Privacy Notice
This notice explains how FirstNet Technology Services (Pty) Ltd ("FirstNet", "we", "us") collects and uses personal information, and the rights you have under the Protection of Personal Information Act 4 of 2013 ("POPIA"). It applies to our customers and their staff, people who visit our website or use the "Ask FirstNet" assistant, people who contact us, resellers and suppliers, and visitors to our offices and data centres.
1. Who we are
1.1 FirstNet Technology Services (Pty) Ltd, registration number 2006/031608/07, is the responsible party for the personal information described in this notice. We are a wholly owned subsidiary of the First Technology Group. Our FirstCoreAI business unit is part of FirstNet.
1.2 Registered address: 26 Augrabies Road, Waterfall Office Park, Midrand, 1686. Our Durban office is at 11 Richefond Circle, Umhlanga Ridge, 4319. Phone: 0861 989 896.
1.3 Information Officer: Vaughan Gerson (Managing Director). You can contact the Information Officer by email to privacy@firstnet.co.za, or by post or hand delivery to the registered address above.
2. When this notice does not apply
2.1 When we provide services to a customer, we often process personal information on the customer's behalf: for example files stored in our cloud, email passing through our security services, call recordings, guest Wi-Fi sign-ups at a customer's venue, or prompts sent to our AI services. In those cases the customer is the responsible party and we act as its operator under our Data Processing Annexure. The customer's own privacy notice tells you how your information is used, and you should direct requests to the customer. We will help the customer respond.
2.2 Managed Guest Wi-Fi: if you sign in to a guest Wi-Fi network at a shop, hotel, office or other venue that uses FirstNet's Managed Guest Wi-Fi, the venue decides what information is collected, what you consent to and how it is used, and the login page shows the venue's terms and privacy notice. FirstNet and the platform provider process that information for the venue. We do not use guest Wi-Fi data for our own marketing.
3. Information we collect
3.1 Customers and their contact persons: names, job titles, business contact details, identity or registration numbers, VAT numbers, billing and banking details, credit vetting results, service and site details, contract and order history, support tickets and correspondence, and account credentials for our portals.
3.2 SIM card and mobile data users: the information that the Regulation of Interception of Communications and Provision of Communication-related Information Act 70 of 2002 ("RICA") requires us or the mobile network operator to collect before activating a SIM card, such as name, identity or passport number and address.
3.3 Network and service information: IP addresses assigned to you, connection logs, usage volumes, call detail records (numbers called, date, time and duration), device identifiers and fault information. We process this to provide, bill and secure our services and as required by law.
3.4 Call recordings: where we record calls to or from our sales, support or escalation lines (for quality, training, dispute resolution and security), you will be told at the start of the call.
3.5 Website visitors: when you send us an enquiry, quote request, LEO satellite quote request or reseller application through our website, we collect the details you enter (such as name, company, business email, phone and message). See section 9 for cookies and analytics.
3.6 "Ask FirstNet" assistant: when you type a question into the website assistant, the question is sent to our AI service, which runs in FirstNet's South African data centre, to generate an answer from our published website content. We keep the text of your question for up to 90 days to improve our website and its answers; email addresses and phone or other identifying numbers are removed before it is stored, and we do not store the answers or link questions to you. We temporarily keep your IP address in server memory only to limit the number of questions per minute and per day; it is not written to disk and is cleared when it is no longer needed for that purpose. Please do not type personal information into the assistant.
3.6A Knowledge Hub search: when you search the Knowledge Hub, we keep the words you searched for and how many answers were found, for up to 90 days, so that we can add the answers people look for. Email addresses and phone or other identifying numbers are removed first, and we do not store your IP address or anything that links a search to you.
3.6B Continue on WhatsApp: if you tap "Continue on WhatsApp" in the assistant, the chat so far is passed to FirstNet Pulse, FirstNet's official WhatsApp, so it can carry on where you left off. From then on it is kept like any WhatsApp conversation with FirstNet (see section 6). If you choose "Leave my details" instead, the details you enter are handled like any other enquiry to our sales team.
3.7 Visitors to our offices and data centres: name, identity number, company, vehicle registration, time of entry and exit, CCTV footage and, for data centre access, biometric data (such as facial or fingerprint recognition) used for access control.
3.8 Suppliers, resellers and partners: business contact details, company information, B-BBEE status, banking and tax details, and contract information.
3.9 Job applicants: CVs and information you give us when applying for a position with FirstNet. Where another First Technology Group company handles your application, its privacy notice also applies.
3.10 We collect most information directly from you or your organisation. We also receive information from credit bureaux, the mobile network operators and fibre network operators we use, our Vendors, public registers (such as CIPC), and people who refer you to us.
