Privacy policy
Effective Date: | Last updated:
Who this covers, and who it does not
This policy is about the personal data S-DATA Inc. handles as a result of you visiting this website or sending us an enquiry. We are the controller of that data. You can reach us through the contact form, or by post to the mailing address listed on the about page and in the legal notice.
It does not cover data we process for a client under a contract. When we hold or manage data on a client's behalf, that client is the controller and we act on their instructions under the terms of that agreement. Our whole argument is that an organization should own its own data, and this policy is not the document that governs it.
Sovereign Sports L.L.C., our subsidiary, is the controller for its own website and publishes its own privacy policy. Both companies use the same support desk, so staff of either may read an enquiry in order to answer it.
What we collect
Five things, and nothing else.
What you send us
If you use the contact form: your name, your email address and your message, and your company and phone number if you choose to give them. We ask for what we need to reply. Your message is placed in a queue in our own support desk, and someone replies to the address you give.
Server logs
Our servers record requests, including your IP address, the page requested, the time, and your browser's user agent string. This happens whether or not you accept analytics, because it is how a web server works rather than a choice we layer on top.
We use it for two things: keeping the site available and diagnosing faults, and stopping abuse of the contact form. Our support desk accepts at most 20 messages from one address in an hour and 240 in a day, and the address is how it counts. That is a security measure, not a way of profiling anyone.
The spam check on the contact form
The contact page uses Google reCAPTCHA to tell people from automated spam. It runs in the background and asks you nothing. When the page loads and when you send the form, it sends Google information about your visit, such as your IP address, your browser and how you moved through the page, and Google returns a score that our support desk uses to accept or refuse the message. It runs on the contact page only, and Google's own privacy policy and terms apply to it. See the cookies policy for what it stores.
Analytics, only if you accept
Nothing analytics-related is collected until you accept the banner. If you do, Google Analytics records page views and approximate location derived from your IP address. See the cookies policy for exactly what is set.
Radio survey information
If your organization asks us to run a radio signal survey, we collect what we need to plan and carry it out safely and legally. That is the names, job titles, reporting lines and work contact details of the staff involved, and the answers your colleagues give to the survey questionnaire. Those answers are commercially sensitive to your organization.
We collect this from your organization rather than from you, so you may be in it without having given it to us yourself. It is work contact information, used for the survey and for the services a survey may lead to, and for nothing else. We do not use it for marketing.
Why we are allowed to
| Data | Why | Basis |
|---|---|---|
| Contact form submission | To read your enquiry and reply to it | Your request, and our legitimate interest in answering it |
| Server logs | Availability, fault diagnosis, abuse prevention | Our legitimate interest in a site that works and is not abused |
| The contact form's spam check | To keep automated spam out of our support queue | Our legitimate interest in a contact form that is not abused |
| Analytics | To see which pages are read | Your consent, which you can withdraw at any time |
| Radio survey information | To run a radio signal survey safely and legally, and to provide the services it may lead to | Our legitimate interest, and your organization's, in providing the service it asked for |
Who else sees it
We use Google Cloud to host this site and our support desk, where contact form messages are kept, and to hold survey information. We use Google Workspace to send our replies, Google reCAPTCHA on the contact page, and Google Analytics if you have accepted it. Google processes that data on our behalf as our supplier. Both companies are in the United States, and so is the infrastructure, so your data is handled there.
We do not sell your data. We do not share it with advertisers or data brokers. We do not add you to a marketing list because you asked us a question, and we do not use an enquiry to build a profile of you.
How long we keep it
| Data | Kept for |
|---|---|
| Your enquiry | Kept in our support desk as a record of the enquiry. If it becomes a contract, it is kept under that contract instead. You can ask us to delete it at any time |
| Request logs | About 30 days |
| Administrative and audit logs | Up to 400 days, as our platform retains them |
| Radio survey information | One year, or one year past the end of any contract with your organization to provide a service, whichever is later |
| Analytics | Per Google's retention for the property, if you accepted |
Your rights
Depending on where you live you may have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to object to our using it, to receive it in a portable form, and to withdraw consent you have given.
Ask through the contact form, choosing Data Protection Request as the reason. There is no charge and you do not need to explain why. Withdrawing analytics consent needs no request at all: use the analytics preferences control in the footer of any page.
How long we take
We will respond within 45 days of receiving your request. If it is genuinely complicated we may take one further period of up to 45 days, and if we do we will tell you inside the first 45 days, along with why. That is the outside limit rather than the target; most requests here are answerable in days, because there is not much data to search.
Checking that it is you
Before we hand over or delete anything we need to be reasonably sure the request comes from you. Handing your data to somebody who claims to be you would be a worse failure than being slow about it.
Usually that means replying from the address the data is attached to, or telling us something that matches what we already hold, such as roughly when you contacted us and what about. We ask for the least we can: we will not require an identity document, and we will not use anything you send for verification for any other purpose.
If we cannot verify a request we will tell you so and explain what would help, rather than refusing without a reason. You may also use an authorized agent, in which case we need reasonable proof that you authorized them.
If we say no, you can appeal
If we decline a request, in whole or in part, we will tell you why and we will tell you how to appeal. You have 45 days from our decision to appeal it, through the contact form, marking it clearly as an appeal. An appeal is looked at by someone who did not make the original decision where we have the people to do that.
We will respond to an appeal within 45 days, in writing, explaining the reasons for our decision. If we still decline, you may complain to your state attorney general or the equivalent data protection authority where you live, and we will give you a means of contacting them.
Asking costs you nothing
We will not treat you differently for exercising any of these rights. No worse service, no different price, no penalty, and no effect on a live enquiry or an existing contract. If you are a client, asking a question about your personal data has no bearing on the work we do for you.
Practical limits
Worth stating rather than leaving you to discover. We can only find what we can identify, so an enquiry sent from an address you no longer control is hard for us to tie to you. Server logs are keyed on IP address rather than identity, so we generally cannot pick out one visitor's records from them without more information than we would want to hold. Where we cannot act for a reason like that, we will say so plainly instead of leaving the request unanswered.
Security
The site is served only over HTTPS. The contact form is sent over HTTPS to our own support desk, which validates and rate limits submissions and screens out automated ones. Credentials are held in a secrets manager rather than in code or configuration, and the site is described openly in how this site is built.
No system is beyond compromise. If something happens that affects your data and we are required to tell you, we will, and we would rather tell you than not.
Children
This site is aimed at people running organizations and their IT, and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has sent us something, tell us and we will delete it.
Changes
We may update this policy as the site or the business changes. The version published here is the one that applies, and the date at the top says when it last changed.