Privacy Policy

1. Information We Collect

Depending on whether you are an ISP administrator or an end-customer interacting with a GigaBill-powered ISP portal or WhatsApp service, we collect and process the following categories of data:

• Operator Account Data: Name, work email address, phone number, corporate designation, and ISP company registration documents necessary for tenant onboarding.
• Customer Service Metadata: PPPoE/IPoE usernames, hashed authentication credentials, assigned IP addresses, MAC addresses, NAS identifiers, and optical line terminal (OLT) port mappings.
• RADIUS Accounting Records: RFC 2866 session timestamps (session start, interim updates, session stop), input/output octets, and disconnect reason codes to facilitate bandwidth management and accurate billing.
• Billing & Payment Data: Transaction reference IDs, virtual bank account numbers, settlement webhooks, and invoice amounts. GigaBill processes card payments via licensed Payment Solution Service Providers (PSSPs); we do not store raw card numbers or CVVs.
• Conversational Interactions: Mobile phone numbers (MSISDN), inbound menu prompts, and renewal confirmation notices delivered via authorized WhatsApp Business APIs.

2. Lawful Basis for Processing

In accordance with Section 25 of the Nigeria Data Protection Act (NDPA 2023), GigaBill processes personal data exclusively under the following lawful bases:

• Contractual Necessity: Executing automated service unthrottling, issuing tax invoices, and providing continuous subscriber authentication.
• Legal Obligation: Compliance with Federal Inland Revenue Service (FIRS) e-invoicing laws and Nigerian Communications Commission (NCC) statutory reporting requirements.

3. Data Isolation & Security

Carrier billing infrastructure demands high-grade operational security:

• Multi-tenant schema segregation preventing cross-tenant data leakage.
• Database storage encrypted at rest using AES-256-GCM.
• Web and API communications enforced over TLS 1.3 with HSTS.
• Role-Based Access Control (RBAC) ensuring operator employees access only records required for their duty.
• Automated daily off-site encrypted backups with cryptographic checksum verification.

4. Data Retention & Archiving

We retain customer and accounting data only for as long as necessary to maintain billing history, dispute resolution, and regulatory compliance. High-frequency RADIUS accounting logs are automatically summarized into daily accounting aggregates and purged after 90 days, unless an extended retention period is explicitly required by the operator for regulatory audits.

5. Third-Party Integrations

GigaBill coordinates with select sub-processors to deliver core functionality:

• Payment Processors: Licensed Nigerian PSSPs (Paystack, Flutterwave, Monnify, Interswitch) for payment gateway settlement.
• Messaging: Meta Cloud API / WhatsApp Business Platform for transactional self-care messages.
• Hosting Infrastructure: Tier-III and Tier-IV data centers compliant with ISO 27001 and local data residency guidelines.

6. Your Rights Under NDPA 2023

Under Nigerian data protection regulations, individuals hold the following rights:

• Right to request confirmation and copies of personal data held.
• Right to request rectification of inaccurate or obsolete customer details.
• Right to request erasure of personal data where retention lacks lawful basis.
• Right to object to automated processing or request human intervention.
• Right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).