details: the legal and trading name of your business, registration number, VAT and tax identification numbers, physical and postal address, financial year end, entity type and, where provided, the names and Botswana Institute of Chartered Accountants membership numbers of directors and accountants who approve financial statements.
- Communications: what you tell us when you contact support, respond to surveys, or join a waiting list, including the Olympus Banking waiting list.
- Payment information for paid plans, which our payment provider collects and processes directly; we receive only a reference, the card brand and the last four digits.
Information generated by your use of the Service:
- Usage and log data: the pages and features used, actions taken, the date and time of each action, the Organisation it relates to, error reports, and an audit trail of changes to the books. The audit trail is part of the Service and is how you can show who did what.
- Device and connection data: IP address, browser type and version, operating system, and approximate location derived from IP address, used to secure your account and diagnose problems.
- Assistant interactions: the questions you ask Athena, the files you give it to read, and the answers and proposals it returns, together with the tools it used to produce them.
Information from others:
- If a colleague invites you to an Organisation, we receive your email address and the role they have given you.
- If you link Olympus Banking, Olympus Merchant Services or Olympus Invoicing, we receive the account and transaction information you authorise, as described in section 6.
We do not intentionally collect special personal data, such as information about health, religion or biometric data, through the Service, and we ask that you do not enter it into free text fields. If such data appears in a document that you upload, such as a medical receipt, we process it only as your processor, for the purpose of recording the transaction.
4. Why we use personal data and our lawful basis
The Act permits processing only where there is a lawful basis for it. We rely on the following bases, each for the purposes listed with it.
Performance of a contract with you, or steps you ask us to take before entering into one:
- creating and administering accounts and Organisations, and authenticating users;
- providing the features of the Service, including posting entries, generating reports, sending invoices and quotes that you ask us to send, and reading documents that you give to Athena;
- billing and collecting fees for paid plans;
- providing support and responding to your requests.
Compliance with a legal obligation:
- keeping accounting and transactional records for the periods required by Botswana tax and company law;
- responding to lawful requests from the Botswana Unified Revenue Service, the Financial Intelligence Agency, the courts and other competent authorities;
- notifying the Commission and affected people of personal data breaches where the Act requires it.
Our legitimate interests, where those interests are not overridden by your rights:
- keeping the Service and our users secure, including detecting and preventing fraud, abuse and unauthorised access;
- understanding how the Service is used so we can fix problems and improve it, using aggregated or de-identified information wherever possible;
- sending you important service messages, such as changes to these terms or security notices;
- establishing, exercising or defending legal claims.
Consent, which you may withdraw at any time without affecting processing that took place before withdrawal:
- sending marketing emails about new Olympus products, where you have opted in;
- optional features that we tell you rely on consent when you turn them on.
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms and concluded that the processing is necessary and proportionate. You can ask us for more information about that assessment.
5. Automated processing and Athena
Arubis automates bookkeeping work. Examples include learning that bank lines from a particular payee are usually coded to a particular account, matching incoming payments to invoices by reference and amount, holding a bill that appears to duplicate another, and reading a receipt so that it can be booked as a bill.
These automated steps act on business records, not on decisions about individuals. They do not produce decisions that have legal effects on, or similarly significantly affect, any natural person within the meaning of the Act. Every automated action is logged, attributed to the automation that performed it, and, where the ledger allows, can be undone by a user. People can always review and override what the Service has done.
Athena uses large language models provided by a third-party inference provider (currently NVIDIA, through its API service) to read documents and answer questions. When you ask Athena a question, or give it a file to read, the relevant text, images of the document and the data Athena retrieves from your books to answer are sent to the provider for processing. We send only what is needed to answer. Under our arrangements with the provider, that content is used to generate the response and is not used by us to train general-purpose models. The Athena and Automated Processing Terms describe these safeguards in more detail.
6. Connected Olympus services
Arubis is part of the Olympus Pay group of services, and you can choose to connect it to them.
- Olympus Banking: if you link an Olympus Bank account, Arubis receives the account's transactions, balances and references so that they can be reconciled in your books. Olympus Banking is invite only; if you join the waiting list from within Arubis, we record your name, email address, business name, the account type that interests you and the date you joined, so that we can invite you as access opens.
- Olympus Merchant Services and Olympus Invoicing: if you link them, invoices you issue in Arubis can be published so that customers can pay online, and payments and settlements flow back into your books.
