Privacy Policy

This policy explains how Lightning IP Pty Ltd ABN 41 649 028 240 of Level 1, 561 Olive Street, Albury NSW 2640 collects, uses, discloses, stores, secures and destroys your Personal Information. It forms part of Section D of this Agreement and applies to Consumer Customers, Business Customers, the people who use a Service we supply, people who apply for a Service, and visitors to lightningip.com.au.

Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true and whether or not it is recorded in a material form. It includes information we hold about an account holder, an authorised representative, and a nominated contact on an account.

We handle Personal Information in accordance with:

(a) the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We apply the APPs in full. We do not rely on the small business exemption in the Privacy Act 1988 (Cth) — that exemption is not available to us, because we are subject to the data retention obligations in Part 5-1A of the Telecommunications (Interception and Access) Act 1979 (Cth); (b) Part IIIA of the Privacy Act 1988 (Cth) and the Privacy (Credit Reporting) Code, which govern credit-related information; (c) the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth); (d) Part 13 of the Telecommunications Act 1997 (Cth), which places extra restrictions on what a carriage service provider may do with information about a customer and their use of a Service, on top of the APPs; and (e) the privacy obligations in the applicable ACMA-registered industry codes and standards, including the industry code for the Integrated Public Number Database (C555:2024).

The current version of this policy is always published at lightningip.com.au, and we will give you a copy on request at no charge. We review it from time to time. If we change it in a way that materially affects how we handle your Personal Information, we will tell you in accordance with the Changes we may make to this Agreement clause in Section A. Section A also contains a short overview of privacy; this policy is the detail, and if the two differ, this policy governs how we handle your Personal Information.

What we collect depends on the Service you have and how you deal with us. It generally includes:

(a) account and identity information — your name, date of birth, service address, postal address, email address, phone numbers, and the identification we sight to verify who you are (including before a high-risk transaction such as a SIM swap, a number port or a change of account holder); (b) business information — if you are a Business Customer, your ABN or ACN, trading name, and the names and contact details of your authorised representatives; (c) billing and payment information — your plan, your Charges, invoices, payments, payment method details, arrears, and any arrangement we make with you (including an arrangement under our Financial Hardship Policy); (d) credit information — information used to assess an application for credit or an increase in a credit limit, and information about your repayment history, as described in the Credit reporting clause; (e) usage and service information — records of your use of a Service, including call and message records, the numbers and network addresses you connect to, the date, time and duration of a connection, data volumes, and the identifiers associated with your Service or Equipment (such as a SIM, IMEI or connection identifier); (f) network information about where a Service is used — for a mobile Service, the cell sites your device connects to, and for a fixed Service, the address and network identifiers of your connection. Information of this kind can indicate the general area in which a Service is being used; (g) support and interaction information — your enquiries, orders, appointments, faults, complaints, correspondence, the notes our staff make, and recordings or transcripts of calls where we have told you the call is being recorded; and (h) website information — as described in the Cookies and analytics on our website clause.

We collect this information so we can supply, connect, change, maintain, bill and support your Service; verify who you are and protect your account from takeover; assess and manage credit risk and recover what you owe; handle faults and complaints; detect and prevent fraud, scams and misuse; improve our Services; and meet our obligations under the law and under the applicable industry codes and standards.

We only collect what we reasonably need for those purposes. You can deal with us anonymously or under a pseudonym for a general enquiry, but we cannot supply, change or troubleshoot a Service without knowing who you are, and in some cases the law requires us to identify you. If you choose not to give us information we reasonably need, we may not be able to supply a Service, make a change, or complete your request — and we will tell you if that is the case.

