Lesotho · Version 0.2
1.1 Purpose. GridSat (Pty) Ltd – Lesotho Branch (registration number 95918) (“GridSat”, “we”, “us” or “our”) respects the privacy of its customers and is committed to protecting their Personal Information. This Privacy Policy explains what Personal Information GridSat collects, why it is collected, how it is used and shared, and the rights available to Customers and other data subjects in respect of their Personal Information.
1.2 Relationship to the Customer Terms. This Privacy Policy is incorporated by reference into, and forms part of, the Gridsat Customer Terms and applies to any person who orders, receives or uses the Services or Kit, and to any other individual whose Personal Information GridSat processes in connection with the Services (each, “you” or a “Data Subject”).
1.3 Governing standard. GridSat processes Personal Information in accordance with applicable Lesotho law, in particular the Data Protection Act, 2011 (Act No. 5 of 2012) (the “Data Protection Act”), which establishes the Lesotho Data Protection Commission (the “Commission”). As at the date of this Policy the Commission has not yet been appointed or made operational; the Data Protection Act nonetheless remains fully in force, and the courts of Lesotho retain jurisdiction to hear claims under it in the interim.
2.1 Who this Policy applies to. This Policy applies to Personal Information GridSat collects through: (a) the sign-up, ordering and account administration process; (b) the GridSat Portal; (c) the Kit and Services once installed and in use; (d) correspondence, support requests and calls with GridSat; and (e) GridSat's website.
2.2 What this Policy does not cover. This Policy does not govern the privacy practices of Starlink, of any third-party website linked to from the GridSat Portal, or of any reseller or agent (including Comnet Lesotho) through whom you may have ordered the Services, each of which maintains its own privacy policy.
3.1 “Personal Information” means any information about a living individual which can be used to identify that individual, either alone or together with other information, and, where applicable under Lesotho law, information relating to an identifiable juristic person.
3.2 “Data Protection Act” means the Data Protection Act, 2011 (Act No. 5 of 2012) of Lesotho, as amended.
3.3 “Commission” means the Lesotho Data Protection Commission established under the Data Protection Act, which as at the date of this Policy has not yet been appointed or made operational.
3.4 “Processing” means any operation or activity performed on Personal Information, including collection, recording, storage, use, disclosure, transmission, or destruction.
3.5 “GridSat Portal” means has the meaning given in the Customer Terms.
3.6 “Starlink” means Starlink Services, LLC, SpaceX Starlink and their respective Affiliates, being the upstream satellite network operator whose infrastructure GridSat uses to deliver the Services.
3.7 “Data Subject” means the individual to whom Personal Information relates.
3.8 Capitalised terms not defined in this Policy have the meaning given to them in the Customer Terms.
4.1 Account and order information. Name, contact details, physical and billing address, identity or company registration number, and banking or payment details, collected when an Order is placed or an account is opened.
4.2 Service usage information. Information relating to installation address, Kit serial numbers, service tier, data usage, network performance and fault history, collected in the course of provisioning, monitoring and supporting the Services.
4.3 Communications data. Correspondence with GridSat's sales, billing and support teams, including call recordings, emails and Portal support tickets.
4.4 Technical and network data. IP addresses, device and terminal identifiers, and network diagnostic data generated by the Kit and the Starlink network, to the extent this constitutes Personal Information.
4.5 Portal data. Login credentials and a temporary session identifier used to keep a Customer authenticated while logged in to the GridSat Portal. The Portal does not use cookies and does not otherwise track, profile or log Portal usage (see clause 12).
5.1 Directly from you. Most Personal Information is provided directly by the Customer or its representatives when ordering the Services, opening an account, or contacting GridSat for support.
5.2 Through the Kit and the Services. Technical and network data is generated automatically through the Customer's use of the Kit and the Services.
5.3 From third parties. GridSat may receive Personal Information from a reseller or agent through whom the Customer was onboarded, from Starlink in connection with Kit registration and network provisioning, or from credit, fraud or identity verification providers where applicable.
6.1 Purposes. GridSat processes Personal Information to: (a) provision, deliver, monitor and support the Services and Kit; (b) administer accounts and process billing and payment; (c) comply with applicable Law, including Know-Your-Customer, tax and regulatory reporting obligations; (d) communicate with Customers regarding their account, the Services, and service disruptions; (e) protect the security and integrity of GridSat's and Starlink's networks; and (f) enforce the Customer Terms and pursue or defend legal claims.
6.2 Legal basis. The Data Protection Act requires that Personal Information be collected only where necessary, appropriate to the context, and directly related to a clearly defined and lawful purpose. Consistent with this requirement, GridSat processes Personal Information on the basis of: performance of the Agreement with the Customer; compliance with GridSat's legal obligations; and GridSat's legitimate interests in operating, securing and improving the Services, provided these interests do not override the Data Subject's own rights and freedoms. Personal Information will not be used for a purpose other than that for which it was collected, except where the Data Protection Act permits this (including where the Data Subject has given informed consent).
6.3 Marketing. GridSat will only send direct marketing communications where permitted by applicable Law, and will provide a means to opt out of any such communications.
7.1 Starlink. GridSat shares Personal Information with Starlink strictly to the extent necessary for Starlink to activate, provision, maintain and support the Kit and the underlying satellite connectivity, and to process Limited Warranty claims under the Customer Terms. GridSat does not itself store or process the content of communications carried over the Starlink network; carriage of Customer traffic across Starlink's infrastructure is performed by Starlink as the upstream network operator, independently of GridSat's own processing of account, billing and support information described in this Policy.
