Privacy Policy & Data Protection

1. Statutory Commitment & Scope

IAMNET, trading as IAMsecure (Pty) Ltd ("IAMNET", "we", "us", or "our"), operates solar-powered community mesh telecommunications infrastructure across the Republic of South Africa and expanding Pan-African territories. We operate as the dedicated connectivity division of the IAM group, alongside IAMSECURE (cybersecurity operations).

This Privacy Policy governs personal information collected through our website (iamnet.online), captive sign-in portals, and edge networking nodes. It satisfies our statutory duties under the Protection of Personal Information Act, No. 4 of 2013 (POPIA) of South Africa and incorporates the baseline safeguards of the General Data Protection Regulation (EU) 2016/679 (GDPR) for international visitors and partners.

2. South African POPIA Alignment

In adherence to Condition 1 through Condition 8 of Chapter 3 of POPIA, IAMNET processes personal information under the principles of accountability, processing limitation, purpose specification, information quality, openness, security safeguards, and data subject participation:

• Information Officer Designation: In accordance with Sections 55 and 56 of POPIA, IAMNET has registered an Information Officer tasked with overseeing governance, compliance, and requests for access. Enquiries can be directed directly to connect@iamnet.online (Attention: Information Officer).
• Lawful Basis & Limitation: Information is collected exclusively for legitimate network provisioning, session continuity, fraud deterrence, and statutory telecommunications regulatory adherence.
• Data Subject Participation (Section 23 & 24): You have the unconditioned right to confirm whether we hold personal information about you, request a copy thereof, and mandate correction or deletion of inaccurate, irrelevant, or excessive records without punitive cost.
• Mandatory Breach Notification (Section 22): Where reasonable grounds exist to believe personal data has been compromised or accessed by an unauthorized person, IAMNET maintains documented protocol to immediately notify the Information Regulator and affected data subjects without unreasonable delay.

3. European / International GDPR Alignment

For international partners, roaming subscribers, and cross-border commercial customers:

• Legal Bases for Processing (Article 6): Processing is grounded in explicit contractual necessity (delivering requested internet access), compliance with legal obligations, or our legitimate interest in securing edge node infrastructure.
• Data Subject Rights (Articles 15–21): Includes the right to access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and the right to object to automated decision-making.
• Cross-Border Safeguards (Chapter V): Cloud-based routing telemetry transferred outside South Africa or the EEA is executed under standard contractual clauses (SCCs) guaranteeing equivalent data protection.

4. Captive Portal & Network Telemetry Handling

IAMNET takes a firm stance against consumer surveillance in public connectivity:

• Free Ad-Supported Access: When connecting to our complimentary tier, users view a lightweight sponsor advertisement. IAMNET does not inspect packets, track URLs visited, build commercial tracking dossiers, or monitor application traffic content.
• Session Telemetry: For load balancing and network health, nodes record hardware MAC addresses (hashed for anonymity), connection timestamps, total megabytes transferred, and signal-to-noise ratio. These ephemeral logs are automatically pruned every 30 days.
• Pre-Paid Micro-Bundle Transactions: Payments via debit card, Instant EFT, or mobile money are processed through PCI-DSS Level 1 certified gateways. IAMNET never stores raw card details, CVVs, or online banking passwords on edge hardware or web servers.

5. Retention & Disposal Protocol

Personal records and network diagnostics are retained only for the minimum statutory timeframe mandated under South African law (such as the Regulation of Interception of Communications and Provision of Communication-Related Information Act, RICA, where applicable). Data is destroyed, de-identified, or irreversibly anonymized using NIST SP 800-88 cryptographic sanitization standards once its operational purpose expires.

6. Contacting the Information Officer & Regulatory Authority

To exercise your data subject rights, lodge an enquiry, or request our PAIA (Promotion of Access to Information Act) Manual: