Privacy & Legal

#

Equatorium provides a web platform (the “Platform”) to government licensing authorities, telecommunications regulators and ministries (“Agencies”). The Platform shows where satellite terminals that appear to use the Starlink network are operating within the countries an Agency subscribes to, so that the Agency can check them against its licensing records and take action under its own laws.

To do this, Equatorium licenses device and location data from third-party data suppliers (“Data Partners”) and analyses it to identify satellite terminals. The Platform is organised around the terminal (the dish) rather than the people who use it. The advertising IDs of the devices seen connected to a terminal are part of the data Equatorium licenses: Agency users see them in the terminal’s side panel and in exports. Other information that could identify the people using a terminal is protected by default and is released to an Agency only through our Disclosure Policy, which requires a stated legal basis and review by Equatorium.

We also operate the public website at equatorium.com, where licensing authorities can request a briefing, apply for an account and contact support.

#

• Customers are public authorities. We provide the Platform only to vetted public authorities, for spectrum licensing and related lawful regulatory purposes. We vet every Agency, by reviewing its sign-up or before issuing it a referral code, and we review every country subscription; we may refuse either.
• Identity is protected by default. Agencies see terminals, their locations and the devices seen connected to them. Identity-linked data moves only through our Disclosure Policy.
• Protected activity is excluded. Requests concerning conflict areas, journalists or other protected activity are denied, and the Platform may not be used to target them.
• Audit logging. Every change in the Platform and every disclosure request is written to the Agency’s audit log.
• Sale of data. Providing device and precise location data to government customers for a fee is a “sale” of personal data under several privacy laws. We disclose this, and anyone can opt out through Your Privacy Choices.
• No advertising or eligibility decisions. We do not use the data for advertising, and it may not be used to decide anyone’s eligibility for credit, employment, insurance or housing.

#

If documents conflict, the order of precedence in Section 20 of the Terms of Use applies: any Standard Contractual Clauses prevail; then a signed Order Form; the Customer Data Processing Agreement (for personal data); the Disclosure Policy (for Releases); the Terms of Use; and then the remaining policies and notices.

#

#

Equatorium operates a secure platform that detects and locates Starlink satellite terminals for licensing authorities. The services we provide (collectively, the “Services”) include:

• the Equatorium web application and related pages and user interfaces currently located at equatorium.com and its sub-domains (the “Platform”), including its map, search and terminal views, scheduled scans and alerts, task assignment and notifications, the disclosure process, billing, support, account settings, the audit log and exports;
• the detection results, terminal records, evidence summaries, reports, exports, alerts, and other information we make available through the Platform, which are derived from device and network data that we license from third-party data partners (the “Data Services”, and each item of such output, “Output”);
• the disclosure process through which identity-linked data about a specific terminal may be released to an Agency, as described in our Disclosure Policy (a “Release”);
• Quant, the AI assistant built into the Platform, as described in Quant, the AI Assistant; and
• any documentation, application programming interfaces, export formats, the “Check a release” page, and other software or materials we make available for use with the Platform (collectively, the “Software”).

Updates or changes to the Services. We change the Services from time to time, for example by improving detection, adding countries, data sources, or features, fixing defects, and applying security patches. These changes may affect how detections or Output appear. We may add, change, suspend, or remove any feature or portion of the Services at any time. Where a change materially reduces the core functionality of a paid country subscription during its term, we will notify you and, as your sole remedy, you may terminate the affected subscription and receive a pro-rata refund of prepaid fees for the unused portion of that subscription.

Changes required by law. We may modify, restrict, or remove any data category, scope, feature, or country coverage where we reasonably believe it is necessary to comply with law, a court order, regulator guidance, a Data Partner restriction, or our Responsible Use commitments. Such a change is not a breach of this Agreement and does not give rise to a refund under the previous paragraph. A pro-rata refund of prepaid fees applies only where the change removes access to a subscribed country entirely.

Availability. We will use commercially reasonable efforts to make the Platform available 99.5% of each calendar month. Scheduled maintenance notified at least 48 hours in advance, emergency security maintenance, and unavailability caused by Data Partners, third-party networks, or force majeure do not count as unavailability. If availability falls below that level in a month, your Agency may request a service credit of 5% of the monthly equivalent of its country subscription fees, within thirty (30) days after the end of that month. Service credits are your sole remedy for unavailability. Data freshness (“data as of”), detection coverage, and disclosure review times are not part of availability.

Notifications and messages. We send service, security, billing, task, alert, and disclosure notifications by email and in the Platform. You can manage the frequency of some notification emails in your account settings, but you cannot opt out of messages that are necessary to operate your account, secure the Services, or comply with law.

Changes to this Agreement. We may modify this Agreement and the documents incorporated into it (including the Privacy Policy, Disclosure Policy, Responsible Use & Platform Enforcement Policy, and Customer Data Processing Agreement). We will post the revised version with a new “Last updated” date and, for material changes, notify your account administrators by email or in the Platform at least thirty (30) days before the change takes effect, unless a shorter period is required by law, a court or regulator, or to address a security or misuse risk. Material changes that are adverse to your Agency take effect at the start of your next subscription term, except changes required by law, changes needed for security, and changes that strengthen the Disclosure Policy or the Responsible Use & Platform Enforcement Policy, which take effect on the stated date. If you continue to use the Services after a change takes effect, you agree to the revised Agreement. If you do not agree, you must stop using the Services, and you may terminate under Section 17. If you terminate because of an adverse change that applies during a term, we will refund prepaid subscription fees for the unused portion of that term. Changes do not apply retroactively to disputes already notified under Section 19.

#

Eligible Agencies. The Services are offered only to government licensing authorities, telecommunications and spectrum regulators, ministries, and other public bodies with a lawful mandate over the licensing or authorization of satellite terminals or radio equipment in a country for which they hold a subscription, together with their authorized personnel. The Services are not offered to private individuals, commercial enterprises (other than contractors acting under the documented instructions and authority of an eligible Agency and approved by us in writing), or to any person for personal, household, journalistic, investigative, or commercial purposes.

Sign-up and vetting. To register, you must provide your name, your agency, an official government email address, your country, and any referral code you were given, and you must accept this Agreement. We review every sign-up before granting access, except a sign-up made with a valid referral code we issued, which is approved without a separate review because we vetted the Agency before issuing the code. As part of a review we may verify your identity, your role, your agency’s mandate and legal authority, and the country concerned; ask for additional information or documents; and consult the human-rights and legal due diligence described in our Responsible Use & Platform Enforcement Policy. We may approve, request further information about, or deny any sign-up in our sole discretion, and we are not required to give reasons for a denial. A payment card may be authorized at sign-up and charged only on approval.