We collect Personal Information:

(a) directly from you — when you apply for a Service, speak or write to us, use our website, or contact us about an order, a fault, an account or a complaint; (b) from someone acting for you — an authorised representative, an account contact, an advocate, a financial counsellor or an interpreter you have asked to deal with us on your behalf; (c) from our Suppliers and their agents and contractors — including nbn, the operator of the mobile network we resell, and our wholesale aggregator — who give us the information needed to qualify, order, connect, test, fix and disconnect a Service (for example a service qualification result for your address, an appointment outcome, or a fault test result); (d) automatically, through your use of a Service — our systems, and our Suppliers' networks and systems, generate records of your use of the Service as it is delivered. This happens as a normal part of supplying a carriage service and it cannot be switched off; (e) from other carriers and carriage service providers — for example when you port a number to or from us, when a fault crosses more than one network, or when we investigate suspected fraud or misuse; (f) from credit reporting bodies, other credit providers and our collection agents, as described in the Credit reporting clause; (g) from installers, technicians, cablers, dealers and agents who deal with you on our behalf; and (h) from publicly available sources, and from a person who tells us about a problem with a Service (for example someone reporting an unwelcome communication).

Where it is reasonable and practicable, we collect Personal Information about you from you rather than from someone else. If we receive Personal Information about you that we did not ask for and did not need, we will destroy it or de-identify it where it is lawful and reasonable to do so.

APP 5 requires us to tell you certain things when we collect Personal Information about you. So, at or before the time we collect it, or as soon as practicable afterwards, we take reasonable steps to make sure you know:

(a) who we are and how to contact us; (b) that we have collected the information, and the circumstances and purposes of the collection; (c) whether the collection is required or authorised by law, and if so, which law; (d) the main consequences for you if we do not collect it; (e) the types of organisations we usually disclose that kind of information to; (f) that this policy explains how you can access or correct your information, and how to complain about a privacy issue, and where to find this policy; and (g) whether we are likely to disclose the information to an overseas recipient and, where we can practicably say so, the countries involved.

This policy is our standard collection notice and covers most of what we collect. Where a particular collection needs more explanation, we will tell you at the time — for example before we obtain a credit report, before we record a call, or where a Supplier needs information about you to attend your premises.

We use your Personal Information for the purposes for which it was collected, for related purposes you would reasonably expect, for any purpose you have consented to, and where the law requires or authorises us to. In practice, that means using it to:

(a) assess your application, verify your identity, and set up and manage your account; (b) qualify, order, provision, connect, change, relocate, restore, test and disconnect a Service; (c) bill you, take payment, and manage arrears, hardship arrangements and debt recovery; (d) provide support, diagnose and repair faults, and handle enquiries and complaints; (e) manage credit risk, and detect, investigate and prevent fraud, scams, unauthorised account changes, misuse of a Service, and threats to the security or integrity of a network — including to meet our obligations under Part 14 of the Telecommunications Act 1997 (Cth) and under the industry code for reducing scam calls and scam SMS (C661:2022); (f) contact you about your Service and your account — including outages, planned works, appointments, billing, a change to this Agreement, and anything else we are required to tell you; (g) understand how our Services are used, and improve and develop our Services, our network arrangements and our support. We use aggregated or de-identified information for this wherever we reasonably can; and (h) comply with the law, an applicable industry code or standard, or a lawful request from a court, regulator or government agency.

We use your Personal Information for marketing only as described in the Direct marketing and how to opt out clause. We do not sell your Personal Information, and we do not disclose it to another organisation for that organisation's own marketing purposes.

We disclose Personal Information only where it is necessary for a purpose described in this policy, and only to the extent necessary. The kinds of organisations we disclose it to are:

