South Africa · Version 0.1
1.1 Purpose. GridSat (Pty) Ltd (registration number 2024/410741/07) (“GridSat”, “we”, “us” or “our”) respects the privacy of its customers and is committed to protecting their Personal Information. This Privacy Policy explains what Personal Information GridSat collects, why it is collected, how it is used and shared, and the rights available to Customers and other data subjects in respect of their Personal Information.
1.2 Relationship to the Customer Terms. This Privacy Policy is incorporated by reference into, and forms part of, the Gridsat Customer Terms and applies to any person who orders, receives or uses the Services or Kit, and to any other individual whose Personal Information GridSat processes in connection with the Services (each, “you” or a “Data Subject”).
1.3 Governing standard. GridSat processes Personal Information in accordance with the Protection of Personal Information Act, 2013 (Act 4 of 2013) (“POPIA”), the bulk of which came into force on 1 July 2020, with a one-year grace period ending 30 June 2021. POPIA is enforced by the Information Regulator (South Africa) (the “Regulator”), which also administers the Promotion of Access to Information Act, 2000 (“PAIA”).
2.1 Who this Policy applies to. This Policy applies to Personal Information GridSat collects through: (a) the sign-up, ordering and account administration process; (b) the GridSat Portal; (c) the Kit and Services once installed and in use; (d) correspondence, support requests and calls with GridSat; and (e) GridSat's website.
2.2 What this Policy does not cover. This Policy does not govern the privacy practices of Starlink, of any third-party website linked to from the GridSat Portal, or of any reseller or agent through whom you may have ordered the Services, each of which maintains its own privacy policy. Requests for access to records under PAIA are handled under GridSat's separate PAIA manual, available on request.
3.1 “Personal Information” means information relating to an identifiable, living natural person and, where applicable under POPIA, an identifiable, existing juristic person, including but not limited to information relating to race, gender, contact details, identifying numbers, and financial, employment or communications history.
3.2 “POPIA” means the Protection of Personal Information Act, 2013 (Act 4 of 2013) of South Africa, as amended.
3.3 “Information Regulator” means the Information Regulator (South Africa), the independent body established under POPIA to enforce POPIA and PAIA.
3.4 “Processing” means any operation or activity performed on Personal Information, including collection, receipt, recording, organisation, storage, use, dissemination, or destruction.
3.5 “Responsible Party” means GridSat, being the party that determines the purpose of and means for processing Personal Information under this Policy.
3.6 “GridSat Portal” means has the meaning given in the Customer Terms.
3.7 “Starlink” means Starlink Services, LLC, SpaceX Starlink and their respective Affiliates, being the upstream satellite network operator whose infrastructure GridSat uses to deliver the Services.
3.8 “Data Subject” means the person to whom Personal Information relates.
3.9 Capitalised terms not defined in this Policy have the meaning given to them in the Customer Terms.
4.1 Account and order information. Name, contact details, physical and billing address, identity or company registration number, and banking or payment details, collected when an Order is placed or an account is opened.
4.2 Service usage information. Information relating to installation address, Kit serial numbers, service tier, data usage, network performance and fault history, collected in the course of provisioning, monitoring and supporting the Services.
4.3 Communications data. Correspondence with GridSat's sales, billing and support teams, including call recordings, emails and Portal support tickets.
4.4 Technical and network data. IP addresses, device and terminal identifiers, and network diagnostic data generated by the Kit and the Starlink network, to the extent this constitutes Personal Information.
4.5 Portal data. Login credentials and a temporary session identifier used to keep a Customer authenticated while logged in to the GridSat Portal. The Portal does not use cookies and does not otherwise track, profile or log Portal usage (see clause 12).
5.1 Directly from you. Most Personal Information is provided directly by the Customer or its representatives when ordering the Services, opening an account, or contacting GridSat for support.
5.2 Through the Kit and the Services. Technical and network data is generated automatically through the Customer's use of the Kit and the Services.
5.3 From third parties. GridSat may receive Personal Information from a reseller or agent through whom the Customer was onboarded, from Starlink in connection with Kit registration and network provisioning, or from credit, fraud or identity verification providers where applicable.
6.1 Purposes. GridSat processes Personal Information to: (a) provision, deliver, monitor and support the Services and Kit; (b) administer accounts and process billing and payment; (c) comply with applicable Law, including Know-Your-Customer, tax and regulatory reporting obligations; (d) communicate with Customers regarding their account, the Services, and service disruptions; (e) protect the security and integrity of GridSat's and Starlink's networks; and (f) enforce the Customer Terms and pursue or defend legal claims.
6.2 Legal basis. Consistent with the conditions for lawful processing under POPIA, GridSat processes Personal Information only where: it is necessary for the performance of the Agreement with the Customer; it is necessary to comply with an obligation imposed by law on GridSat; it is necessary to protect a legitimate interest of the Customer or Data Subject; or it is necessary for pursuing the legitimate interests of GridSat or a third party to whom the information is supplied, provided this does not override the Data Subject's own interests. Where none of these grounds applies, GridSat will obtain the Data Subject's consent before processing.
6.3 Direct marketing. In accordance with section 69 of POPIA, GridSat will only send direct marketing communications by electronic means with the Customer's prior consent, save where the Customer is an existing customer of GridSat, the marketing relates to similar products or services, and the Customer was given a reasonable opportunity to opt out at the time the information was collected and at each subsequent communication.
7.1 Starlink. GridSat shares Personal Information with Starlink strictly to the extent necessary for Starlink to activate, provision, maintain and support the Kit and the underlying satellite connectivity, and to process Limited Warranty claims under the Customer Terms. GridSat does not itself store or process the content of communications carried over the Starlink network; carriage of Customer traffic across Starlink's infrastructure is performed by Starlink as the upstream network operator, independently of GridSat's own processing of account, billing and support information described in this Policy.
