GigTel is not a payment processor, payment gateway, or acquirer, does not require payment card information ("Cardholder Data") in order to provide the Services, and does not accept payment card information over the telephone.
Definitions
“Cardholder Data,” “Sensitive Authentication Data” (SAD), “Primary Account Number” (PAN), and “PCI DSS” have the meanings given by the PCI Security Standards Council.
Shared Responsibility
Where a customer, reseller, distributor, or their agents choose to handle Cardholder Data using the Services, each such party is responsible for its own compliance with PCI DSS for its own environment and for how it collects, transmits, or stores Cardholder Data. GigTel is responsible for the security of the communications platform as described in its security commitments and applicable service documentation; it is not responsible for a customer’s handling of Cardholder Data.
Payments Made to GigTel by Card
Where a customer or reseller pays GigTel by payment card, that transaction is processed by Paya or Stripe, and GigTel’s own card acceptance is scoped to SAQ A. GigTel does not store full PAN or Sensitive Authentication Data in the course of accepting such payments.
Telephone Payments and Call Recording
GigTel does not accept payment card information over the telephone. The platform provides manual control to pause and resume call recording. If a customer chooses to use the Services to accept payment card information over the telephone, it is the customer's sole responsibility to use that control to exclude Cardholder Data, including Sensitive Authentication Data such as the card security code, from call recordings, and not to store Sensitive Authentication Data after authorization. GigTel does not monitor call content for Cardholder Data. This capability and the shared responsibility.
Fax and Subservice Providers
Certain features (including eFax) are delivered through subservice providers. GigTel relies on those providers’ independent attestations for their portions of the service.
GigTel’s eFax service is provided through a subservice provider that maintains SOC 2 Type II, HIPAA with BAA, and standard data encryption. Compliance documentation is available on request under NDA.
No Attestation; Documentation
This section describes allocation of responsibility and does not constitute a PCI DSS attestation by GigTel. Customers requiring compliance documentation may request it via their assigned account representative.
add
Canada PIPEDA
Scope. This section applies where GigTel collects, uses, or discloses the personal information of individuals in Canada in the course of providing the Services, in addition to the shared-responsibility terms above.
Governing privacy laws. Personal information of individuals in Canada is handled in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and any applicable provincial privacy laws (for example, Quebec’s Law 25 and the Alberta and British Columbia Personal Information Protection Acts).
Consent to call recording. Where the Services are used to record calls, the customer is responsible for obtaining the knowledge and consent required under applicable Canadian law from all parties to the call.
Access and correction. Individuals in Canada may request access to, or correction of, their personal information held by GigTel by contacting SalesSupport@GigTel.com. Requests will be handled as required by applicable law.
Breach reporting. In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, GigTel will report to the Office of the Privacy Commissioner of Canada (OPC) and notify affected individuals as required by PIPEDA, and will maintain breach records as required. These obligations are in addition to any contractual breach-notification terms in the applicable customer, reseller, or distributor agreement.
Data residency. Certain Service data may be processed or stored in the United States. Where available, Canadian data-residency options may be offered for eligible workflows; contact your account representative for details.
Relationship to other terms. Nothing in this section limits the shared-responsibility allocation above; PIPEDA and provincial-law obligations apply in addition to those terms.