7.2 Service providers. GridSat may share Personal Information with its professional advisors, payment processors, couriers, IT and hosting providers, and other contracted service providers, solely for the purposes described in clause 6, and subject to obligations of confidentiality.
7.3 Group companies. GridSat may share Personal Information with its Affiliates within the GridSat group for account administration and group reporting purposes.
7.4 Legal and regulatory disclosure. GridSat may disclose Personal Information where required by Law, by a competent Authority, or by a valid court order, or where necessary to establish, exercise or defend a legal claim.
7.5 No sale of Personal Information. GridSat does not sell Personal Information to third parties.
8.1 Nature of the Services. The Services are delivered using satellite connectivity operated by Starlink, whose ground infrastructure, gateways and servers are located outside Lesotho. As an inherent and unavoidable feature of this technology, Personal Information transmitted as part of the Customer's use of the Services, together with limited account and technical information necessary for Kit activation and support, will necessarily be transmitted to, and may be processed in, jurisdictions outside Lesotho.
8.2 Safeguards. The Data Protection Act prohibits a data controller from transferring Personal Information to a recipient in a foreign country unless the recipient is subject to a law, code of conduct or contract that (a) effectively upholds principles for reasonable processing that are substantially similar to those under the Data Protection Act, and (b) restricts any further transfer of the Personal Information to third parties in a foreign country on substantially similar terms; alternatively, where the recipient is in a SADC member state that has adopted the SADC data protection requirements and the transfer is necessary for a task carried out in the public interest or pursuant to the data controller's lawful functions. Starlink is not established in a SADC member state, and GridSat's transfer of Personal Information to Starlink is accordingly made in reliance on contractual terms with Starlink intended to satisfy the first of these grounds.
9.1 Retention period. GridSat retains Personal Information for as long as reasonably necessary to fulfil the purposes described in clause 6, including for the duration of the Agreement and for such further period as required to comply with applicable Law (including tax, accounting and regulatory record-keeping requirements), or to establish, exercise or defend legal claims.
9.2 Deletion. Personal Information that is no longer required for these purposes will be securely deleted or anonymised.
10.1 Measures. GridSat implements reasonable technical and organisational measures designed to protect Personal Information against unauthorised access, loss, misuse, alteration or destruction, proportionate to the nature of the Personal Information and the risks involved.
10.2 Personnel. Access to Personal Information is restricted to GridSat personnel and contracted service providers who require it to perform their functions, and who are subject to obligations of confidentiality.
10.3 Breach notification. Where GridSat believes that a Data Subject's Personal Information has been accessed or acquired by an unauthorised person, GridSat will notify the Commission and the affected Data Subject in writing as soon as reasonably possible after discovery, as required by the Data Protection Act. Notification to the Data Subject may be delayed where a competent authority determines that notification would impede a criminal investigation.
11.1 Rights available to you. Subject to the Data Protection Act and to any applicable exceptions, you have the right to: (a) request access to the Personal Information GridSat holds about you; (b) request correction of inaccurate Personal Information; (c) prevent or request the blocking of processing that causes, or is likely to cause, you unwarranted damage or distress; (d) object to the processing of your Personal Information for direct marketing purposes; and (e) once appointed, lodge a complaint with the Commission.
11.2 How to exercise your rights. Requests may be submitted using the contact details in clause 16. GridSat will respond within a reasonable time and may request proof of identity before giving effect to a request.
11.3 Limitations. GridSat may decline or limit a request where permitted or required by applicable Law, including where the Personal Information is required to comply with a legal obligation or to establish, exercise or defend a legal claim.
12.1 No cookies or tracking. The GridSat Portal does not use cookies and does not track Data Subjects. The Portal uses session identifiers solely to authenticate a logged-in user for the duration of their session; these session identifiers are not used for tracking, profiling, analytics, or advertising purposes, and expire when the session ends.
12.2 If this changes. Should GridSat introduce cookies or similar tracking technologies on the Portal or website in future, this Policy will be updated accordingly and, where required by applicable Law, an appropriate notice or consent mechanism will be implemented at that time.
13.1 No services directed at children. The Services are not directed at, and are not intended to be ordered by, children. GridSat does not knowingly collect Personal Information from children without the consent of a parent or guardian, as required under applicable Law.
14.1 Updates. GridSat may update this Policy from time to time to reflect changes in its practices or in applicable Law. The current version will be published on the GridSat Portal, and the “version” and date on the cover of this Policy will be updated accordingly. Material changes will be notified to Customers in accordance with the Customer Terms.
15.1 Contacting GridSat first. If you have a concern about how GridSat has handled your Personal Information, please contact GridSat using the details in clause 16 so that GridSat can attempt to resolve the matter.
15.2 Regulator and courts. The Data Protection Act provides for complaints to be made to the Commission. As the Commission has not yet been appointed or made operational, you may in the interim bring a claim directly before the courts of Lesotho, which retain full jurisdiction to hear claims under the Data Protection Act and to award damages.
16.1 Contact details. Questions, requests or complaints regarding this Policy or GridSat's processing of Personal Information may be directed to:
GridSat (Pty) Ltd – Lesotho Branch (registration number 95918)
1st Floor, Lccul Complex, Maseru West, Maseru, 100, Lesotho
privacy@gridsat.net
This Privacy Policy forms part of the GridSat Terms & Conditions. For Starlink's policies, see the Starlink Acceptable Use Policy .