4. Why we use it and our lawful basis
| Purpose | Lawful basis under POPIA section 11 |
|---|---|
| Quoting, concluding and performing contracts, installing and supporting services, billing and collecting payment | Necessary to conclude or perform a contract (s11(1)(b)) |
| Credit vetting before providing services on credit terms | Legitimate interest (s11(1)(f)) and, where required, consent |
| RICA registration, keeping communication-related information, responding to lawful interception directions | Legal obligation (s11(1)(c)) |
| ICASA reporting, tax, VAT and company records, B-BBEE reporting | Legal obligation (s11(1)(c)) |
| Network and information security, fraud and abuse prevention, enforcing our Acceptable Use Policy | Legitimate interest (s11(1)(f)) and legal obligation |
| Physical security and access control at our premises and data centres (including CCTV and biometrics) | Legitimate interest (s11(1)(f)); for biometrics, the grounds in sections 27 and 33 of POPIA |
| Responding to enquiries, complaints and requests | Legitimate interest (s11(1)(f)) or steps at your request before a contract (s11(1)(b)) |
| Website analytics (see section 9) | Legitimate interest (s11(1)(f)) |
| Direct marketing (see section 8) | Consent, or existing customer exception under section 69(3) |
| Improving our services, training our staff and quality assurance | Legitimate interest (s11(1)(f)) |
| Legal claims and disputes | Legitimate interest (s11(1)(f)) |
We will not use your personal information for a purpose that is incompatible with the purpose for which we collected it (section 15 of POPIA).
5. Who we share it with
5.1 We share personal information only as needed for the purposes above, with:
5.1.1 other companies in the First Technology Group that provide shared services to us (such as finance, HR and IT), under confidentiality and data protection obligations;
5.1.2 our operators and suppliers, such as data centre operators, fibre and mobile network operators, cloud and software providers, payment and debit order processors, debt collectors, auditors and professional advisers, who must protect it under written agreements;
5.1.3 the Vendor of a product you order, where the Vendor needs it to provide or license the product (for example to create your licence or account);
5.1.4 credit bureaux, for credit vetting and, where you do not pay, for reporting as allowed by the National Credit Act 34 of 2005;
5.1.5 regulators, law enforcement agencies, courts and other public bodies, where the law requires it, including under RICA, the Cybercrimes Act 19 of 2020 and the Films and Publications Act 65 of 1996; and
5.1.6 a buyer or successor of all or part of our business, under confidentiality obligations.
5.2 We do not sell personal information, and we do not give it to third parties for their own marketing.
5.3 Foreign authorities: we only disclose personal information to a foreign law enforcement agency or court through South African legal processes (such as a mutual legal assistance request or a South African court order), or where South African law otherwise allows it.
6. Where we keep it and cross-border transfers
6.1 We keep personal information in South Africa by default, in our own data centre in Umhlanga and in colocation facilities in South Africa. It goes offshore only where a service provider described in 6.2 processes it outside South Africa.
6.2 Some of our service providers process personal information outside South Africa, for example:
6.2.1 email and office productivity services, where their providers host them outside South Africa;
6.2.2 website analytics (Google Analytics, see section 9); and
6.2.3 customer relationship, ticketing and billing systems, where their providers host them outside South Africa.
These providers process personal information in the locations they publish for their services.
6.3 We transfer personal information outside South Africa only where section 72 of POPIA allows it: where the recipient is bound by law, binding corporate rules or a binding agreement that gives adequate protection; where you have consented; or where the transfer is needed to perform a contract with you or in your interest.
7. How long we keep it
| Information | Retention period |
|---|---|
| Customer contracts, invoices and accounting records | At least the periods required by the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011, and longer if a dispute is open |
| Communication-related information required by RICA | The period prescribed under RICA and the directives issued under it |
| Support tickets and correspondence | For the duration of the customer relationship and for as long afterwards as needed to deal with queries, disputes and legal claims |
| Call recordings (FirstNet's own lines) | Only for as long as needed for the purposes in section 3.4, or longer if needed for a dispute or investigation |
| Website enquiry form submissions | For as long as needed to respond to and follow up on your enquiry, unless you become a customer |
| "Ask FirstNet" assistant | Question text, with identifying details removed, for up to 90 days; IP addresses for rate limiting are kept only in server memory, are not written to disk and are cleared when no longer needed for that purpose |
| Knowledge Hub search terms | Search text, with identifying details removed, for up to 90 days |
| CCTV footage | For a limited period in line with our security procedures, unless needed for an investigation or legal claim |
| Data centre access logs and biometric templates | For as long as needed for access control, security and audit purposes |
| Marketing preferences and opt-outs | For as long as needed to honour your choice |
After the retention period we delete or de-identify the information, unless the law requires us to keep it longer or it is needed for a legal claim.