Signed Order Form. Paid country subscriptions, response-time tiers faster than the standard review time, and the disclosure process require an Order Form signed by an authorized representative of the Agency that incorporates this Agreement. Until an Order Form is signed, access is limited to a trial, and Output during the trial does not include identity-linked data or Releases. The individual who accepts this Agreement at sign-up does so on the Agency’s behalf to the extent the Agency’s law permits, and personally as to their own conduct.

Country subscriptions. Access to the Data Services for a country requires an active country subscription. We review each request to add a country and may deny it, including where we determine that the requesting Agency does not have a mandate in that country or that providing the Services there would conflict with law, sanctions, or our Responsible Use commitments.

Ineligibility. You may not access or use the Services if you or your agency, or to your knowledge any of your officials or personnel who use the Services: (i) are located in, organized under the laws of, or ordinarily resident in a country or territory subject to comprehensive sanctions, or are the target of sanctions administered by the United States, the United Nations, the European Union, the United Kingdom, or any other jurisdiction applicable to Equatorium; (ii) cannot lawfully receive or use the Services under the laws applicable to you; (iii) have previously had access to the Services suspended or terminated for misuse; or (iv) fall within Section 13 (Export Controls, Sanctions, and Restricted Data Transfers).

Authority. You represent and warrant that you are at least eighteen (18) years old, that you are employed by or formally engaged on behalf of the Agency, and that the Agency has authorized you to accept this Agreement and to use the Services for the Permitted Purpose described in Section 4.

#

Accounts and users. Your Agency’s account is managed by one or more administrators who may invite users (each an “Authorized User”) up to the number of seats included in your plan or purchased as extra seats. Each Authorized User must have their own login, must use an official email address of the Agency (or another address we approve), and must be bound by obligations of confidentiality and responsible use at least as protective as this Agreement. Logins may not be shared.

Roles and permissions. The Platform lets you give each Authorized User a role with permissions such as viewing or buying billing items, spending credits, approving disclosure requests, managing users, and viewing the audit log. The roles available are shown in the Platform. You are responsible for assigning roles on a need-to-know basis, for keeping at least one administrator, for appointing at least one approver who is not the requester of a disclosure request, and for promptly removing access for anyone who leaves the Agency or no longer needs it.

Two-step verification and credentials. Authorized Users must enable two-step verification where the Platform requires it, keep credentials confidential, and notify us immediately at security@equatorium.com if they suspect unauthorized access. You are responsible for all activity under your account, whether or not you authorized it, except to the extent caused by our breach of this Agreement.

Accurate information. You must keep account information, including administrator contacts, billing contacts, and the Agency’s legal name and country, accurate and up to date.

Audit log. Activity in the Platform, including disclosure requests and access to Releases, is recorded in your Agency’s audit log. You agree that Equatorium may maintain and review audit records to operate, secure, and enforce the Services, and that audit records may be used as evidence in any dispute or investigation concerning use of the Services.

#

Permitted Purpose. You may use the Services and Output solely for the following purpose (the “Permitted Purpose”): to identify, locate, monitor, and take lawful regulatory action concerning satellite terminals that may be operating without the licence, authorization, or type approval required in a country for which your Agency holds an active subscription, including the related licensing, spectrum management, enforcement, and policy activities that fall within your Agency’s legal mandate. Any use beyond spectrum licensing must fall within the mandate your Agency stated when it applied, and Equatorium’s legal team must approve that mandate in writing before your account is created. Any other use requires our prior written approval under the Responsible Use & Platform Enforcement Policy.

Focus on terminals, not individuals. The Services are designed to account for terminals. Terminal records describe a dish, not a person. You agree not to use the Services or Output to locate, track, monitor, or profile any individual except through an approved disclosure under the Disclosure Policy, and then only for the case and legal basis stated in the approved request.

Licence to Output. Subject to your compliance with this Agreement and payment of applicable fees, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable licence during the term of your subscription to access, view, and use Output internally within your Agency for the Permitted Purpose, and to include Output in your Agency’s internal case files, enforcement notices, court submissions, and regulatory records to the extent reasonably necessary for a specific action within the Permitted Purpose.

Exports. Exports (including terminal reports, usage exports, and Release exports) are Output. You must store exports securely, limit access to personnel who need them for the Permitted Purpose, and delete them when no longer needed for that purpose or when this Agreement ends, unless your law requires you to keep them as part of an official record. Export files may expire and be deleted from the Platform after a limited period (see the Data Retention Schedule).

No onward disclosure. You may not disclose Output to any third party, including other government bodies, except (i) to another public authority in your country, where your law requires it for the same matter, that authority is bound by confidentiality, and you record the disclosure in your own records; (ii) to a court, tribunal, or prosecutor in connection with a specific proceeding within the Permitted Purpose; or (iii) as we otherwise approve in writing. You remain responsible for any onward disclosure.

Your responsibility for decisions. You alone decide whether and how to act on Output. You are responsible for ensuring that any inspection, notice, seizure, fine, or other action you take is lawful, proportionate, based on independent verification (see Section 14), and consistent with the rights of the persons affected.

#

Identity-linked data about a terminal is released to an Agency only through a disclosure request approved under our Disclosure Policy, which forms part of this Agreement and requires a stated legal basis and review by Equatorium. You must comply with the Disclosure Policy for every request, including its requirements on legal basis, justification and approval within your Agency, and you may not make requests concerning conflict areas, journalists, or other protected activity. Linking a Release to a named individual is your responsibility and must be carried out lawfully under your own legal authority.

Your representations for each request. By submitting or approving a disclosure request, the requester and the approver each represent on behalf of the Agency that the stated legal basis is genuine, current, and sufficient under the laws that apply to the Agency; that any court order or authorization provided is authentic and has not been revoked; that the scopes requested are necessary and proportionate for the stated case; and that the Release will be used only for that case.

Integrity of Releases. You may not alter a Release or present an altered document as a Release. Releases can be checked as described in the Disclosure Policy.

Our discretion. Equatorium is not obliged to approve any request, and nothing in this Agreement or in the payment of fees, including response-time fees, entitles you to a Release. Response-time tiers set how quickly we review a request, not the outcome. Threat-to-life requests are handled at priority, whatever your tier, at no charge.

