Privacy Policy

HIT Pacific Broadband — IEISI.ORG PTY LTD (ACN 695 032 314)

1. Who we are

HIT Pacific Broadband is a brand of IEISI.ORG PTY LTD (ACN 695 032 314), a Carriage Service Provider registered in Queensland, Australia. We are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

Privacy enquiries and complaints: hello@hitpacific.com.au

2. What personal information we collect

We collect only what is necessary to provide and bill for your service:

• Identity: first name, last name, date of birth
• Contact: email address, mobile number
• Service address: street address, suburb, state, postcode
• Business details (optional): business name, ABN — only if you are signing up as a business customer
• Technical identifiers: IP address, browser user agent — recorded at the time you acknowledge your Critical Information Summary and when OTP verification is completed
• Service data: your NBN service identifiers (AVC ID, NTD ID, wholesale service ID), plan, billing cycle, activation date
• Correspondence: emails, text messages and chat messages you send to us, and the name, phone number or username your chat app shares with us when you message us on Facebook Messenger (or WhatsApp or Telegram, where we offer them)
• Calls: your phone number, the time and length of your call, and any voicemail you leave, when you call us
• Installation contact (optional): the name and phone number of a person you nominate to meet the technician at your premises, which we pass to our wholesale carrier for the installation appointment

We do not collect credit card numbers, bank account numbers, or other payment credentials. These are collected and held directly by our payment processors (see Section 6).

3. How we collect your information

We collect your information directly from you when you:

• Sign up for a service at hitpacific.com.au
• Check an address for NBN service, on our website or by email or chat (we keep the address you checked, the result, and when you checked it)
• Contact us by email, phone, text message or chat (Facebook Messenger, and WhatsApp or Telegram where we offer them)
• Use our website (IP address, browser information via server logs and cookies)

We also receive information from NBN Co and our wholesale carrier in the course of qualifying and provisioning your service — for example, your address serviceability status and NTD details.

4. Why we collect it and how we use it

We use your personal information to:

• Verify your identity and eligibility for service
• Qualify your address for NBN service and determine available plans
• Place and manage your service order with our wholesale carrier
• Issue invoices and collect payment
• Arrange delivery of a router or other hardware you order from us
• Decide how hardware orders are paid, and whether we can offer a new service where earlier bills remain unpaid, using your payment history with us (held in our accounting system and by our payment processors)
• Send you service-related communications (order confirmation, welcome letter, invoices, outage notifications, support responses, and texts replying to your call or message)
• Respond to complaints and enquiries
• Meet our legal and regulatory obligations as a Carriage Service Provider
• Measure the effectiveness of our advertising (see Section 10)

We do not use your personal information for any purpose that is not directly related to providing or improving our service to you.

5. We do not sell your data

We will never sell, rent, or trade your personal information to any third party for their own commercial purposes. Disclosures to third parties (Section 6) are solely for the purpose of delivering your service.

6. Third-party disclosures

To deliver your service, we share personal information with the following third parties. Each operates under its own privacy policy and applicable law.

Leaptel (wholesale carrier) — We transmit your name, service address, and contact details to Leaptel when placing your service order and for ongoing service management. Leaptel processes this data in Australia.

Leader Computers Pty Ltd (hardware supplier) — If you order a router or other hardware from us, we send your name, delivery address (your service address) and phone number to Leader Computers Pty Ltd, an Australian company, so it can send the device to you. Leader passes these details to its courier for delivery. We only send them once your order is paid and ready to ship. You can contact Leader at leadersystems.com.au/contact-us.

Our phone system — Our support line (07 3569 1900) runs on our own phone system at our office in Brisbane. It keeps a record of each call — your phone number, the time and how long it lasted — and any voicemail you leave. Calls reach it over Leaptel's phone network, so Leaptel also handles your phone number and call times when you call us. This data is kept in Australia.

BinaryLane (server hosting) — When we check an address or place and manage your order, our request to Leaptel — or, for a hardware order, to Leader — which can include your name, service address and contact details — passes through a server we rent from BinaryLane in Brisbane. The server passes it on without storing it, and its logs hold no personal information. BinaryLane's privacy policy is at binarylane.com.au/privacy-policy.