8. Direct marketing
8.1 We send electronic marketing (email, SMS, WhatsApp or automated calls) only:
8.1.1 to existing customers, about our own similar products and services, where we obtained your contact details in the context of a sale and you were given the chance to object when we collected them; or
8.1.2 to other people, only with their prior consent, as required by section 69 of POPIA. We will ask for consent only once, in the form prescribed by the POPIA regulations.
8.2 Every marketing message tells you who it is from and how to opt out, free of charge. You can also opt out at any time by emailing privacy@firstnet.co.za, or by using the unsubscribe link.
8.3 We do not use guest Wi-Fi data, customer data we hold as an operator, or AI service Inputs for our own marketing.
9. Cookies, analytics and similar technologies
9.1 Our website uses a small number of cookies and similar technologies:
| Name or type | Provider | Purpose | Duration |
|---|---|---|---|
| Google Analytics 4 cookies (such as `_ga` and `_ga_<ID>`) | Measure how visitors use the site (pages viewed, time on page, approximate location from IP, device and browser type) so we can improve it | As set in Google Analytics (Google's default is up to 2 years) | |
| Google Tag Manager | Loads the analytics script; does not set its own cookies | n/a | |
| `fn-hero-story` (cookie) | FirstNet | Remembers which homepage story you last saw so the next visit shows a different one; contains no personal information | 1 year |
| `fn-hero-la-<division>` (browser local storage) | FirstNet | Remembers which headline caption was last shown for each division so the next visit shows a different one; contains no personal information | Until you clear your browser storage |
| Admin and portal session cookies | FirstNet | Keep authorised users signed in to the content management system or customer portals; strictly necessary | Session or as stated on sign-in |
9.2 We do not use the analytics information to identify you.
9.3 Google processes Google Analytics data under its own terms. You can read how Google uses information from sites that use its services at https://policies.google.com/technologies/partner-sites, and you can stop Google Analytics from collecting your data by installing the browser add-on at https://tools.google.com/dlpage/gaoptout. You can also block or delete cookies in your browser settings; the site still works without them.
10. How we protect it
10.1 FirstNet's information security management system is certified to ISO/IEC 27001:2022 by INTERCERT (certificate IC-IS-2512139). We use access controls, multi-factor authentication for administrative access, encryption in transit, network segmentation, monitoring, staff training and secure disposal, and we bind our operators to written security obligations.
10.2 If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as required by section 22 of POPIA.
11. Your rights
11.1 Under POPIA you have the right to:
11.1.1 ask whether we hold personal information about you, free of charge, and ask for a copy or description of it (section 23); requests for records are dealt with under our PAIA Manual, which sets out the process and any prescribed fee;
11.1.2 ask us to correct or delete personal information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or that we are no longer authorised to keep (section 24), using Form 2 of the POPIA regulations or by email;
11.1.3 object to processing based on legitimate interest, on reasonable grounds, and object at any time to direct marketing (section 11(3)), using Form 1 of the POPIA regulations or by email;
11.1.4 withdraw consent you have given, without affecting processing before the withdrawal;
11.1.5 not be subject to a decision based solely on automated processing that has legal or similarly significant effects for you, except as allowed by section 71; and
11.1.6 complain to the Information Regulator.
11.2 Send requests to the Information Officer by email to privacy@firstnet.co.za, or by post or hand delivery to the address in section 1. We may need to verify your identity before acting on a request. We will respond within a reasonable time, and within 30 (thirty) days for requests for records under PAIA.
12. Complaints
12.1 Please contact our Information Officer first, so that we can try to resolve your concern.
12.2 You may lodge a complaint with the Information Regulator (South Africa):
12.2.1 website: https://inforegulator.org.za;
12.2.2 POPIA complaints: POPIAComplaints@inforegulator.org.za;
12.2.3 general enquiries: enquiries@inforegulator.org.za;
12.2.4 telephone: 010 023 5200;
12.2.5 address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191.
(Contact details checked on the Regulator's website on 13 October 2026. Please check the website for the latest details.)
13. Children
13.1 Our services are sold to businesses and are not directed at children. We do not knowingly collect personal information about children, except where a customer's use of a service involves it, in which case the customer is the responsible party.
14. Changes to this notice
14.1 We will update this notice when our processing changes or the law requires it. The current version is always on our website, with its version number and effective date. If a change materially affects how we use personal information we already hold, we will tell affected customers directly.
Privacy Notice | Version v2026.10c | Effective date: 1 November 2026
Published by FirstNet Technology Services (Pty) Ltd (registration number 2006/031608/07), 26 Augrabies Road, Waterfall Office Park, Midrand, 1686 | 0861 989 896 | support@firstnet.co.za | Privacy: privacy@firstnet.co.za