(a) our Suppliers and their agents and contractors — including nbn, the operator of the mobile network we resell, and our wholesale aggregator — so a Service can be qualified, ordered, connected, tested, maintained, disconnected or investigated. See the Our network and our Suppliers section of Section C; (b) other carriers and carriage service providers — to port a number to or from us, to route traffic, to work a fault that crosses networks, and to prevent, detect and investigate fraud and misuse; (c) installers, technicians, cablers and field contractors who attend your premises; (d) the Integrated Public Number Database (IPND) — we are required to provide and keep current the customer and service information for each public number we supply, in the manner set out in the IPND industry code (C555:2024). IPND data is used only for purposes permitted by law, which include delivery of the emergency call service, directory assistance and directory publication (unless your number is unlisted), law enforcement and national security, and approved research. See the Phone numbers and public identifiers section of Section C; (e) emergency service organisations and the emergency call person — including information about your Service and about the location from which an emergency call was made. See the Emergency call services section of Section C; (f) credit reporting bodies, other credit providers, and our debt collection agents and legal advisers, as described in the Credit reporting clause; (g) the service providers who help us run our business — including our IT, hosting, billing, provisioning, payment processing, customer support, printing, mail and archiving providers — under contracts that require them to protect your information, use it only for us, and tell us about any suspected breach; (h) law enforcement, national security and other government agencies, courts and tribunals — where the disclosure is required or authorised by law or by a warrant or authorisation, as described in the Information we must keep, and what we must give to agencies clause and the Security, interception and lawful assistance section of Section C; (i) the TIO, the Office of the Australian Information Commissioner (OAIC), the ACMA and other regulators — where the information is needed to deal with a complaint or an inquiry about you or about us; (j) your authorised representative, advocate, financial counsellor or interpreter, where you have authorised it; and (k) a purchaser or proposed purchaser of our business, or of a book of accounts, where the disclosure is necessary for the transaction and the recipient is required to handle your information consistently with this policy and the Privacy Act 1988 (Cth).

We do not disclose the content of a communication, or information about a communication, except where an exception in Part 13 of the Telecommunications Act 1997 (Cth) applies. Where the law prohibits us from telling you that a disclosure has been made — for example a disclosure under a warrant — we will not tell you.

If you apply for a Service on credit, or ask us to increase a credit limit, we may:

(a) obtain a credit report about you from a credit reporting body, and use it to assess your application and to verify your identity; (b) disclose to a credit reporting body identification information about you, the fact that you have applied for credit and the amount, the fact that we are a credit provider to you, the type and term of the credit, and (where the law allows) information about your repayment history; (c) disclose to a credit reporting body that a payment has become overdue and is a default, but only where the amount and the age of the overdue payment meet the thresholds in Part IIIA of the Privacy Act 1988 (Cth) and we have given you the written notices Part IIIA requires; and (d) disclose credit information to another credit provider who is assessing an application from you, or to our debt collection agents and legal advisers.

We handle credit-related information in accordance with Part IIIA of the Privacy Act 1988 (Cth) and the Privacy (Credit Reporting) Code. Our credit reporting statement — which names the credit reporting bodies we use, gives their contact details, and tells you how to get their policies about managing credit information — is published at lightningip.com.au and we will give you a copy on request.

You have the right to:

(a) ask a credit reporting body not to use your credit reporting information to pre-screen you for a direct marketing offer; (b) ask a credit reporting body not to use or disclose your credit reporting information if you believe you have been, or are at risk of being, a victim of fraud; (c) ask us or a credit reporting body to correct credit information that is inaccurate, out of date, incomplete, irrelevant or misleading, at no charge; and (d) complain to us about how we have handled your credit information, and then to the TIO or the OAIC — see the Privacy complaints and how to raise them clause.

We will not report a default against you, and we will not sell or assign your debt, while you are participating in and meeting the terms of an arrangement under our Financial Hardship Policy.

Under Part 5-1A of the Telecommunications (Interception and Access) Act 1979 (Cth) we are required to keep certain records about your use of a Service for two years. This is often called metadata. It includes information about the subscriber and the account, and, for each communication, information such as its source and destination, the date, time and duration, the type of service and equipment used, and the location of the equipment at the start and end of the communication. It does not include the content of a communication, and we are not required to keep, and do not keep for this purpose, a record of the web addresses you visit.

Because this obligation is imposed on us by law, and not by choice:

(a) we must keep this data for the full retention period even if you ask us to delete it, and even after you stop being a customer; and (b) we cannot agree to a request to destroy it early. This is the one part of your information that a deletion request cannot reach.

