Draft, not for publication. Items shaded like [GAP: example] are unknown and need a decision or a fact from the controller. This page is hidden from search engines until they are closed. It has not been reviewed by a data protection adviser.

Privacy notice

How we handle your data

Applies to the Digital Sovereignty Audit website and the free Exposure Snapshot. Effective [GAP: date of publication].

This notice explains what personal data we collect when you request an Exposure Snapshot, why, who else handles it, how long we keep it and what your rights are. It follows the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

• Controller: Concept Informatics Ltd, company number 03893221, which provides Digital Sovereignty Audit.
• Registered office: [GAP: registered office address]
• Privacy contact: [GAP: privacy contact email address]
• ICO registration: [GAP: ICO registration number, or confirmation that the company is exempt]
• Data protection officer: none appointed. [GAP: confirm none is required]

2. What we collect

• Your organisation's domain and your work email address, which you type into the form.
• Your marketing choice (ticked or not) and the time you made it.
• The time of your request and, once you open the link, the time you confirmed it.
• The report we generate for your domain. It is built from public data only: the domain's email (MX) and name server (NS) records and the third-party hosts its home page loads. It contains no personal data beyond what such public records may hold.
• A one-way hash of your link, so we can recognise it. We do not keep the link itself.
• Your IP address, used briefly to limit abuse. Our application keeps it in memory only and does not write it to the database. Our hosting and security providers may record it in their own logs (section 5). [GAP: state the log retention period of each provider once known]
• Bot-protection signals. The form uses Cloudflare Turnstile, which assesses your browser to tell people from bots. [GAP: confirm Turnstile is enabled before publishing this line, and check what Cloudflare collects under its terms]

We do not use cookies, advertising trackers or analytics on this site, and the email we send contains no tracking pixel. [GAP: confirm after the SES configuration set is created with open and click tracking off]

3. Why we use it and our legal basis

• To send you the report you asked for and to run the scan. Legal basis: legitimate interests, in providing a service you requested (Article 6(1)(f)). [GAP: confirm the basis with an adviser; steps at your request before a contract (Article 6(1)(b)) is the alternative]
• To keep the service secure and prevent abuse, including rate limits and bot protection. Legal basis: legitimate interests.
• To contact you about Digital Sovereignty Audit services, only if you ticked the optional box. Legal basis: your consent (Article 6(1)(a)) and PECR. You can withdraw it at any time. The report does not depend on it. [GAP: confirm the PECR position for corporate subscribers with an adviser, as the specification already notes]

We require an email address on the domain you are checking so that a report goes to the organisation it describes. We do not make decisions about you by automated means.

4. Scanning your domain

When you first open your link, our servers make a small number of ordinary public requests to the domain you named: DNS lookups and one request for its home page. We do not log in to anything or probe for weaknesses.

5. Who handles your data for us

We do not sell personal data. These providers process it on our behalf. Cloudflare, Amazon Web Services and Railway are US companies. Supabase contracts through a Singapore company, with a US group company providing support. We say so because this service is about exactly that kind of dependency. See also Digital Sovereignty Audit applied to ourselves.

We may also disclose data where the law requires it. [GAP: confirm data processing terms are in place with all four providers]

6. Transfers outside the UK

Data is stored in the EU (Frankfurt) and processed on EU infrastructure where the table says so. Each provider is a US company or has a US group company, and may process or access data in the United States, for example for support or security. [GAP: name the transfer safeguard for each provider (UK-US data bridge certification, or the International Data Transfer Agreement or Addendum), from their data processing terms]

7. How long we keep it

• Requests you never confirm: deleted after 7 days.
• Confirmed reports: available through your link for 30 days from first opening, then the whole record, including your email address and your marketing choice, is deleted. [GAP: remove this marker once the retention job is deployed and has run]
• If you ticked the marketing box: until you withdraw consent or [GAP: maximum period, for example 24 months from last contact].
• Provider logs: [GAP: retention periods from each provider]

8. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict its use, or send it to you in a usable format. You can object to processing based on legitimate interests, and you can withdraw consent at any time. To use any of these, write to [GAP: privacy contact email address]. Until there is a self-service option on the report page, deletion requests are handled by hand. We aim to reply within one month.

9. Cookies

We set none and store nothing on your device. If Turnstile needs to store anything in your browser to work, we will say so here. [GAP: verify in a browser once Turnstile is live]

10. How we protect it

Data is encrypted in transit. The database is reached only by our application, and your link itself is never stored. Your link carries its secret in the part of the address that browsers do not send to servers, and the report page sends no referrer. No system is perfectly secure, and we will tell you and the ICO about a breach as the law requires.

11. Complaints

Please contact us first so we can put things right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

12. Changes

If we change this notice we will update the date at the top, and tell you directly if the change affects how we use data you have already given us.

This notice is not legal advice.