Privacy Policy

1. Introduction

Micro IT Solutions (Pty) Ltd, trading as Flexi Networks, is a licensed electronic communications provider in the Kingdom of Eswatini. We take the privacy of our customers, website visitors and job applicants seriously.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and what rights you have under the Data Protection Act, 2022 of the Kingdom of Eswatini.

For the purposes of that Act, Flexi Networks is the data controller in respect of the personal data described in this policy.

2. Scope of this policy

This policy applies to personal data we process in connection with:

• enquiries, coverage checks and quotation requests;
• the provision, installation, support and billing of our services;
• use of this website and our online forms;
• communications with our sales, support and accounts teams;
• job applications submitted through our careers pages; and
• our legal and regulatory obligations as a licensed operator.

It does not apply to third-party websites or services that you reach through links on our site. Those have their own privacy policies, which you should read.

3. Personal data we collect

Information you give us

• Identity and contact details — name, physical and postal address, email address, telephone and mobile numbers.
• Identification and verification data — identity or passport number and supporting documents, and for businesses, company registration and tax details. We are required to collect and verify this under subscriber registration requirements.
• Account and billing information — customer number, billing address, payment records, banking details where you arrange a debit order, and correspondence about your account.
• Service information — the address at which service is installed, package selected, installation notes, equipment allocated and support history.
• Communications — the content of enquiries, support tickets, fault reports, emails, WhatsApp messages and, where calls are recorded for quality or training purposes, call recordings.
• Attachments you send us — including photographs of equipment submitted with a fault report, and documents submitted with an application.
• Recruitment data — where you apply for a role, your curriculum vitae and the information it contains.

Information generated by your use of our services

• Network and traffic data — connection times, session duration, volumes of data transferred, IP address allocation, equipment identifiers and technical performance data.
• Service quality data — line diagnostics, signal levels, fault and outage records.
• Website data — pages visited, approximate location derived from IP address, device and browser type, referring page and time of visit.

We do not routinely inspect, monitor or record the content of your communications, and we do not do so except where required by law under a valid warrant, court order or lawful directive.

4. Why we process your data, and our lawful basis

We process personal data only where we have a lawful basis to do so.

• Performance of a contract — to assess coverage, quote for and install services, provide and support the service, manage your account, bill you and collect payment, and handle relocations and cancellations.
• Compliance with a legal obligation — to register subscribers, retain records required by our licence and by law, respond to lawful requests from competent authorities, meet tax and accounting requirements, and comply with the Data Protection Act.
• Legitimate interests — to secure and maintain our network, prevent fraud and abuse, plan capacity and coverage expansion, improve our services, train our staff, and keep records of complaints and their resolution. We balance these interests against your rights and freedoms.
• Consent — for optional marketing communications, non-essential website analytics, and any processing that requires consent under the Act. Where we rely on consent, you may withdraw it at any time.
• Protection of vital interests or public interest — in the limited circumstances recognised by the Act.

5. Special categories of personal data

We do not seek to collect sensitive personal data — such as data revealing health, race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or sexual orientation — in the ordinary course of providing our services.

Where such data is unavoidably processed, for example where an accessibility requirement is relevant to an installation, we do so only where the Act permits it, only to the extent necessary, and with appropriate additional safeguards.

Please do not include sensitive personal data in support tickets, fault reports or general correspondence unless it is genuinely necessary.

6. Cookies and website analytics

Our website uses a small number of cookies and similar technologies.

• Strictly necessary — required for the site to function, for example to remember your session or protect forms against automated abuse. These cannot be disabled.
• Analytics — where enabled, these help us understand which pages are useful and where visitors encounter difficulty. They are used in aggregate and are not used to identify you personally.
• Third-party content — some pages embed third-party content, such as a map or a web font, which may set its own cookies. These are governed by the relevant third party’s privacy policy.

You can control or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the site, including our forms, from working correctly.

7. Who we share your data with

We do not sell personal data. We share it only where necessary, and only with:

• Service providers acting on our instructions — including billing and customer management platforms, email and hosting providers, payment processors, installation contractors and IT support providers. These parties act as data processors under written terms requiring them to protect your data and to use it only for the purposes we specify.
• Upstream and interconnect partners — where technically necessary to deliver or fault-find your service.
• Competent authorities — including the Eswatini Communications Commission, law enforcement and the courts, where we are lawfully required to disclose information.
• Professional advisers — auditors, accountants and legal advisers, under duties of confidentiality.
• Debt collection agencies — where an account remains unpaid after our internal recovery processes.
• A purchaser — in the event of a sale, merger or reorganisation of our business, subject to equivalent protections.

8. Transfers outside Eswatini

Some of the service providers we use operate systems located outside the Kingdom of Eswatini, which means your personal data may be transferred across borders.

Where personal data is transferred to another SADC Member State, we do so in accordance with the conditions set out in the Data Protection Act. Where data is transferred outside SADC, we take reasonable steps to satisfy ourselves that an adequate level of protection is in place — through contractual safeguards, an assessment of the recipient country’s legal framework, or another basis permitted by the Act.

You may ask us for further information about the safeguards applied to a specific transfer.

