Privacy Policy

1Who we are and what this covers

This Privacy Policy is issued by WISP Limited of P.O. Box 195, Foodworld, Gordons, Port Moresby, Papua New Guinea (WISP, we, us or our). We are responsible for the personal information described here.

It applies when you visit our website, create an account, apply for or use GIGA Home Broadband, contact us, or use our Customer, ISP, DataCo or Admin portals. It should be read together with our Terms of Service.

We handle personal information in line with the laws of Papua New Guinea, including the National Information and Communications Technology Act 2009 and the Cybercrime Code Act 2016, and with internationally recognised privacy principles.

2Information we collect

Information you give us

• Identity and contact details: name, phone number, email address and postal address.
• Service address and location: your premises address, estate or area, and map location so we can check coverage and install the service.
• Verification documents: such as a national ID, passport or driver’s licence, where needed to confirm who you are and prevent fraud.
• Account details: username, password (stored in encrypted form) and your account role.
• Billing details: your plan, invoices and payment history. Card and mobile money details are collected and processed by our payment providers; we do not store your full card number.
• Communications: messages, support requests, call notes and feedback you send us.
• Partner information: if you are an ISP Partner or DataCo user, business details, licence information and staff contact details.

Information created when you use our services

• Service and network data: equipment identifiers, IP addresses, connection times, data volumes, speed and fault diagnostics.
• Website and portal data: device and browser type, pages visited, sign-in times and security logs.

Information from others

• ISP Partners who sell or support your service.
• DataCo and network contractors involved in installation and maintenance.
• Payment providers, confirming whether payments were successful.

3How we use your information

4Your internet activity

• We do not monitor, record or analyse the content of your communications or the websites you visit, except where we are required to by law or a valid court order.
• We process technical data such as IP address assignments, connection times and data volumes because it is needed to run and secure the network and to bill correctly.
• We never sell or rent your browsing data, and we do not use it for targeted advertising.

5Who we share it with

• ISP Partners who supply or support your service, limited to what they need for that purpose.
• DataCo, installers and contractors who build, install and maintain the network.
• Payment providers who process your payments securely.
• Technology providers who host our website, portals, email and databases for us.
• Professional advisers such as auditors, accountants and lawyers.
• Regulators and authorities, including NICTA and law enforcement, where we are legally required to or must protect people from harm. We check that each request is lawful.
• A new owner of all or part of our business, who must continue to protect your information in line with this policy.

Everyone we share information with must keep it confidential, protect it and use it only for the purpose we provide it.

6Cookies and similar technologies

We do not use advertising cookies. Most browsers let you block or delete cookies; doing so may stop you from signing in.

7Storage and international transfers

Our website, portals and some business systems are hosted by reputable technology providers, which may store or process information in countries outside Papua New Guinea, such as Australia, Singapore or the United States. Where this happens, we take reasonable steps, including contractual protections, to make sure your information receives a level of protection consistent with this policy.

8How long we keep it

9How we protect it

• Encrypted connections (HTTPS) across our website and portals.
• Passwords stored using one-way encryption.
• Role-based access, so customers, partners and staff see only the information they need.
• Staff and partner confidentiality obligations and access logging.
• Regular backups and software updates.

No system is completely secure. If we become aware of a data breach that is likely to cause you serious harm, we will notify you promptly and tell you what we are doing about it and what you can do to protect yourself.

Please help us by using a strong, unique password and never sharing your login details. We will never ask for your password by phone, SMS or email.

10Your rights and choices

• Access: ask for a copy of the personal information we hold about you.
• Correction: ask us to fix information that is wrong or out of date. You can update many details yourself in the Customer Portal.
• Deletion: ask us to delete your information where we no longer need it, subject to records we must keep by law.
• Marketing: opt out at any time using the unsubscribe link in our messages or by contacting us. Service messages, such as bills and outage notices, will still be sent.
• Withdraw consent: where we rely on your consent, you can withdraw it at any time.
• Complain: tell us if you are unhappy with how we have handled your information.

To make a request, contact us using the details below. We may need to verify your identity first. We will respond within 30 days and will not charge you for a reasonable request.

11Children

You must be 18 or older to create an account or apply for our services. We do not knowingly collect personal information from children. If you believe a child has given us their information, please contact us and we will delete it.

12Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top shows when it was last revised. If we make significant changes, we will let you know by email, SMS or a notice in the Portal before they take effect.

13Contact us and complaints

We will acknowledge privacy complaints within 2 business days and aim to resolve them within 30 days. If you are not satisfied with our response, you may contact the National Information and Communications Technology Authority (NICTA).