#

Quant is an AI assistant that answers questions about your Agency’s data in the Platform and may suggest actions. Quant uses an AI model provided by a third party acting as our sub-processor and is described in Quant, the AI Assistant, which forms part of this Agreement. By using Quant you acknowledge that:

• your question, the parts of your Agency’s Equatorium data that Quant reads to answer it, and Quant’s reply are sent to that sub-processor, as described in Sub-processors & Data Partners;
• Quant never acts on its own: nothing it suggests happens until an Authorized User presses Confirm, and confirmed suggestions are recorded in your audit log;
• Quant can make mistakes. You must check important figures and conclusions against the Platform page Quant links to before relying on them, and you must not rely on Quant alone for any enforcement decision; and
• we may apply usage limits per user and per Agency, and may suspend or disable Quant at any time.

You must not use Quant to attempt to obtain identity-linked data outside the disclosure process, to generate content unrelated to the Permitted Purpose, or to circumvent any limit or safeguard in the Services.

#

Your Content. “Your Content” means information you or your Authorized Users submit to the Services, including account details, area definitions, workflow settings, case notes, task comments, disclosure justifications, legal-basis documents and other uploads, support messages, and Quant questions. As between the Parties, you retain your rights in Your Content.

Licence to Equatorium. You grant Equatorium and its sub-processors a worldwide, non-exclusive, royalty-free licence to host, copy, process, transmit, and display Your Content as necessary to provide, secure, support, and improve the Services, to review disclosure requests, to maintain audit records, to enforce this Agreement, and to comply with law. We will not disclose Your Content (including the existence or content of your disclosure requests) to any other customer.

Your responsibility. You represent and warrant that you have all rights and authority needed to submit Your Content, that uploads are authentic, and that Your Content does not contain malicious code or information you are not permitted to share with us. Do not upload classified information or special categories of personal data unless strictly necessary to support a disclosure request.

Feedback. If you provide suggestions or feedback about the Services, you grant Equatorium a perpetual, irrevocable, worldwide, royalty-free licence to use that feedback for any purpose without obligation to you. Feedback does not include Your Content or your confidential information.

Usage data. We may collect and use technical and usage information about how the Services are used (for example, feature usage, performance, and error data) to operate, secure, and improve the Services and to produce aggregated statistics that do not identify your Agency or any individual.

#

Ownership. Except for the limited licences granted to you in this Agreement, Equatorium and its licensors retain all right, title, and interest in and to the Platform, the Services, the Software, the Data Services, the detection models, scores, classifications, and methodologies, terminal numbering, Output (other than Your Content contained in it), any improvements or derivative works, and all related intellectual property. We reserve all rights not expressly granted.

Software licence. Subject to this Agreement, we grant you a limited, non-exclusive, non-transferable, non-sublicensable, revocable licence to use the Software during the term solely to access and use the Services for the Permitted Purpose.

Restrictions. You will not, and will not permit anyone else to:

• copy, modify, translate, or create derivative works of the Services or Software, or decompile, disassemble, reverse engineer, or otherwise attempt to derive source code, models, model weights, scoring logic, or underlying data, except to the extent such restriction is prohibited by applicable law;
• sell, resell, rent, lease, lend, sublicense, distribute, or otherwise make the Services, Software, or Output available to any third party, except as permitted in Section 4;
• access the Services by automated means (including scraping, crawling, or bulk downloading) other than through interfaces and exports we provide, or exceed published rate or usage limits;
• attempt to re-identify any individual from Output, or combine Output with other data to identify an individual, except through and within the scope of an approved Release;
• use the Services, Software, or Output to build or train a competing product or service, or to train, fine-tune, or evaluate any machine-learning or AI model;
• probe, scan, or test the vulnerability of the Services, or breach or circumvent any security, authentication, audit, or access control (responsible security research must be coordinated in advance with security@equatorium.com);
• upload or transmit viruses or other harmful code, or interfere with the integrity or performance of the Services;
• remove, alter, or obscure any proprietary notices or markings, including those on Releases and exports; or
• represent that Equatorium certifies or endorses any action you take, or use Equatorium’s name or marks without our prior written consent.

Government end users. Any use, reproduction, or disclosure of the Platform and its documentation by a government entity is governed solely by this Agreement and any Order Form, except as mandatory law requires otherwise.

#

Data Processing Agreement. The processing of personal data in connection with the Services is governed by the Customer Data Processing Agreement (the “DPA”), which forms part of this Agreement. In summary, Equatorium acts as an independent controller of the device and location data it licenses from Data Partners and uses to provide the Data Services; your Agency becomes an independent controller of any Output and Release it receives; and Equatorium acts as a processor or service provider for your Agency when it hosts Your Content.

Your obligations. You will:

• comply with all data protection, privacy, surveillance, and criminal-procedure laws that apply to your Agency’s receipt and use of Output and Releases, including any requirement for prior judicial or independent authorization;
• process Output and Releases only for the Permitted Purpose and the specific case stated in an approved disclosure request;
• implement appropriate technical and organizational measures to protect Output and Releases from unauthorized access, loss, or disclosure, at least as protective as those described in the DPA;
• notify us without undue delay, and in any event within seventy-two (72) hours, at security@equatorium.com if you become aware of unauthorized access to, or disclosure of, Output or a Release in your custody;
• cooperate with us in responding to data subject requests, regulatory inquiries, and audits concerning Output or Releases; and
• honour opt-out and deletion requests that we pass to you concerning Output you hold, where your law permits.

Certification of Release use. Once a year, and at any time we reasonably suspect misuse, your Agency will, within thirty (30) days of our written request, certify in writing that it has complied with Section 4, the Disclosure Policy, and the Responsible Use & Platform Enforcement Policy. For any Release we identify, your Agency will also provide the legal-basis record, a description of the use made of the Release, and confirmation of deletion or of the official case record in which it is retained. If your Agency does not respond in time, we may suspend the disclosure process for your Agency until it does.

Privacy Policy. Our Privacy Policy describes how we collect, use, and share personal data, including information about your Authorized Users. By using the Services, you confirm that you have reviewed it and that you will make it available to your Authorized Users.

Children. The Services are not designed to process data about children. You must not use the Services in connection with any person you know to be a child under applicable law, and you must tell us at privacy@equatorium.com if you believe Output relates to a child.