Each linked service is operated by Olympus Pay under its own terms and privacy notice. Linking is optional, can be undone, and is limited to the people who hold the relevant permissions in both services.
7. Who we share personal data with
We share personal data only as described here, and never sell it.
Service providers (sub-processors) who process data on our behalf, under written contracts that require them to protect it and use it only to provide their services to us:
- Supabase, Inc.: database, authentication and file storage;
- Vercel, Inc.: application hosting and content delivery;
- NVIDIA Corporation: artificial intelligence inference for Athena;
- Resend, Inc.: delivery of transactional email, such as invoices, quotes, invitations and sign-in links.
We keep this list current on our legal pages and in the Data Processing Addendum, and will give customers notice before adding a sub-processor that will process Customer Data.
Other people you direct us to share with: for example, when you send an invoice or quote, the recipient receives it; when you invite an accountant, they gain access to the Organisation you invited them to.
Authorities and others where the law requires or permits it: we may disclose personal data to comply with a law, regulation, court order or lawful request by a public authority, including tax and financial intelligence authorities, or where necessary to protect the rights, property or safety of our users, the public or ourselves. Where permitted, we will tell the affected customer before disclosing their data.
Corporate transactions: if all or part of our business is sold, merged or reorganised, personal data may be transferred to the successor, which will be bound by this Policy until it gives notice of any change.
8. Transfers outside Botswana
Some of our sub-processors operate infrastructure outside Botswana, and personal data may therefore be stored or processed in other countries. The Act restricts transfers of personal data to a third country unless that country ensures an adequate level of protection, or appropriate safeguards are in place, or another condition in the Act applies.
Where we transfer personal data outside Botswana, we do so only where: the recipient country has been recognised as providing adequate protection; or we have put in place contractual clauses that require the recipient to protect the data to a standard equivalent to the Act, together with supplementary technical measures such as encryption in transit and at rest; or another lawful ground under the Act applies. You can ask us for information about the safeguards that apply to a particular transfer.
We choose providers that maintain recognised security certifications and audit reports, and we review them periodically.
9. How long we keep personal data
We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting and reporting requirements.
- Account data is kept while your account is active and for up to ninety days after it is closed, so that it can be restored if closure was a mistake, and then deleted, except as described below.
- Accounting records in your books are retained by default for seven years from the end of the financial year to which they relate, reflecting record keeping obligations under Botswana company and tax law. During that period they cannot be deleted through the Service; after it, they become eligible for deletion.
- Audit trail entries are kept for as long as the records they describe.
- Support communications are kept for three years after the matter is closed.
- Server and security logs are kept for up to twelve months, unless needed to investigate an incident.
- Athena conversation history is kept while the conversation exists and deleted when you delete it or close the account.
- Backups are overwritten in the ordinary course within ninety days.
When retention ends we delete personal data or anonymise it so that it can no longer be associated with an individual.
10. How we protect personal data
We apply technical and organisational measures appropriate to the risk, which we review regularly against recognised frameworks including the Trust Services Criteria used for SOC 2 reporting. They include:
- encryption of all traffic using current versions of TLS, and encryption at rest provided by our infrastructure providers;
- strict separation between Organisations, enforced in the database itself through row-level security policies, so that a user can read only the books of Organisations they belong to;
- changes to the books made only through controlled database functions that check each user's permission before acting, with immutable posted entries and a complete audit trail;
- least-privilege access for our own staff, with administrative actions logged and reviewed;
- secure software development practices, including automated testing of security controls, dependency monitoring and review of changes before release;
- rate limiting and monitoring to detect abuse;
- documented incident response and breach notification procedures.
No method of transmission or storage is completely secure. If we become aware of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Commission within the period the Act requires, and affected people where the Act requires, and will tell affected customers without undue delay.
11. Your rights
Subject to the conditions and exceptions in the Act, you have the right to:
- be informed about how your personal data is processed, which this Policy is designed to do;
- access the personal data we hold about you and receive a copy of it;
- have inaccurate personal data corrected and incomplete data completed;
- have personal data erased where there is no longer a lawful reason to keep it;
- restrict processing in certain circumstances, for example while the accuracy of data is being checked;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- receive personal data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible;
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you;
- withdraw consent where processing is based on consent;
- lodge a complaint with the Information and Data Protection Commission.
