Madagascar · Version 0.6
1.1 Purpose. GridSat Madagascar SARL (“GridSat”, “we”, “us” or “our”) respects the privacy of its customers and is committed to protecting their Personal Information. This Privacy Policy explains what Personal Information GridSat collects, why it is collected, how it is used and shared, and the rights available to Customers and other data subjects in respect of their Personal Information.
1.2 Relationship to the Customer Terms. This Privacy Policy is incorporated by reference into, and forms part of, the Gridsat Customer Terms (clause 13.1) and applies to any person who orders, receives or uses the Services or Kit, and to any other individual whose Personal Information GridSat processes in connection with the Services (each, “you” or a “Data Subject”).
1.3 Governing standard. GridSat processes Personal Information in accordance with applicable Malagasy law, in particular Loi n°2014-038 du 9 janvier 2015 sur la protection des données à caractère personnel (the “Data Protection Law”), supervised by the Commission Malagasy de l'Informatique et des Libertés (“CMIL”), and, where relevant to the security of GridSat's systems, Loi n°2014-006 du 19 juin 2014 relative à la lutte contre la cybercriminalité, as amended by Loi n°2016-031.
2.1 Who this Policy applies to. This Policy applies to Personal Information GridSat collects through: (a) the sign-up, ordering and account administration process; (b) the GridSat Portal; (c) the Kit and Services once installed and in use; (d) correspondence, support requests and calls with GridSat; and (e) GridSat's website.
2.2 What this Policy does not cover. This Policy does not govern the privacy practices of Starlink, of any third-party website linked to from the GridSat Portal, or of any reseller or agent through whom you may have ordered the Services, each of which maintains its own privacy policy.
3.1 “Personal Information” means information relating to an identified or identifiable natural person, and, where applicable under Malagasy law, an identifiable juristic person.
3.2 “Data Protection Law” means Loi n°2014-038 du 9 janvier 2015 sur la protection des données à caractère personnel, as amended, and any implementing decree (including Décret n°2023-1541 establishing the CMIL).
3.3 “CMIL” means the Commission Malagasy de l'Informatique et des Libertés, the independent administrative authority responsible for supervising compliance with the Data Protection Law.
3.4 “Processing” means any operation performed on Personal Information, including collection, recording, storage, use, disclosure, transmission, or destruction.
3.5 “GridSat Portal” means has the meaning given in the Customer Terms.
3.6 “Starlink” means Starlink Services, LLC, SpaceX Starlink and their respective Affiliates, being the upstream satellite network operator whose infrastructure GridSat uses to deliver the Services.
3.7 “Data Subject” means the natural person to whom Personal Information relates.
3.8 Capitalised terms not defined in this Policy have the meaning given to them in the Customer Terms.
4.1 Account and order information. Name, contact details, physical and billing address, identity or company registration number, and banking or payment details, collected when an Order is placed or an account is opened.
4.2 Service usage information. Information relating to installation address, Kit serial numbers, service tier, data usage, network performance and fault history, collected in the course of provisioning, monitoring and supporting the Services.
4.3 Communications data. Correspondence with GridSat's sales, billing and support teams, including call recordings, emails and Portal support tickets.
4.4 Technical and network data. IP addresses, device and terminal identifiers, and network diagnostic data generated by the Kit and the Starlink network, to the extent this constitutes Personal Information.
4.5 Portal data. Login credentials and a temporary session identifier used to keep a Customer authenticated while logged in to the GridSat Portal. The Portal does not use cookies and does not otherwise track, profile or log Portal usage (see clause 12).
5.1 Directly from you. Most Personal Information is provided directly by the Customer or its representatives when ordering the Services, opening an account, or contacting GridSat for support.
5.2 Through the Kit and the Services. Technical and network data is generated automatically through the Customer's use of the Kit and the Services.
5.3 From third parties. GridSat may receive Personal Information from a reseller or agent through whom the Customer was onboarded, from Starlink in connection with Kit registration and network provisioning, or from credit, fraud or identity verification providers where applicable.
6.1 Purposes. GridSat processes Personal Information to: (a) provision, deliver, monitor and support the Services and Kit; (b) administer accounts and process billing and payment; (c) comply with applicable Law, including Know-Your-Customer, tax and regulatory reporting obligations; (d) communicate with Customers regarding their account, the Services, and service disruptions; (e) protect the security and integrity of GridSat's and Starlink's networks; and (f) enforce the Customer Terms and pursue or defend legal claims.
6.2 Legal basis. Consistent with the grounds recognised under the Data Protection Law, GridSat relies on: performance of the Agreement with the Customer; compliance with GridSat's legal obligations; and GridSat's legitimate interests in operating, securing and improving the Services, provided these interests do not override the Data Subject's own rights and freedoms. Where required by the Data Protection Law, GridSat will obtain consent before processing Personal Information for a purpose not covered above.
6.3 Marketing. GridSat will only send direct marketing communications where permitted by applicable Law, and will provide a means to opt out of any such communications.
7.1 Starlink. GridSat shares Personal Information with Starlink strictly to the extent necessary for Starlink to activate, provision, maintain and support the Kit and the underlying satellite connectivity, and to process Limited Warranty claims under the Customer Terms. GridSat does not itself store or process the content of communications carried over the Starlink network; carriage of Customer traffic across Starlink's infrastructure is performed by Starlink as the upstream network operator, independently of GridSat's own processing of account, billing and support information described in this Policy.