#

a. Pricing elements

• Country subscriptions. Access to the Data Services for each country requires an annual country subscription at the price shown in the Platform or the Order Form. Subscriptions start when activated after our review, run for twelve (12) months, and renew automatically for successive twelve-month terms unless auto-renew is turned off before the renewal date. Renewal is subject to your Agency’s issue of a purchase order or equivalent budget authority where its law requires one. If funds for a renewal are not appropriated, the subscription ends at the end of the current term without liability for either Party, provided you notify us before the renewal date.
• Credits. Certain activities and options are paid in credits. Credit prices, pack sizes and the activities that use credits are set out in the Platform or the Order Form, and the number of credits an activity costs is shown in the Platform before you confirm it.
• Response-time tiers. Each subscription includes a standard disclosure review time. Faster review times are available for an additional charge. The available tiers and their charges are set out in the Platform or the Order Form. If a charge for a faster tier is not paid, your Agency returns to the standard review time. Review times are targets we use reasonable efforts to meet; missing one does not result in approval of a request.
• Trial. We may grant a trial allowance of credits as we determine. Trial credits have no cash value, cannot be refunded or transferred, and expire at the end of the trial, after which your balance returns to zero unless you purchase credits.
• Extra seats. Seats beyond those included in your plan are charged at the rate shown in the Platform.

b. Payment

You may pay by card through our payment processor or, where we approve, by invoice. If you pay by card, you authorize us and our payment processor to charge your card for purchases you confirm, for automatic top-ups you enable, and for renewals. Our payment processor collects and stores card details. If you pay by invoice, invoices are due within thirty (30) days of the invoice date unless the Order Form states otherwise, and you must provide the billing entity, billing email, and any purchase order number you require. All amounts are payable in the currency shown with the price in the Platform or the Order Form.

Automatic top-up. If you enable auto top-up, we will purchase the number of credits you selected whenever your balance falls below the threshold you set, using your payment method on file, until you turn it off.

Past-due amounts. If a payment fails or an invoice is overdue, we may suspend credit-consuming activities, workflows, or access to the Data Services until the amount is paid, after notice to your billing contacts. Late amounts may bear interest at the lesser of 1% per month or the maximum permitted by law, except where your applicable public-finance law prohibits interest, in which case it does not apply.

c. Refunds and adjustments

• Except as stated in this Section or required by law, fees and purchased credits are non-refundable, and credits have no cash value.
• If a request to add a country subscription is denied, or is withdrawn by you while still in review, any amount charged for it is refunded in full to the original payment method or credited against an open invoice.
• If we terminate your access under Section 17(e) for legal reasons or because we stop offering the Services in a country, we refund the prepaid fees for the unused portion of the affected subscription and the purchase price of unused purchased credits.
• If a technical failure on our side causes credits to be spent on a run or refresh that did not complete, we will restore those credits once we confirm the failure.
• If you terminate this Agreement because of our material breach that we fail to cure within thirty (30) days of your notice, we refund the prepaid fees for the unused portion of your subscriptions and the purchase price of unused purchased credits.
• No refund or adjustment is available where we suspend or terminate your access for breach of this Agreement or the Responsible Use & Platform Enforcement Policy.

d. Taxes

Fees exclude taxes. You are responsible for all sales, use, value-added, goods and services, withholding, and similar taxes, duties, or levies, other than taxes on Equatorium’s net income. If you are required by law to withhold any tax, you will gross up the payment so that Equatorium receives the full amount invoiced, unless your applicable law prohibits gross-up, in which case the Parties will cooperate in good faith to obtain any available exemption or credit. If you are exempt, you must provide a valid exemption certificate.

e. Changes to fees

We may change prices or introduce new charges with at least thirty (30) days’ notice. Changes do not affect a country subscription term already paid, credits already purchased, or prices fixed in an Order Form.

#

Definition. “Confidential Information” means non-public information disclosed by one Party to the other that is marked as confidential or would reasonably be understood to be confidential, including, for Equatorium, the Software, detection methods, models, scores, pricing, unreleased features, Output, and Releases, and, for the Agency, Your Content, disclosure requests, case information, and the identity of terminals your Agency is investigating. Confidential Information does not include information that (i) is or becomes public through no fault of the receiving Party, (ii) was lawfully known to the receiving Party before disclosure without restriction, (iii) is independently developed without use of the other Party’s Confidential Information, or (iv) is lawfully received from a third party without restriction.

Obligations. Each Party will use the other’s Confidential Information only to perform or exercise its rights under this Agreement, will protect it using at least reasonable care, and will disclose it only to its personnel, contractors, and advisers who need to know it and are bound by confidentiality obligations no less protective.

Compelled disclosure. A Party may disclose Confidential Information when required by law, court order, or a binding request of a competent authority, provided that, where legally permitted, it gives the other Party prompt notice and reasonable assistance to seek protective treatment. Requests from third parties to Equatorium for information about Agencies or Output are handled as described in Requests from Authorities & Third Parties.

Misuse reporting and transparency. Nothing in this Section prevents Equatorium from (a) notifying the Agency’s oversight body, a competent data protection authority, or law enforcement where Equatorium reasonably believes the Services have been misused in breach of Section 4, the Disclosure Policy, or the Responsible Use & Platform Enforcement Policy, or where necessary to prevent serious harm to any person; or (b) publishing aggregate statistics that do not identify the Agency or any case. Where it is lawful and safe to do so, Equatorium will give the Agency prior notice of a notification under (a).

Freedom of information and public records. If you are subject to freedom-of-information, access-to-information, or public-records laws, you will, to the extent those laws permit, treat Equatorium’s Confidential Information as commercially sensitive and exempt from disclosure, and notify us before disclosing it so that we may object.

#

Reporting misuse. If you believe anyone has misused the Services or Output, violated this Agreement, or submitted a disclosure request without a genuine legal basis, please contact legal@equatorium.com or use in-app Support. We investigate every report. See also the Responsible Use & Platform Enforcement Policy.

Copyright and trademark. We respond to notices of alleged infringement as described in our Copyright & Trademark Notice. We may terminate the access of repeat infringers.

#

Export controls and sanctions. The Services, Software, and Output may be subject to export-control and economic-sanctions laws of the United States and other jurisdictions. You will comply with those laws and will not access, use, export, re-export, or transfer the Services, Software, or Output (i) to or for the benefit of any country, territory, government, entity, or person that is the target of comprehensive sanctions or appears on a restricted-party list, (ii) for any military end use or end user, or any use related to weapons of mass destruction, where prohibited, or (iii) in violation of any licence requirement.