NBN Co (network operator) — Your service address and NBN connection identifiers (AVC ID, NTD ID) are passed to NBN Co by our wholesale carrier in the course of provisioning and maintaining your NBN service. HIT Pacific does not transmit data directly to NBN Co; this disclosure occurs through our wholesale carrier. NBN Co's privacy policy is at nbnco.com.au/privacy-policy.

GoCardless (payment processing) — Where you choose direct debit (BECS) via GoCardless, your name and bank account details are held by GoCardless. GoCardless's privacy policy is at gocardless.com/legal/privacy.

Stripe (payment processing) — Where you pay by card, Apple Pay, Google Pay or PayTo, your name and email address are passed to Stripe to process payment. Stripe collects and stores your card or bank account details directly, and may process them outside Australia, including in the United States. We do not receive or store your card or bank account numbers. Stripe also checks each payment for fraud using automated screening (Stripe Radar), which can decline a payment that looks fraudulent; no person at HIT Pacific makes that decision. If a payment is declined, you can pay by PayID, BECS Direct Debit or Wise instead, or call us on 07 3569 1900 and we'll help. Stripe's privacy policy is at stripe.com/au/privacy.

Wise (payment processing) — Where you choose Wise, your name and email address are passed to Wise to process payment. Wise collects and stores your payment and bank account details directly. We do not receive or store your card or bank account numbers. Wise's privacy policy is at wise.com/au/legal/privacy-policy.

Xero (billing and accounting) — Your name, email address, service address, ABN (if provided), and invoice data are held in Xero for billing and accounting purposes. Xero's privacy policy is at xero.com/au/legal/privacy.

Twilio (SMS delivery) — Your mobile number is passed to Twilio to deliver one-time verification codes during sign-up. If you send a text message to our number (0485 019 168), Twilio delivers it to us with your mobile number. We email it to our staff so they can call or email you back; we don’t send an automatic reply. If you have called or texted us, or you are a customer, our staff may send you a text from that number about your enquiry or your service, for example to return a call we missed. A staff member approves every text before it is sent, and we never send marketing texts this way. Reply STOP to any of these texts and our staff won’t text you again; we will still send the messages we are required to send you about your account or service. Twilio keeps a record of each text it receives for us in the same way as the texts it sends. Twilio keeps a record of each text it sends for us: your mobile number, the message (including the code, which expires after 10 minutes), and when it was sent and delivered. Twilio stores these records in the United States. After 30 days they are removed from our working message logs and kept in Twilio's archive for our account until we delete them. Twilio's privacy policy is at twilio.com/en-us/legal/privacy.

Cloudflare (hosting, security, and data storage) — All traffic to hitpacific.com.au is routed through Cloudflare's network. Your account and service data — including sign-up sessions, service records, and support history — is stored in Cloudflare's D1 database platform. Cloudflare also processes connection metadata (IP address, request headers) for security and performance. Data centres may be within or outside Australia. When someone comments on or mentions our Facebook or Instagram pages, the text of that post (up to 500 characters) is processed by Cloudflare Workers AI, using Meta's Llama model running on Cloudflare's network, to sort enquiries about our service from everything else. Cloudflare's privacy policy is at cloudflare.com/privacypolicy.

Resend (email delivery) — The emails we send you — for example verification codes, order confirmations, bills and support replies — are delivered by Resend. Resend receives your email address and the content of each email, and stores data in the United States. Resend's privacy policy is at resend.com/legal/privacy-policy.

Google (address suggestions) — When you type an address into our address checker, on our website or in chat, the text you type is sent from our servers to Google's Places service to suggest matching addresses. Google receives only that text — not your name, contact details or IP address — and may process it outside Australia. Google's privacy policy is at policies.google.com/privacy.

Discord (staff alerts) — Our staff receive operational alerts, such as billing and service-health notices, in Discord, which is based in the United States. These alerts identify customers only by our account number — never by name, contact details or address. The one exception is a fault note from Leaptel about a network outage, which our staff see as Leaptel sent it and which can occasionally mention a street address. Discord's privacy policy is at discord.com/privacy.

Anthropic (AI processing) — When you contact us by email, Facebook Messenger, WhatsApp or Telegram, your inbound message — including your name, email address, phone number or username (as applicable), and the content of your message — is transmitted to Anthropic's API so the AI can sort your enquiry and, for general questions, write a reply (see how we use AI). The AI that reads your message sees only what you sent us and our public plan list; it does not see your account records, billing information or service data. Anthropic does not use customer data submitted via the API to train its models.