7.2 Service providers. GridSat may share Personal Information with its professional advisors, payment processors, couriers, IT and hosting providers, and other contracted service providers, solely for the purposes described in clause 6, and subject to obligations of confidentiality.
7.3 Group companies. GridSat may share Personal Information with its Affiliates within the GridSat group for account administration and group reporting purposes.
7.4 Legal and regulatory disclosure. GridSat may disclose Personal Information where required by Law, by a competent Authority, or by a valid court order, or where necessary to establish, exercise or defend a legal claim.
7.5 No sale of Personal Information. GridSat does not sell Personal Information to third parties.
8.1 Nature of the Services. The Services are delivered using satellite connectivity operated by Starlink, whose ground infrastructure, gateways and servers are located outside Madagascar. As an inherent and unavoidable feature of this technology, Personal Information transmitted as part of the Customer's use of the Services, together with limited account and technical information necessary for Kit activation and support, will necessarily be transmitted to, and may be processed in, jurisdictions outside Madagascar.
8.2 Safeguards. Article 20 of the Data Protection Law permits a transfer of Personal Information to a foreign State only where that State's legislation provides a level of protection similar to Madagascar's, unless one of a limited set of derogations applies — including where the Data Subject has given informed consent to the transfer, or where the transfer is necessary for the performance of a contract with the Data Subject or for the conclusion or performance of a contract in the Data Subject's interest. GridSat's transfer of Personal Information to Starlink is made in reliance on the latter derogation, being necessary for the performance of the Agreement (the provision of the Services, which are technically inseparable from the Starlink network).
9.1 Retention period. GridSat retains Personal Information for as long as reasonably necessary to fulfil the purposes described in clause 6, including for the duration of the Agreement and for such further period as required to comply with applicable Law (including tax, accounting and regulatory record-keeping requirements), or to establish, exercise or defend legal claims.
9.2 Deletion. Personal Information that is no longer required for these purposes will be securely deleted or anonymised.
10.1 Measures. GridSat implements reasonable technical and organisational measures designed to protect Personal Information against unauthorised access, loss, misuse, alteration or destruction, proportionate to the nature of the Personal Information and the risks involved.
10.2 Personnel. Access to Personal Information is restricted to GridSat personnel and contracted service providers who require it to perform their functions, and who are subject to obligations of confidentiality.
10.3 No absolute guarantee. No method of transmission or storage is entirely secure. Where a security incident is reasonably likely to result in a risk to a Data Subject's rights, GridSat will take reasonable steps to notify affected Data Subjects and the competent Authority in accordance with applicable Law.
11.1 Rights available to you. Subject to the Data Protection Law and to any applicable exceptions, you have the right to: (a) be informed of the processing of your Personal Information; (b) request access to the Personal Information GridSat holds about you; (c) request correction of inaccurate or incomplete Personal Information; (d) request deletion of Personal Information no longer required for the purposes described in this Policy; (e) object to certain processing; and (f) lodge a complaint with the CMIL.
11.2 How to exercise your rights. Requests may be submitted using the contact details in clause 16. GridSat will respond within the timeframe required by applicable Law and may request proof of identity before giving effect to a request.
11.3 Limitations. GridSat may decline or limit a request where permitted or required by applicable Law, including where the Personal Information is required to comply with a legal obligation or to establish, exercise or defend a legal claim.
12.1 No cookies or tracking. The GridSat Portal does not use cookies and does not track Data Subjects. The Portal uses session identifiers solely to authenticate a logged-in user for the duration of their session; these session identifiers are not used for tracking, profiling, analytics, or advertising purposes, and expire when the session ends.
12.2 If this changes. Should GridSat introduce cookies or similar tracking technologies on the Portal or website in future, this Policy will be updated accordingly and, where required by applicable Law, an appropriate notice or consent mechanism will be implemented at that time.
13.1 No services directed at children. The Services are not directed at, and are not intended to be ordered by, children. GridSat does not knowingly collect Personal Information from children without the consent of a parent or guardian, as required under applicable Law.
14.1 Updates. GridSat may update this Policy from time to time to reflect changes in its practices or in applicable Law. The current version will be published on the GridSat Portal, and the “version” and date on the cover of this Policy will be updated accordingly. Material changes will be notified to Customers in accordance with the Customer Terms.
15.1 Contacting GridSat first. If you have a concern about how GridSat has handled your Personal Information, please contact GridSat using the details in clause 16 so that GridSat can attempt to resolve the matter.
15.2 Regulator. You may also have the right to lodge a complaint with the CMIL, Madagascar's independent data protection authority established under the Data Protection Law and Décret n°2023-1541.
16.1 Contact details. Questions, requests or complaints regarding this Policy or GridSat's processing of Personal Information may be directed to:
GridSat Madagascar SARL
Pres lot 001 A Bis, Andranomena, Ambohibao, Antananarivo, Madagascar
privacy@gridsat.net
This Privacy Policy forms part of the GridSat Terms & Conditions. For Starlink's policies, see the Starlink Acceptable Use Policy .