We must also disclose information about you, including retained data, where we are required or authorised to do so by law — for example under a warrant, an authorisation under the Telecommunications (Interception and Access) Act 1979 (Cth), a court order, or another exception in Part 13 of the Telecommunications Act 1997 (Cth). When we receive a request of that kind we check that it is lawful and properly made, we disclose only what the request covers, and we keep a record of what we disclosed and to whom. We are frequently prohibited by law from telling you that a disclosure has been made. See the Security, interception and lawful assistance section of Section C.

Apart from obligations of this kind, we keep your Personal Information only for as long as we need it — see the How we secure your information, and how long we keep it clause.

We may use your Personal Information to tell you about our Services, plans, offers and changes we think will be relevant to you, by phone, SMS, email, post, or through our website. We do this in accordance with APP 7, the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth).

Every commercial electronic message we send will identify us, tell you how to contact us, and include a functional and easy way to unsubscribe, and we will action an unsubscribe promptly. You can also opt out at any time by calling us on 1300 994 884 or through the contact channels at lightningip.com.au, and you can tell us which channels you are happy to hear from us on rather than opting out of all of them.

If you opt out, we will still contact you about your Service and your account — for example about a fault, an outage, planned works, an appointment, your bill, a change to this Agreement, or anything else we are required to tell you. Those are service messages, not marketing, and you cannot opt out of them while you have a Service with us.

If you ask us to tell you the source of a marketing approach, we will tell you within a reasonable time unless it is impracticable or unreasonable to do so. Marketing that refers to a Supplier's underlying network is also subject to that Supplier's approval requirements before we publish it. For more detail on how we market, what consent we rely on, and how we maintain our do-not-contact lists, see our Marketing Communications Policy.

Some of the service providers who help us run our business — and some of our Suppliers' service providers — store data, or access data from, outside Australia. This is most common for cloud hosting, software, security and support services.

Before we disclose Personal Information to an overseas recipient, we take reasonable steps to ensure the recipient does not breach the APPs in relation to it. Those steps include contractual obligations requiring the recipient to protect the information, to use and disclose it only for the purposes we permit, to comply with the APPs or an equivalent standard, and to notify us of any actual or suspected breach. Where APP 8 makes us accountable for an act or practice of an overseas recipient, we accept that accountability — we do not ask you to release us from it.

We will tell you which countries your Personal Information is likely to be disclosed to if you ask us, and we will identify them in a collection notice where we can practicably do so. We do not disclose Personal Information overseas for direct marketing.

As APP 11 requires, we take reasonable steps to protect Personal Information from misuse, interference and loss, and from unauthorised access, modification and disclosure. Those steps include:

(a) access controls, so our people and our providers can only reach the information they need to do their job; (b) identity verification and additional authentication before we make a high-risk change to an account — for example a SIM swap, a number port, a change of account holder, or a change to your contact details; (c) encryption of information in transit, and of stored information where that is appropriate to its sensitivity; (d) contractual and technical security requirements on the providers who handle information for us; (e) privacy and information security training for our staff, including how to recognise social engineering; and (f) logging and monitoring, so we can detect and investigate unusual access.

No system is completely secure. You can help protect your account by keeping your account credentials, PINs, one-time codes and porting authorisations confidential, and by telling us straight away if you think someone else has obtained them or is trying to take over your Service.

We keep Personal Information only for as long as we need it for a purpose described in this policy, or for as long as the law requires us to keep it — including the two-year retention period described in the Information we must keep, and what we must give to agencies clause, and record-keeping periods under tax law, the Telecommunications Act 1997 (Cth) and the applicable industry codes and standards. When we no longer need information and no law requires us to keep it, we destroy it or de-identify it. Detailed usage records are only available for the period we retain them, so if you need a copy, ask us sooner rather than later.

We maintain a data breach response plan. If we suspect a data breach involving Personal Information we hold, we will act to contain it, assess what happened and who is affected, and take steps to reduce the risk of harm.