Restricted data transfers. Output and Releases may include precise geolocation data and device identifiers that are regulated under laws restricting transfers of sensitive personal data, including the U.S. Department of Justice rule at 28 CFR Part 202 and the U.S. Protecting Americans’ Data from Foreign Adversaries Act. You will not sell, license, provide access to, or otherwise transfer any Output or Release to any “country of concern,” “covered person,” or “foreign adversary”-controlled entity (each as defined in those laws), and you represent that neither your Agency nor any Authorized User falls within those definitions in a way that would make our provision of the Services to you a prohibited or restricted transaction. If you know or suspect that any such person has gained access to Output or a Release, you must notify us immediately at legal@equatorium.com and take any steps required by law.

Equatorium’s compliance. We may screen Agencies and Authorized Users against sanctions and restricted-party lists, decline or suspend service, and withhold payment or refunds where required by law.

#

You acknowledge and agree that:

• Detections are probabilistic. A terminal record is a statistical inference drawn from third-party data and our analysis. They indicate a likelihood, not a certainty, that a Starlink terminal is or was operating at a location. A detection may be incomplete, out of date, or wrong, and terminals may go undetected.
• Locations are approximate. Positions and addresses shown in the Platform are estimates and are not verified.
• Data depends on third parties. The Data Services depend on data licensed from Data Partners, which may change, be delayed, or cease to be available, and coverage varies between countries and areas. “Data as of” dates shown in the Platform indicate how current the published data is.
• Independent verification is required. Before taking any enforcement or other action that may affect any person (including an inspection, notice, seizure, fine, or referral for prosecution), you must independently verify the presence and operation of the terminal through your own lawful means, such as on-site inspection, spectrum monitoring, or records from licensed operators. Output must not be the sole basis for any such action.

Equatorium does not provide legal advice. You are responsible for determining whether Output is admissible or sufficient under your law.

#

Mutual warranties. Each Party represents and warrants that it has the authority to enter into this Agreement and that its performance will comply with laws applicable to it.

Equatorium warranties. Equatorium warrants that (i) it will provide the Services in a professional manner consistent with this Agreement and the Disclosure Policy, (ii) it will maintain the security measures described in the DPA, and (iii) to its knowledge, it has the rights from its Data Partners needed to provide the Data Services as described. Equatorium maintains the Data Partner Requirements and a due-diligence program for its Data Partners, and will stop using data it learns was unlawfully supplied. Your sole remedy for breach of warranty (i) is for us to re-perform the non-conforming Services or, if we cannot, to terminate the affected subscription and refund prepaid fees for its unused portion.

Insurance. During the term, Equatorium will maintain technology errors and omissions insurance and cyber liability insurance with limits of not less than USD 1,000,000 per claim, and will provide a certificate of insurance on request.

Agency warranties. You represent and warrant that (i) your Agency has a lawful mandate for the Permitted Purpose in each subscribed country; (ii) your use of the Services and Output, including every disclosure request, complies with all applicable laws, including constitutional, human-rights, data-protection, surveillance, and criminal-procedure laws; and (iii) you will comply with the Responsible Use & Platform Enforcement Policy and with all applicable anti-bribery and anti-corruption laws, as described in Section 18.

EXCEPT AS EXPRESSLY STATED IN THIS SECTION, THE PLATFORM, THE SERVICES, THE SOFTWARE, THE DATA SERVICES, OUTPUT, RELEASES, AND QUANT ARE PROVIDED “AS IS” AND “AS AVAILABLE.” TO THE FULLEST EXTENT PERMITTED BY LAW, EQUATORIUM AND ITS LICENSORS, DATA PARTNERS, AND SUB-PROCESSORS DISCLAIM ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, COMPLETENESS, AND AVAILABILITY, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, SECURE, OR ERROR-FREE, THAT ANY TERMINAL WILL BE DETECTED, THAT ANY DETECTION, LOCATION, ADDRESS, OR INFERENCE IS CORRECT, OR THAT ANY OUTPUT WILL BE SUFFICIENT OR ADMISSIBLE FOR ANY PROCEEDING.

#

Some jurisdictions do not allow certain limitations of liability. In those jurisdictions, the limitations below apply only to the extent permitted by law.

TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, GOODWILL, OR DATA, OR COST OF SUBSTITUTE SERVICES, ARISING OUT OF OR RELATING TO THIS AGREEMENT, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. EQUATORIUM WILL NOT BE LIABLE FOR ANY ACTION TAKEN OR NOT TAKEN BY YOU OR ANY OTHER AUTHORITY ON THE BASIS OF OUTPUT, A RELEASE, OR QUANT.

TO THE FULLEST EXTENT PERMITTED BY LAW, EACH PARTY’S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THIS AGREEMENT WILL NOT EXCEED THE GREATER OF (A) THE TOTAL FEES PAID AND PAYABLE BY THE AGENCY TO EQUATORIUM UNDER THIS AGREEMENT IN THE TWELVE (12) MONTHS IMMEDIATELY BEFORE THE EVENT GIVING RISE TO THE CLAIM AND (B) TEN THOUSAND U.S. DOLLARS (USD 10,000).

Exclusions. The limitations in this Section do not apply to (i) the Agency’s payment obligations, (ii) a Party’s indemnification obligations under Section 17, (iii) the Agency’s breach of Section 4 (Permitted Purpose), Section 8 (restrictions), or the Responsible Use & Platform Enforcement Policy, (iv) a Party’s gross negligence, wilful misconduct, or fraud, or (v) liability that cannot be limited by law.

#

a. Indemnification by the Agency

To the extent permitted by the laws governing your Agency, you will defend, indemnify, and hold harmless Equatorium, its affiliates, and their officers, managers, employees, and agents from and against any third-party claims, regulatory proceedings, losses, liabilities, fines, and reasonable costs (including legal fees) arising from (i) your or your Authorized Users’ use of Output or a Release, including any action you take against any person; (ii) any disclosure request that lacked a genuine or sufficient legal basis or was submitted or approved in breach of this Agreement; (iii) your breach of this Agreement, the DPA, or the Responsible Use & Platform Enforcement Policy; or (iv) Your Content. Where your law does not permit a public body to give an indemnity, this paragraph applies as a direct obligation to reimburse to the extent permitted.

b. Indemnification by Equatorium

Equatorium will defend you against any third-party claim alleging that the Platform or Software, as provided by us and used in accordance with this Agreement, infringes that third party’s intellectual property rights, and will pay damages and costs finally awarded or agreed in settlement. If such a claim is made or likely, we may obtain the right for you to continue using the Services, modify them to be non-infringing, or terminate the affected Services and refund prepaid fees for the unused period. This obligation does not apply to claims arising from Your Content, Output used outside the Permitted Purpose, or combinations with items not provided by us.