Our staff also use Anthropic's AI tools (Claude) to help them look up and update accounts, and to write the texts and emails they send you. When they do, information we hold about you that is relevant to the task — such as your name, contact details (including your mobile number), service address, and service, order, appointment and billing details — may be sent to Anthropic. These tools work only under a staff member's direction, and a person is accountable for every change to your account and every message we send.

Anthropic processes this data in the United States under its privacy policy at anthropic.com/legal/privacy.

Meta (Facebook Messenger and WhatsApp) and Telegram (chat messaging) — When you message us on Facebook Messenger, WhatsApp or Telegram, your message travels through that platform and is handled by it under its own privacy policy: Meta's at facebook.com/privacy/policy (Messenger) and whatsapp.com/legal/privacy-policy (WhatsApp), and Telegram's at telegram.org/privacy. With your message we receive the identifier the platform gives us for you and, depending on the platform, your profile name, phone number (WhatsApp) or username (Telegram). We keep our copy in Cloudflare D1 and delete it as set out in Section 8. Meta and Telegram may process your messages outside Australia, including in the United States.

Meta (advertising measurement) — We use Meta's Conversions API for advertising measurement. When you use our address checker or sign-up flow, a pseudonymised event is sent to Meta containing your IP address, browser user agent, and (where available) your email address in SHA-256 hashed form — not in plain text. This is used to measure how well our advertising reaches people who become customers. No plain-text personal information is transmitted to Meta. Meta's data policy is at facebook.com/privacy/policy.

7. Storage and security

Your personal information is stored with:

• Cloudflare D1 — account data, sign-up sessions, service records, and support history. Data centres may be within or outside Australia. Cloudflare maintains ISO 27001 certification.
• Our phone system, on our own server at our office in Brisbane — call records and voicemail. Data is stored in Australia.
• Twilio — records of sign-up verification texts, texts you send us and texts we send you: your mobile number, the message, and delivery details (see Section 6). Data is stored in the United States.
• Resend — the emails we send you, as they were delivered (see Section 6). Data is stored in the United States.

Billing and invoice data is additionally held by Xero (see Section 6). Payment credentials are held solely by Stripe, GoCardless, or Wise and are never stored by HIT Pacific.

We take reasonable steps to protect your information from misuse, loss, unauthorised access, modification, or disclosure. These include access controls, encrypted connections (HTTPS), and limiting access to personal data to personnel who need it to perform their role.

No internet-based system is completely secure. If you have concerns about the security of information you have provided, contact us at hello@hitpacific.com.au.

8. Data retention

We retain your personal information for as long as necessary to provide your service and meet our legal obligations:

• Active customers: for the duration of your service
• Former customers: for a minimum of 7 years after your service ends, to comply with financial record-keeping obligations under the Corporations Act 2001 and tax law
• Sign-ups you didn't finish: a sign-up stays open for 24 hours. If you don't finish it, your name, contact details, date of birth, addresses, business details and IP address are deleted automatically 3 days after it closes (copies of any emails we sent you are kept as described under "Emails we send you" below). In that time we may send you one short email asking what stopped you. If we've already sent you an invoice, we keep your details until it's paid or cancelled, then delete them 3 days after it's cancelled. If you told us your safety is at risk, we keep the address up to 90 days longer so it stays hidden from our staff's address search. We keep an anonymous record of the plan you chose and how far you got, to understand where sign-ups stop
• Installation contact: the name and phone number of the person you nominate for the installation are deleted 30 days after the installation is complete, or 90 days after a cancelled appointment
• Address checks: the address you checked, the NBN result and when you checked it, kept for 90 days and then deleted automatically. We don't store your name, contact details or IP address with them
• Billing update records: when an invoice changes in Xero, we keep a copy of that invoice (your name, contact details, amounts, payments and line items) so we can check our billing is working correctly. Each copy is deleted automatically after 90 days
• Sign-up payment records: for your first invoice we keep a short record of when it was sent, paid and matched in our accounts (the invoice number, amount and dates, and the payment's transfer number — no bank details), so your service can be set up as soon as your payment arrives. It is deleted 90 days after the invoice is settled or cancelled, and after one year at the latest
• Texts to and from our number: the record Twilio keeps of each text (your mobile number, the message and delivery details) is in our working message logs for 30 days, then kept in Twilio's archive for our account until we delete it; the copy emailed to our staff is kept with our other customer correspondence
• Chat messages (Facebook Messenger, and WhatsApp or Telegram if offered): we delete our copy 30 days after your enquiry is closed, unless the conversation is part of a complaint, a financial hardship arrangement or another matter we are required by law to keep records of; those are kept with that record for at least 2 years. The conversation also stays in your own app and with the platform under its privacy policy
• Hardware orders: your order (devices, prices and dates) is kept with your account like your bills. Delivery updates from our hardware supplier are cleared 90 days after your order is finished
• Support correspondence (email and phone): retained for a minimum of 2 years after the matter is resolved
• Emails we send you: we keep a copy of each email we send you about your sign-up or service (who it went to, when, the subject and the full message), so we can show what we told you. Copies are deleted automatically 2 years after your service ends, or 2 years after we sent them if you didn't become a customer. We don't keep the codes in verification emails