If we form the view that there has been an eligible data breach under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) — unauthorised access to, unauthorised disclosure of, or loss of Personal Information that is likely to result in serious harm to an affected individual — we will notify the affected individuals and the OAIC as soon as practicable. Where we only suspect an eligible data breach, we will complete our assessment within 30 days of becoming aware of the grounds for suspicion.

Our notification will tell you what happened, when, what kinds of information were involved, what we are doing in response, and what we recommend you do to protect yourself.

If a breach occurs at one of our Suppliers or service providers, we will work with them to make sure affected customers are notified, and we will tell you what we know as soon as we are able to. Where your Service or your identity may be at risk, we will also tell you what protective measures we can apply to your account — for example adding extra verification before any change can be made, or placing a hold on porting.

Under APP 12 and APP 13 you can ask us for access to the Personal Information we hold about you, and you can ask us to correct it.

To make a request, call us on 1300 994 884 or use the contact channels at lightningip.com.au. Tell us what information you are after — for example a copy of the usage records for a period, the notes on a fault, or your billing history — because that usually gets you the right thing faster. You will need to verify your identity: we will not release information about an account to a person we cannot confirm is entitled to it.

We will acknowledge your request promptly and respond within 30 days. There is no charge for making a request, and no charge for a correction. We may charge a reasonable, cost-based fee for giving access where a request is unusually large or complex; if a fee applies we will tell you what it is and get your agreement before we do the work. We will give you access in the form you ask for where it is reasonable and practicable to do so.

The Privacy Act 1988 (Cth) allows us to refuse access or correction in limited situations — for example where giving access would have an unreasonable impact on another person's privacy, would prejudice an investigation of unlawful activity or a law enforcement function, would reveal information relating to a commercially sensitive decision-making process, or where the law requires or authorises us to refuse. If we refuse, we will tell you in writing why (unless it would be unreasonable to give reasons), and how to complain about our decision.

If we correct information that we have already disclosed to another organisation, we will notify that organisation of the correction if you ask us to and it is practicable to do so. If we do not agree that information is inaccurate, you can ask us to attach a statement to the record noting that you believe it is inaccurate, out of date, incomplete, irrelevant or misleading — and we will do that.

When you visit lightningip.com.au, our web server records the technical information your browser sends, including your IP address, the pages you request, the date and time of the request, the page you came from, and information about your browser and device. We use this to keep the site working, keep it secure, and understand which pages people find useful.

We use cookies — small files stored by your browser — for functions such as keeping you signed in, remembering your preferences, and measuring how the site is used with a website analytics tool. Some cookies are set by that analytics tool rather than by us. You can block or delete cookies through your browser settings; if you do, parts of the site may not work properly.

We do not use website information to build an advertising profile about you, we do not sell it, and we do not combine your browsing of our website with the network usage records described in this policy for marketing purposes. Where we can link website information to you as an identifiable individual, we treat it as Personal Information under this policy.

If you think we have mishandled your Personal Information, or breached the APPs, Part IIIA of the Privacy Act 1988 (Cth), the Privacy (Credit Reporting) Code, or Part 13 of the Telecommunications Act 1997 (Cth), please tell us first — we can usually sort it out quickly. Call us on 1300 994 884 or use the contact channels at lightningip.com.au, and let us know you want it treated as a privacy complaint.

We will handle your complaint under our Complaints Handling Policy. We will acknowledge it, investigate it, and give you our response — normally within 30 days. If we need longer, we will tell you why and when you can expect an answer, and we will keep you updated. We will not charge you for making or handling a privacy complaint.

If you are not satisfied with our response, or we do not respond in time, you can take the matter further at no cost:

(a) to the Telecommunications Industry Ombudsman (TIO), a free and independent dispute resolution service, at tio.com.au or on 1800 062 058 — see the The Telecommunications Industry Ombudsman clause of our Complaints Handling Policy; or (b) to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

You can contact the TIO or the OAIC at any time, and you do not have to come to us first — although raising it with us usually gets a faster result. Nothing in this policy limits your rights under the Privacy Act 1988 (Cth) or the Australian Consumer Law.