c. Procedure

The indemnified Party must promptly notify the indemnifying Party of the claim, give it control of the defence and settlement (except that no settlement may impose an admission or obligation on the indemnified Party without its consent), and provide reasonable cooperation at the indemnifying Party’s expense.

d. Suspension

We may immediately suspend all or part of your access to the Services, including access to a pending or open Release, if we reasonably believe that (i) you or an Authorized User has breached Section 4, Section 8, Section 13, or the Responsible Use & Platform Enforcement Policy; (ii) your account has been compromised; (iii) continued service would expose any person to a risk of serious harm or Equatorium to legal liability; or (iv) payment is overdue as described in Section 10. We may suspend for reasons (i) to (iii) immediately. We will suspend for non-payment under reason (iv) only after thirty (30) days’ written notice to your billing and administrator contacts. We will tell you the reason where legally permitted and safe to do so, and will restore access once the issue is resolved.

e. Termination

• By you. You may terminate this Agreement at any time by closing your account through Support or by notice to legal@equatorium.com. Fees already paid are not refunded except as stated in Section 10.
• By us for cause. We may terminate this Agreement or any subscription on notice if you materially breach it and (where the breach can be cured) fail to cure it within thirty (30) days, or immediately for a breach of the provisions listed in paragraph (d)(i).
• By us for legal reasons. We may terminate this Agreement or any subscription on ninety (90) days’ notice where required by law or sanctions, because of a Data Partner restriction, or because of a material change in the human-rights or legal conditions in a subscribed country, or sooner where the law or sanctions require it. We refund the prepaid fees for the unused portion of the affected subscription and the purchase price of unused purchased credits. Immediate termination for misuse under the previous paragraph is not affected.

f. Effect of termination

On termination, your right to use the Services ends; open Releases are closed; you must stop using Output and delete Output and Releases in your possession, except copies that your law requires you to retain as part of an official case record, which remain subject to this Agreement; and you must pay all amounts due. For ninety (90) days after termination, your administrators may export Your Content through the Platform’s export features, or ask us for an export. We delete Your Content within thirty (30) days after the end of that export period. Equatorium will retain and delete data as described in the Data Retention Schedule. Sections 4 (no onward disclosure and responsibility for decisions), 7 through 9, 10 (amounts due), 11, 13 through 16, this Section 17, 19, and 20, and any other provision that by its nature should survive, survive termination.

#

Each Party will comply with all applicable anti-bribery and anti-corruption laws, including the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act 2010, and the laws of the Agency’s country. Neither Party will offer, give, request, or accept any payment, gift, hospitality, or other advantage to or from any public official or other person to obtain or retain business, influence any decision, or secure any improper advantage in connection with the Services. No referral code, discount, or trial may be offered or accepted as an inducement to any official. Each Party will maintain accurate books and records relating to the Services and will cooperate reasonably with any investigation by the other into a suspected breach of this Section. Equatorium may terminate this Agreement immediately on notice if it reasonably believes this Section has been breached.

#

Governing law. This Agreement, and any dispute or claim arising out of or relating to it or its subject matter (including non-contractual disputes), is governed by the laws of the State of Delaware, without regard to conflict-of-law rules, unless an election is made under the next paragraph or an Order Form specifies a different governing law.

Alternative law and seat. Your Agency may instead elect, by emailing legal@equatorium.com within fourteen (14) days after signing up, either (a) the laws of England and Wales, with the seat of arbitration in London, or (b) the laws of the Dubai International Financial Centre, with the seat of arbitration in the Dubai International Financial Centre. The election applies once Equatorium confirms it in writing, and may also be recorded in an Order Form.

Informal resolution. Before starting any arbitration or proceeding, the Party raising a dispute must send a written notice describing it (a “Notice of Dispute”) to the other Party (for Equatorium, to legal@equatorium.com). Senior representatives of both Parties will meet, in person or remotely, and negotiate in good faith for sixty (60) days from receipt of the Notice of Dispute.

Arbitration. Any dispute not resolved within sixty (60) days will be finally resolved by binding arbitration administered by the International Chamber of Commerce under its Rules of Arbitration in force at the time, by a sole arbitrator (or three arbitrators where the amount in dispute exceeds USD 5,000,000) appointed under those Rules. The seat of arbitration is Wilmington, Delaware, unless an election is made under this Section. The language of the arbitration is English. Arbitration will be confidential, except as necessary to enforce an award or as required by law. Judgment on the award may be entered in any court of competent jurisdiction.

Interim relief and exceptions. Nothing in this Section prevents either Party from seeking urgent interim or injunctive relief from a competent court to protect its Confidential Information or intellectual property or to prevent misuse of Output, or Equatorium from pursuing unpaid fees.

Individual claims. Disputes will be resolved only on an individual basis between Equatorium and the Agency, and not in any class, consolidated, or representative proceeding.

Sovereign immunity. Nothing in this Agreement waives any immunity from suit, jurisdiction, or execution that the Agency may enjoy as a public body under applicable law, except to the extent the Agency expressly agrees in writing in an Order Form. To the extent the Agency has agreed to arbitration under this Section, the Agency agrees that it will not assert immunity to resist the constitution of the arbitral tribunal or the conduct of the arbitration, to the extent permitted by its law.

Time limit. To the extent permitted by law, any claim must be brought within one (1) year after the claimant knew or should have known of the facts giving rise to it.

#

Entire agreement. This Agreement, together with the following documents, which are incorporated by reference, and any Order Form, is the entire agreement between the Parties regarding the Services and supersedes all prior agreements and understandings on that subject: the Privacy Policy; the Disclosure Policy; the Responsible Use & Platform Enforcement Policy; the Customer Data Processing Agreement; the Data Retention Schedule; the Sub-processors & Data Partners page; Quant, the AI Assistant; and the Copyright & Trademark Notice. The Data Partner Requirements apply to Data Partners and do not bind Agencies. Any purchase-order terms, procurement portal terms, or similar terms you issue are rejected and have no effect unless signed by Equatorium as part of an Order Form.

Order of precedence. In case of conflict, and subject to any Standard Contractual Clauses incorporated in the DPA, which prevail: (1) the Order Form; (2) the DPA (as to personal data), except where the Order Form expressly states that it overrides a specific provision of the DPA; (3) the Disclosure Policy (as to Releases); (4) this Agreement; (5) the other incorporated documents.