Where retention beyond these periods is required by law or regulation, we will retain the data for that required period only.

9. Law enforcement and regulatory obligations

As a Carriage Service Provider, we are subject to the Telecommunications (Interception and Access) Act 1979 (Cth), which imposes obligations around lawful interception and data retention on certain telecommunications providers.

In our current operating model (wholesale resale), these obligations — including the Interception Capability Plan (ICP) and Data Retention Implementation Plan (DRIP) — are the responsibility of our wholesale carrier as the network operator. We rely on our wholesale carrier to meet these obligations on our behalf at this stage of our operations.

We may be required by law to disclose your personal information to law enforcement agencies, government authorities, or courts in response to a lawful warrant, court order, or other legal process. We will not disclose personal information to any authority without a lawful basis for doing so. Where we are legally permitted to notify you that a disclosure has occurred, we will do so.

10. Website analytics and advertising measurement

Our website uses cookies and tracking tools for the following purposes. Third-party scripts are loaded via Cloudflare Zaraz, which manages them server-side to reduce client-side data exposure.

• Functional cookies: session management for the sign-up flow. These are essential and cannot be disabled without breaking the service.
• Google Analytics 4 (GA4): We use GA4 to understand how visitors use our website — pages visited, time on site, referral source, and general geographic region. GA4 collects pseudonymised identifiers (a client ID stored in a cookie) and IP addresses, which Google truncates before storage. Google's privacy policy is at policies.google.com/privacy. You can opt out of GA4 tracking using the Google Analytics opt-out browser add-on.
• Google Search Console: We use Google Search Console to monitor how our website appears in Google Search results — including search queries that lead to our site, page rankings, and indexing status. Search Console provides aggregated, non-personal data about search performance. It is linked to our GA4 property, giving Google a combined view of search and on-site behaviour at an aggregate level. Individual visitor data is not shared with us through Search Console.
• Advertising measurement (Meta): Meta's Conversions API and the Meta Pixel measure whether people who see our advertising go on to become customers. Data sent to Meta is pseudonymised — email addresses are SHA-256 hashed before transmission; IP addresses and browser user agents are also included. No plain-text personal information is sent. See Section 6 for detail.

11. Your rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct personal information that is inaccurate, out of date, incomplete, or misleading
• Complain about how we have handled your personal information

To exercise any of these rights, contact us at hello@hitpacific.com.au with your account number and a description of your request. We will respond within 30 days.

There is no charge for making an access or correction request. In some limited circumstances the APPs permit us to decline a request — if we do, we will tell you why.

12. Notifiable Data Breaches

We are subject to the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988. If a data breach occurs that is likely to result in serious harm to any individual whose information is involved, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.

13. Privacy complaints

Step 1 — Contact us. Email hello@hitpacific.com.au with a description of your concern. We will acknowledge within 5 business days and aim to resolve within 30 days.

Step 2 — OAIC. If we cannot resolve your complaint, you may lodge a complaint with the Office of the Australian Information Commissioner:

• Website: oaic.gov.au
• Phone: 1300 363 992

14. Changes to this policy

We may update this policy from time to time. Material changes will be notified to current customers by email. The current version is always published at hitpacific.com.au/privacy with its effective date.

15. Contact

Privacy Officer
HIT Pacific Broadband — IEISI.ORG PTY LTD (ACN 695 032 314)
Email: hello@hitpacific.com.au