Privacy Notice and Personal Data Protection Policy

1. Scope and controller roles

This Privacy Notice explains how YURIAN TECH LTD processes personal data in connection with JASLYN NET. Depending on the activity, the Company may act as a data controller for account, billing, security and support information, or as a data processor/service provider when an organization uses JASLYN NET to process its customers’ data under that organization’s instructions.

Where you operate an ISP, hotspot, school, business or other organization through JASLYN NET, that organization is generally responsible for deciding why its end-user data is collected and how it is used. The Company processes such customer data primarily to provide the contracted Service and according to the organization’s instructions.

2. Data we may collect

• Identity and account data: name, username, organization, role, contact details and authentication metadata.
• Customer and service data entered by an operator, including subscriber identifiers, package, service status, account balance and operational notes.
• Network and device data, including IP addresses, MAC addresses, router identifiers, session times, traffic counters, device information and connectivity events where the enabled feature requires them.
• Payment and transaction data, including transaction identifiers, amounts, currency, status, timestamps, provider references and reconciliation information. Full payment card or mobile-money credentials are generally handled by the relevant payment provider rather than stored by JASLYN NET unless expressly stated.
• Security and audit data, including login events, administrator actions, API requests, security events, approximate location derived from network data where necessary, and system logs.
• Technical data such as browser, operating system, application version, diagnostic information and cookie identifiers where enabled.

3. Purposes and lawful processing

We process personal data for account administration, authentication, tenant isolation, network operations, customer support, billing and reconciliation, fraud prevention, security monitoring, auditability, incident response, service analytics, product reliability and compliance with legal obligations.

We use the minimum information reasonably necessary for the relevant purpose. Where consent is the appropriate legal basis, we will request it and provide a practical mechanism for withdrawal. Withdrawal of consent does not invalidate processing that was already lawful on another applicable basis or processing required by law or contract.

4. Customer and network data

Network operators may use JASLYN NET to process highly operational information. This can include subscriber identifiers, authentication records, session history, IP allocation, device identifiers, bandwidth or usage measurements and service status. Operators must provide their own lawful notices to subscribers and configure retention and access according to their obligations.

We do not sell personal data. We do not use customer network data for unrelated advertising purposes merely because it is available to the platform.

5. Sharing and disclosures

• Infrastructure and hosting providers that process information on our behalf under contractual safeguards.
• Payment providers where a payment or reconciliation requires their participation.
• Network, messaging, email, SMS, RADIUS or other integrations expressly configured by the customer.
• Professional advisers, auditors, insurers or corporate transaction parties where reasonably necessary and subject to confidentiality obligations.
• Authorities, regulators, courts or law-enforcement bodies where disclosure is required or legally authorized.
• Other parties with the customer’s or data subject’s lawful instruction or consent where applicable.

6. International transfers

JASLYN NET may use infrastructure or service providers located outside the data subject’s country. Where personal data is transferred across borders, the Company will apply the safeguards required by applicable data protection law, including appropriate contractual, technical or regulatory measures where required.

The Company will not intentionally transfer personal data merely to avoid applicable privacy obligations.

7. Security

We use technical and organizational safeguards appropriate to the risk, including access control, tenant isolation, authentication, encryption in transit, protected secret storage, audit logging, rate limiting, secure development practices, backup controls and restricted administrative access. No Internet service can guarantee absolute security, so customers must also secure their credentials, devices, integrations and administrator accounts.

8. Retention

Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, contractual operations, security, accounting, dispute resolution and legal obligations. Different records may have different retention periods. Security and financial records may need to remain available after account closure.

When retention is no longer required, information will be securely deleted, anonymized or otherwise handled in accordance with applicable law and technical constraints.

9. Data subject rights

• Request access to personal data held about you.
• Request correction of inaccurate or incomplete information.
• Request deletion where the applicable legal conditions are satisfied.
• Request restriction of certain processing where provided by law.
• Object to direct marketing and certain processing where provided by law.
• Withdraw consent where processing is based on consent.
• Request information about automated decision-making where applicable.
• Lodge a complaint with the Personal Data Protection Commission (PDPC) or another competent authority.

10. Requests and verification

Privacy requests must contain enough information for us to identify the requester and locate the relevant account or organization. We may request reasonable proof of identity or authority to prevent unauthorized disclosure. Where a request is submitted by an organization administrator, we may also verify that the administrator is authorized to act for that organization.

Requests can be made through the official support or privacy channel exposed in JASLYN NET. We will respond within the period required by applicable law, subject to lawful extensions and identity verification.

11. Children

JASLYN NET is primarily an operational business platform and is not designed as a direct-to-child consumer service. Customers must not use the Service to collect children’s personal data unless they have a lawful basis, appropriate safeguards and any required parental or guardian authorization.

12. Breach response

If the Company determines that a personal data incident has occurred, it will investigate, contain, document and remediate the incident and make notifications required by applicable law. Customers must promptly report suspected breaches involving their accounts or data so that coordinated response can begin.

13. Regulatory framework

For Tanzania-related processing, this Notice is designed with reference to the Personal Data Protection Act, 2022 and applicable regulations and guidance issued by the Personal Data Protection Commission. The Act establishes minimum requirements for collection and processing and recognizes rights and duties for data controllers, processors and data subjects.

Nothing in this Notice removes a right or protection that cannot lawfully be excluded.