Assignment. You may not assign or transfer this Agreement without our prior written consent, except to a successor public body that assumes your Agency’s mandate, on written notice. We may assign this Agreement to an affiliate or to a successor in a merger, acquisition, or sale of all or substantially all of the relevant assets, on notice to you, provided the successor agrees to be bound by this Agreement and the Disclosure Policy. If a successor is subject to sanctions or is a covered person under applicable restricted-transfer laws (including 28 CFR Part 202), your Agency may terminate on notice and receive a refund of prepaid fees for the unused portion of its subscriptions and the purchase price of unused purchased credits.

Subcontractors. We may use subcontractors and sub-processors to provide the Services, as described in Sub-processors & Data Partners, and remain responsible for their performance.

Force majeure. Neither Party is liable for failure or delay in performing obligations (other than payment) caused by events beyond its reasonable control, including natural disasters, epidemics, war, terrorism, civil unrest, labour actions, failures of utilities, networks, satellites, hosting or data providers, cyber-attacks not caused by its negligence, or acts of government, including sanctions and changes in law.

Notices. We may give notices by email to your administrators, by in-Platform message, or by posting in the Platform. You must send legal notices to legal@equatorium.com. Notices are effective on receipt. Requests and notices to Equatorium are made by email.

Independent contractors. The Parties are independent contractors. Nothing in this Agreement creates a partnership, joint venture, agency, or employment relationship, and Equatorium does not act on behalf of, or exercise any public authority of, the Agency.

No third-party beneficiaries. This Agreement does not confer rights on any third party, except that Equatorium’s licensors and Data Partners may rely on Section 8.

Severability; no waiver. If any provision is held invalid or unenforceable, it will be enforced to the maximum extent permitted and the remaining provisions remain in effect. A failure or delay in enforcing any right is not a waiver of it; a waiver must be in writing.

Construction. Headings are for convenience only. “Including” means “including without limitation.” This Agreement will not be construed against either Party as drafter.

Language. This Agreement is written in English. If we provide a translation for convenience, the English version prevails to the extent of any inconsistency. Where your Agency’s law requires a version in its official language, the Parties will sign both versions in the Order Form, and Equatorium will review the official-language version against the English version before signing.

Contact. Send questions about this Agreement to legal@equatorium.com.

#

• Terminals, not people. The Platform describes a dish: where it is and why we believe it is a Starlink terminal. Agencies may not use it to follow individuals.
• Lawful purpose only. Access is limited to public bodies with a licensing or spectrum mandate, for that mandate as approved by Equatorium, in the countries they subscribe to.
• Least data necessary. Identity-linked data is released only for a specific case, under a stated legal basis, for the scopes that case needs, and only through our Disclosure Policy.
• Protected activity stays protected. We deny requests that concern conflict areas, journalists, or other protected activity.
• Everything is recorded. Use of the Platform is written to an audit log that Equatorium and the Agency can review.
• Verify before acting. Detections are probabilistic. No one should face enforcement action on the strength of Output alone.

#

Agencies may use the Services only for the Permitted Purpose defined in the Terms of Use: identifying, locating, monitoring, and taking lawful regulatory action concerning satellite terminals that may be operating without the required licence, authorization, or type approval in a subscribed country, together with related licensing, spectrum-management, enforcement, and policy work within the Agency’s legal mandate. Examples of permitted use include:

• measuring the number and distribution of unlicensed terminals to inform licensing policy or spectrum planning;
• setting up scan and alert workflows over areas within the Agency’s jurisdiction;
• planning on-site inspections or spectrum-monitoring missions to verify a detection;
• requesting, through the disclosure process, identity-linked information about a terminal that is the subject of one of the case types in the Disclosure Policy, within the Agency’s mandate; and
• preparing evidence for a specific licensing or enforcement proceeding, after independent verification.

#

Agencies and Authorized Users must not use the Services, Output, or any Release, directly or through Quant or any other person, to do any of the following:

a. Tracking or profiling individuals

• Locate, track, follow, monitor, or build a profile of any individual or household, including through the device information shown on the Platform, except within the scope of an approved Release and the case stated in it.
• Attempt to re-identify any person from Output, or combine Output with other datasets (such as subscriber records, CCTV, social media, or other location data) to identify a person, except within the scope of an approved Release and as the Agency’s own law permits.
• Infer or act on any person’s sensitive characteristics, such as health, religion, ethnicity, sexual orientation, political opinion, or trade-union membership, from Output.

b. Targeting protected persons and activity

• Use the Services in connection with conflict areas, journalists, or other protected activity, or to target any person or group for lawful expression, association, assembly, or religious practice.
• Discriminate against any person or group on the basis of a protected characteristic.

c. Purposes outside the mandate

• Use the Services for any purpose outside the Agency’s stated mandate. Any use beyond spectrum licensing must fall within the mandate the Agency stated when it applied, which Equatorium’s legal team must approve in writing before the account is created.
• Use Output to determine any person’s eligibility for credit, employment, insurance, housing, education, healthcare, or public benefits, or for marketing or commercial purposes of any kind.
• Use the Services outside the countries the Agency subscribes to, or on behalf of another government, agency, or private party.

d. Sharing and commercial exploitation

• Disclose, publish, sell, resell, license, or otherwise make Output or a Release available outside the Agency, except as permitted by Section 4 of the Terms of Use.
• Use Output, Releases, or Quant responses to train, fine-tune, or evaluate any machine-learning or AI model, or to build a competing product or dataset.

e. Technical misuse

• Scrape, crawl, or bulk-download the Platform, or exceed rate or usage limits.
• Circumvent or attempt to circumvent access controls, roles, approval steps, audit logging, release expiry, or any other safeguard in the Disclosure Policy, including by creating duplicate accounts, sharing logins, or splitting a request to avoid review.
• Alter a Release or export, or present an altered copy as genuine.
• Upload malicious code, probe for vulnerabilities without coordination with security@equatorium.com, or interfere with the Services.

f. Children

• Use the Services in connection with any person the Agency knows or has reason to believe is a child under applicable law, or request a Release relating to a child, except where a threat to that child’s life is the stated case and Equatorium approves it. Report any Output you believe relates to a child to privacy@equatorium.com.

g. False or unlawful requests

• Submit or approve a disclosure request with a legal basis that is invented, expired, revoked, insufficient under the Agency’s law, or not related to the terminal in question, or with a justification that misstates the facts.

#

The following uses are not permitted unless Equatorium has approved them in writing in advance, which we may do subject to conditions such as additional review, narrower scopes, or shorter retention:

• access by contractors or consultants acting for the Agency;
• sharing aggregate statistics derived from Output in public reports, parliamentary submissions, or press statements (aggregates must not allow any terminal or person to be singled out);
• enforcement action concerning aviation (in-flight) terminals, maritime terminals, diplomatic premises, or the premises of international organizations;
• use in a border area, or in connection with a cross-border matter involving another country’s authorities;
• integration of exports into the Agency’s own case-management or analytical systems; and
• any use not clearly within the Permitted Purpose.