7.2 Service providers. GridSat may share Personal Information with its professional advisors, payment processors, couriers, IT and hosting providers, and other contracted service providers (each an “operator” for the purposes of POPIA), solely for the purposes described in clause 6, under a written agreement requiring the operator to maintain the confidentiality and security of the information, and subject to obligations of confidentiality.
7.3 Group companies. GridSat may share Personal Information with its Affiliates within the GridSat group for account administration and group reporting purposes.
7.4 Legal and regulatory disclosure. GridSat may disclose Personal Information where required by Law, by a competent Authority, or by a valid court order, or where necessary to establish, exercise or defend a legal claim.
7.5 No sale of Personal Information. GridSat does not sell Personal Information to third parties.
8.1 Nature of the Services. The Services are delivered using satellite connectivity operated by Starlink, whose ground infrastructure, gateways and servers are located outside South Africa. As an inherent and unavoidable feature of this technology, Personal Information transmitted as part of the Customer's use of the Services, together with limited account and technical information necessary for Kit activation and support, will necessarily be transmitted to, and may be processed in, jurisdictions outside South Africa.
8.2 Safeguards. Section 72 of POPIA restricts the transfer of Personal Information to a recipient in a foreign country unless, among other grounds, the transfer is necessary for the performance of a contract between the Data Subject and GridSat, or for the conclusion or performance of a contract concluded in the interest of the Data Subject between GridSat and a third party, or the recipient is subject to a law, binding corporate rules or agreement providing an adequate level of protection substantially similar to the conditions for lawful processing under POPIA (including restrictions on further onward transfer). GridSat's transfer of Personal Information to Starlink is made in reliance on the contract-performance ground, being necessary for the provision of the Services, which are technically inseparable from the Starlink network.
9.1 Retention period. GridSat retains Personal Information for no longer than is necessary to achieve the purposes described in clause 6, including for the duration of the Agreement and for such further period as required to comply with applicable Law (including tax, accounting and regulatory record-keeping requirements), or to establish, exercise or defend legal claims, as required by section 14 of POPIA.
9.2 Deletion. Personal Information that is no longer required for these purposes will be securely deleted, destroyed or de-identified.
10.1 Measures. In accordance with section 19 of POPIA, GridSat implements appropriate, reasonable technical and organisational measures to secure the integrity and confidentiality of Personal Information and to prevent its loss, damage, unauthorised destruction, or unlawful access or processing.
10.2 Personnel. Access to Personal Information is restricted to GridSat personnel and contracted operators who require it to perform their functions, and who are subject to obligations of confidentiality.
10.3 Breach notification. Where GridSat has reasonable grounds to believe that a Data Subject's Personal Information has been accessed or acquired by an unauthorised person, GridSat will notify the Information Regulator and the affected Data Subject in writing as soon as reasonably possible after discovery, as required by section 22 of POPIA.
11.1 Rights available to you. Subject to POPIA and to any applicable exceptions, you have the right to: (a) be notified that Personal Information about you is being collected; (b) establish whether GridSat holds Personal Information about you and request access to it; (c) request correction, destruction or deletion of Personal Information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully; (d) object, on reasonable grounds, to the processing of your Personal Information; (e) object to the processing of your Personal Information for direct marketing purposes; (f) not be subject to a decision based solely on automated processing, including profiling, which affects you to a substantial degree, without an opportunity to make representations; and (g) submit a complaint to the Information Regulator.
11.2 How to exercise your rights. Requests may be submitted using the contact details in clause 16. GridSat will respond within a reasonable time and may request proof of identity before giving effect to a request.
11.3 Limitations. GridSat may decline or limit a request where permitted or required by applicable Law, including where the Personal Information is required to comply with a legal obligation or to establish, exercise or defend a legal claim.
12.1 No cookies or tracking. The GridSat Portal does not use cookies and does not track Data Subjects. The Portal uses session identifiers solely to authenticate a logged-in user for the duration of their session; these session identifiers are not used for tracking, profiling, analytics, or advertising purposes, and expire when the session ends.
12.2 If this changes. Should GridSat introduce cookies or similar tracking technologies on the Portal or website in future, this Policy will be updated accordingly and, where required by applicable Law, an appropriate notice or consent mechanism will be implemented at that time.
13.1 No services directed at children. The Services are not directed at, and are not intended to be ordered by, children. POPIA subjects the processing of a child's Personal Information to additional conditions, and GridSat does not knowingly collect Personal Information from a child without the consent of a competent person (such as a parent or legal guardian), as required under POPIA.
14.1 Updates. GridSat may update this Policy from time to time to reflect changes in its practices or in applicable Law. The current version will be published on the GridSat Portal, and the “version” and date on the cover of this Policy will be updated accordingly. Material changes will be notified to Customers in accordance with the Customer Terms.
15.1 Contacting GridSat first. If you have a concern about how GridSat has handled your Personal Information, please contact GridSat using the details in clause 16 so that GridSat can attempt to resolve the matter.
15.2 Information Regulator. You may also lodge a complaint with the Information Regulator, whose contact details are: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191; POPIAComplaints@inforegulator.org.za (POPIA complaints) or PAIAComplaints@inforegulator.org.za (PAIA complaints).
16.1 Contact details. Questions, requests or complaints regarding this Policy or GridSat's processing of Personal Information may be directed to:
GridSat (Pty) Ltd (registration number 2024/410741/07)
1 James Barry Avenue, Constantia, Cape Town, South Africa
privacy@gridsat.net
This Privacy Policy forms part of the GridSat Terms & Conditions. For Starlink's policies, see the Starlink Acceptable Use Policy .