9. How long we keep your data

We keep personal data only for as long as necessary for the purpose it was collected for, and to meet our legal, regulatory, accounting and reporting obligations.

• Customer account and billing records — retained for the duration of the service and thereafter for the period required by tax, accounting and licence obligations.
• Subscriber registration and verification data — retained for the period required by applicable law and our licence conditions.
• Support tickets, fault reports and correspondence — retained for a period appropriate to service history, quality assurance and complaint handling.
• Network and traffic data — retained for the period required for network operation, security and any applicable legal retention requirement.
• Enquiries that do not become accounts — retained for a limited period to allow follow-up, then deleted.
• Recruitment data — retained for a limited period after the recruitment process concludes, unless you agree to us keeping it on file for future opportunities.

When data is no longer required it is securely deleted or anonymised.

10. How we protect your data

We maintain appropriate technical and organisational measures to protect personal data against unauthorised or unlawful access, alteration, disclosure, loss or destruction. These include:

• access controls that limit personal data to staff who need it to do their job;
• encryption of data in transit where appropriate;
• network security controls, monitoring and logging;
• confidentiality obligations and privacy training for our staff;
• written data protection terms with the processors we appoint; and
• backup and recovery procedures.

No system can be guaranteed completely secure. You also play a part: keep your account credentials and passwords confidential, secure your own devices and wireless network, and tell us promptly if you suspect your account has been compromised.

11. Your rights under the Data Protection Act, 2022

Subject to the conditions and exemptions in the Act, you have the right to:

• Be informed about how your personal data is collected and used — which is the purpose of this policy.
• Access the personal data we hold about you, and to be told how it is being processed.
• Correction of personal data that is inaccurate, misleading or incomplete.
• Deletion of personal data that is outdated, irrelevant, excessive or has been unlawfully processed, where we are not required to retain it.
• Object to processing in certain circumstances, including processing for direct marketing.
• Withdraw consent at any time where our processing is based on consent. Withdrawal does not affect processing already carried out.
• Not be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.
• Lodge a complaint with the supervisory authority.

12. How to exercise your rights

To exercise any of these rights, contact us by email at sales@flexinetworks.co.sz, by telephone on +268 2417 7505, or in writing at Libro Business Park, Kunene Road, Corner Plaza, Ezulwini, Eswatini.

So that we do not disclose your data to the wrong person, we will verify your identity before acting on a request. We may ask for proof of identity and, where the request is made on someone else’s behalf, evidence of authority.

We will respond within the period required by the Act. Where a request is complex or you have made a number of requests, we may need longer — if so, we will tell you and explain why.

There is normally no charge for exercising your rights. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline to act, and will explain our reasons.

13. Automated decision-making

We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing.

Some processes are partly automated — for example, an initial coverage indication generated from our mapped coverage areas, or automated billing reminders. Decisions that materially affect your service, such as approving an installation, restricting an account or declining an application, involve human review.

14. Marketing communications

We may send you service-related communications — invoices, maintenance notices, outage updates and important account information. These are necessary to provide your service and are not marketing.

We will only send you marketing communications where you have consented, or where permitted by law in relation to our own similar services. Every marketing message includes a simple way to opt out, and you can also tell us at any time that you no longer wish to receive them.

Opting out of marketing does not affect service-related communications, which we must continue to send.

15. Children’s personal data

Our services are contracted with adults and our website is not directed at children. We do not knowingly collect personal data from children without the consent of a parent or guardian.

If you believe a child has provided personal data to us without appropriate consent, please contact us and we will take appropriate steps to delete it.

16. Data breaches

We maintain procedures to detect, investigate, contain and record personal data breaches.

Where a breach occurs that is likely to result in a risk to the rights and freedoms of affected individuals, we will notify the supervisory authority and, where required by the Act, the affected individuals without undue delay, describing what happened, the likely consequences and the steps taken to address it.

17. Complaints

If you are concerned about how we handle your personal data, please contact us first at sales@flexinetworks.co.sz. We take privacy complaints seriously and will investigate promptly.

If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority designated under the Data Protection Act, 2022. The data protection supervisory function in Eswatini is exercised by the Eswatini Communications Commission (ESCCOM), and a dedicated Eswatini Data Protection Authority has also been established — please refer to the current guidance published by those bodies for the correct route.

The supervisory authority has powers to investigate, order corrective action and impose administrative penalties for contraventions of the Act.

18. Changes to this policy

We review this policy regularly and may update it to reflect changes in law, regulation, technology or our practices.

The current version and its effective date are shown at the top of this page. Where a change is material, we will bring it to your attention by email or another appropriate means. We encourage you to review this page periodically.

19. Contact us

Micro IT Solutions (Pty) Ltd t/a Flexi Networks
Data controller for the purposes of the Data Protection Act, 2022
Libro Business Park, Kunene Road, Corner Plaza, Ezulwini, Eswatini
Telephone: +268 2417 7505
Email: sales@flexinetworks.co.sz
Licence: ESCCOM GECS/003/23/MICRO IT

Note for review: if a dedicated privacy or data protection contact address is established — for example privacy@flexinetworks.co.sz — it should be substituted here and in clause 12 before publication.