To exercise a right, contact us at privacy@olympuspay.co. We will verify your identity before acting, so that we do not disclose your data to someone else, and will respond within the period the Act allows. We do not charge a fee unless a request is manifestly unfounded or excessive, in which case the Act permits a reasonable fee or a refusal, with reasons.
Some rights are limited by our legal obligations. For example, we cannot erase accounting records that a business is required to keep for seven years, but we can restrict their use to what the law requires.
12. Cookies and similar technologies
Arubis uses a small number of cookies and similar technologies that are strictly necessary for it to work:
- authentication cookies that keep you signed in and are shared across olympuspay.co services so that you can move between Olympus products without signing in again;
- a cookie that remembers which Organisation you are working in;
- local storage that remembers interface preferences, such as whether the sidebar is collapsed.
These are essential to provide the Service you have asked for, and so do not require consent. We do not use advertising cookies or third-party tracking in the application. If we introduce optional analytics in future, we will ask for your consent first and let you change your choice at any time.
You can block or delete cookies in your browser settings, but if you block strictly necessary cookies you will not be able to sign in.
13. Data protection by design and by default
The Act requires controllers to build data protection into the way systems are designed and to process, by default, only the personal data that is necessary for each purpose. We take that obligation seriously because an accounting system concentrates sensitive information about a business and everyone it deals with.
In practice this means that: new features are reviewed for their privacy impact before release, and a data protection impact assessment is carried out where processing is likely to result in a high risk to individuals; Athena receives only the parts of your books needed to answer a particular question, rather than a copy of everything; documents customers open from an invoice or quote link reveal only what is printed on that document and nothing else about your business; public links use long random tokens that cannot be guessed; and personal data is not used for a new purpose that is incompatible with the purpose for which it was collected without a fresh lawful basis and, where required, notice to you.
We also limit who inside Olympus Pay can see Customer Data. Engineers do not browse customers' books. Where access is needed to investigate a problem you have reported, it is granted for that purpose, recorded, and removed when the work is complete.
14. Accuracy of personal data
We take reasonable steps to keep the personal data we control accurate and up to date. You can change your name, email address and other profile details in the Service at any time, and the owner of an Organisation can change the business details that appear on documents.
Because posted accounting entries cannot be edited, an error in a posted document, such as a misspelt customer name on an issued invoice, is corrected by issuing a credit note or reversal and a corrected document, rather than by changing history. This preserves the integrity of the books that tax law requires while still allowing the record to be put right. Contact records, unlike posted documents, can be corrected directly.
15. Direct marketing
We send service messages that you need in order to use Arubis, such as sign-in links, security alerts, invoices you ask us to deliver and notices of changes to our terms. These are not marketing and you cannot opt out of them while you have an account.
We send marketing messages about new Olympus products, features and events only where you have agreed to receive them, or where the law otherwise permits it for existing customers in relation to similar services and you have been given a simple way to refuse. Every marketing email contains a link to unsubscribe, and you can also opt out by writing to privacy@olympuspay.co. We honour opt-outs promptly and keep a record of them so that you are not contacted again.
We do not pass your details to other companies for their own marketing.
16. Your obligations as a controller of the data in your books
When you record information about your customers, suppliers, employees and other individuals in Arubis, your business decides why and how that personal data is processed and is therefore its controller under the Act. The Service gives you tools to meet your obligations, but it cannot meet them for you.
In particular, you are responsible for: having a lawful basis for recording and using the personal data in your books, which for most bookkeeping will be the performance of a contract or compliance with tax law; telling the individuals concerned how you use their data, for example in your own privacy notice or terms of trade; responding to their requests to exercise their rights, with our help where you need it; deciding who in your business may access their data, using the roles in the Service; and keeping records only for as long as you need them, within the limits of your retention obligations.
If an individual contacts us directly about data in your books, we will refer them to you and will not respond to the substance of their request without your instruction, except where the law requires us to.
17. Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under eighteen as a user of the Service. If you believe a child has created an account, contact us and we will delete it. Your books may contain personal data about minors, for example where a customer is a school pupil; you process that data as controller and must have a lawful basis for doing so.
18. Changes to this Policy
We will update this Policy when our processing changes or the law requires it. We will publish the new version here with its effective date and, where the change is significant, tell you by email or in the Service before it takes effect. Earlier versions are available on request.