Status: Draft 0.1 — 5 October 2026. Counsel review is outstanding. This draft is not legal advice and is not published.
Who we are. ISP550 will be operated by the company registered for that purpose. RC number, registered address, and TIN will be inserted after CAC and tax registration. Data protection contact: dpo@isp550.com. The founder is the interim data protection officer until a named appointment replaces that record (dpo-and-dpco.md).
Two roles
| Data | Controller | Processor |
|---|---|---|
| Tenant staff accounts, the contract with ISP550, platform invoices, platform security logs | ISP550 | — |
| Subscriber identity, phone, address, voucher and session data the Tenant stores | The Tenant ISP | ISP550 |
When ISP550 acts as processor, the Tenant's instructions and the DPA govern. This policy explains ISP550's own controller activities and summarises processor safeguards.
Data we handle
Tenant account data (ISP550 as controller). Name, email, phone, role, authentication secrets (hashed), organisation profile, support correspondence, and audit events for staff actions.
Subscriber data (ISP550 as processor). Username, optional name and address, phone number where ISP staff provide it or the subscriber bought before phone collection ended (the captive portal no longer asks for one), ISP-specific Wi-Fi account email and password hash for paid captive-portal purchases, synthetic email used only as a Paystack customer key (p{E.164}@sub.isp550.com, or u{id}@sub.isp550.com where no phone is held, never used as a real mailbox), service status, package, router association, and consent time/source. Phone numbers are stored as AES-256-GCM ciphertext plus an HMAC lookup hash. Wi-Fi account sessions and staff-issued recovery tokens are stored as hashes. Staff see a masked phone number unless they reveal it, and each reveal is logged.
Payments. Amounts in kobo, channel, status, and provider references. Card numbers are never stored. Paystack collects card data.
Router secrets. RADIUS and RouterOS API secrets are encrypted. They are not shown again after creation.
Webhook bodies. Encrypted at rest and purged after 180 days.
Technical data. Request identifiers, IP address, user agent, and error reports (Sentry) with the redaction rules in packages/logger.
Lawful basis
For tenant staff and the contract with ISP550: contract, and legitimate interest in securing the service (fraud, audit, abuse).
For subscriber data: the Tenant must have a lawful basis before the data is entered. The captive portal records consent with version, time, and source. Other bases the Tenant relies on (for example a contract with its own subscriber) stay the Tenant's to document.
ISP550 does not sell personal data.
Sharing
Intended recipients, once those accounts exist:
- Paystack — payment processing in Nigeria.
- Termii, and a fallback SMS provider if enabled — message delivery to numbers the Tenant asks us to message.
- Railway (EU West) — application, Postgres, Redis.
- Hetzner (EU) — WireGuard, FreeRADIUS, and the edge agent.
- Cloudflare — DNS, WAF, and object storage (R2).
- Sentry — error reports. Better Stack — uptime and logs.
- A licensed DPCO — compliance audit, under confidentiality.
Staff of the Tenant see subscriber data according to their role. Support and reseller roles see masked values.
Cross-border transfers
Application data is hosted in the European Union (Railway EU West and Hetzner EU). The transfer record is tia-eu-hosting.md. Nigerian hosting is a later option, not the current design.
Retention
A full retention schedule is Phase 16. Until it is enforced:
- Webhook payloads: 180 days, then delete.
- Tenant account and tax invoices: keep for the life of the contract and for the period counsel confirms Nigerian tax law requires.
- Subscriber data: delete or return on the Tenant's instruction, a completed erasure request, or tenant closure, after backups age out.
- Router secrets: delete with the router record.
Rights
People can ask to access, rectify, erase, object, or receive a copy of their data. Subscribers should ask their ISP first, because the ISP is controller. The ISP may pass the request to dpo@isp550.com. Tenant staff may write to dpo@isp550.com directly. ISP550 will help the Tenant meet NDPA timelines. The complaint regulator is the Nigeria Data Protection Commission (NDPC).
Breaches
ISP550 notifies the Tenant without undue delay after becoming aware of a breach of subscriber data. Where ISP550 is controller, it notifies the NDPC within 72 hours of awareness and notifies affected people without delay when the risk is high. The operational runbook is Phase 11.
Children
The service is for ISPs and their paying subscribers. ISP550 does not knowingly offer accounts to children.
Changes
Material changes to this policy will be versioned. Tenant acceptance of a new version is stored with time and source before it applies.
Contact
dpo@isp550.com · security@isp550.com for incident reports.