Send requests for approval to legal@equatorium.com or raised through in-app Support.

#

Each Agency must, and must ensure its Authorized Users:

• Hold a legal basis. Confirm before each disclosure request that a current legal basis exists under the Agency’s own law, including any required prior authorization by a court or independent body, and keep a copy available for Equatorium’s review on request.
• Apply need-to-know. Grant accounts and roles only to personnel who need them, keep approver and requester roles separate, enable two-step verification, and remove access promptly when it is no longer needed.
• Inform users. Ensure every Authorized User has read the Terms of Use, this Policy, and the Disclosure Policy before using the Platform. Equatorium provides onboarding training on request; it is not mandatory.
• Keep records. Maintain records of each case in which Output or a Release is used, including the legal basis, the decision taken, and any onward disclosure permitted by the Terms of Use, and provide them to Equatorium on reasonable request.
• Handle exports and Releases securely. Store them only in access-controlled systems approved for sensitive personal data, never in personal email or unmanaged devices, and never print or forward them beyond those who need them.
• Delete when the case ends. Delete Releases and exports containing identity-linked data when the case for which they were released is closed, or earlier when no longer needed, except where the Agency’s law requires retention as part of an official record.
• Verify before acting. Independently verify a detection before any enforcement action, as required by Section 14 of the Terms of Use.
• Respect individuals’ rights. Handle complaints and rights requests from affected persons in accordance with the Agency’s law, and pass to Equatorium any request that concerns Equatorium’s own processing.
• Report incidents. Tell Equatorium at security@equatorium.com within seventy-two (72) hours of discovering any misuse, unauthorized access, or loss of Output or a Release.

#

Account approval. Equatorium staff review every sign-up before granting access, except a sign-up made with a valid referral code that Equatorium issued: the code is issued only after Equatorium has vetted the Agency, so that sign-up is approved without a separate staff review. When we review a sign-up, we verify the applicant’s official email and identity, the Agency’s existence and legal mandate, and the country concerned. Any use beyond spectrum licensing must be stated in the application and approved in writing by Equatorium’s legal team before the account is created. We may ask for further information, such as the legal instrument establishing the Agency’s mandate or a letter of authorization, and we may deny a sign-up without giving reasons.

Country review. We review each country subscription before activating it. Before offering the Services in a country, and periodically after that, we assess the legal framework for licensing and surveillance, the independence of courts and oversight bodies, the protection of journalists and civil society, the presence of armed conflict, and credible reports of misuse of surveillance technology. We may decline, condition, suspend, or end the Services in a country, or for an Agency, on the basis of that assessment.

Framework. Our due diligence follows the UN Guiding Principles on Business and Human Rights, the OECD Guidelines for Multinational Enterprises, and relevant export-control guidance on cyber-surveillance items.

Sanctions and restricted parties. We screen Agencies and Authorized Users against applicable sanctions and restricted-party lists and do not offer the Services where prohibited, as described in Section 13 of the Terms of Use.

#

Terminal identity is protected by default. Identity-linked data is released to an Agency only through our Disclosure Policy, which requires a stated legal basis and review by Equatorium. In addition:

• Audit trail. Activity in the Platform is written to an audit log visible to Agency administrators with access to it and to Equatorium.
• Quant safeguards. Quant cannot release identity-linked data and never acts without a user’s confirmation.
• Usage limits. Usage limits apply to the Services.

#

Equatorium monitors use of the Services to detect and prevent misuse. This includes:

• reviewing audit logs and usage for signs of misuse;
• reviewing approved Releases to confirm that the legal basis was genuine and the use matched the stated case, and asking Agencies for the supporting records described in Section 5;
• reviewing Agencies’ continued eligibility, including when an Agency’s mandate, leadership, or legal framework changes; and
• investigating every report of misuse we receive.

Authorized Equatorium staff carry out monitoring under confidentiality obligations. We do not access the content of Your Content except as needed to provide support, review disclosure requests, investigate misuse, or comply with law.

#

If we determine, in our reasonable judgment, that an Agency or Authorized User has breached this Policy, we may take one or more of the following measures, depending on the severity of the breach, its consequences, and whether it is repeated:

1. Warning and a request for corrective action, such as removing a user, deleting an export, or providing records.
2. Restriction of specific features, such as disclosure requests, exports, Quant, or particular areas, or a requirement for additional review of future requests.
3. Revocation of an open Release and a request that the Agency confirm deletion of all copies.
4. Suspension of individual Authorized Users or of the Agency’s account.
5. Termination of the Agency’s account, subscriptions, and access to the Services, without refund, as provided in Section 17 of the Terms of Use.
6. Notification of the Agency’s oversight body, a competent data protection authority, or other authorities, where required by law or where we consider it necessary to prevent harm to any person.

Where a breach creates a risk of serious harm to any person, we may act immediately and without prior notice. Otherwise, we will generally give the Agency an opportunity to explain and remedy the breach. We may refuse future sign-ups from an Agency or individual whose access was terminated for misuse.

#

Anyone, including Authorized Users, members of the public, journalists, and civil-society organizations, may report suspected misuse of Equatorium by emailing legal@equatorium.com or, for customers, through in-app Support. Please include as much detail as you can, such as the Agency concerned, dates, locations, and how you became aware of the issue. Reports may be made confidentially. We will not tell the Agency who reported it unless the reporter agrees or we are required by law, and we prohibit retaliation by Agencies against their personnel who report misuse in good faith.

Report security vulnerabilities to security@equatorium.com.

#

We publish an annual transparency report with aggregate information about how the Services are used and enforced, including the number of countries served, the number of disclosure requests received, approved, and denied by case type and denial reason, the number of enforcement actions taken under this Policy, and the number of requests we received from authorities other than our customers (see Requests from Authorities & Third Parties). Figures are aggregated so that no Agency’s investigations can be identified. A draft of the current report, with underlying data where needed, is available on request from privacy@equatorium.com. See also Privacy Request Statistics.

#

We may update this Policy as the Services, the law, or our understanding of risks change. We will post the updated Policy with a new “Last updated” date and notify Agency administrators of material changes as described in Section 1 of the Terms of Use. Changes that add safeguards may take effect immediately. Send questions about this Policy to legal@equatorium.com.

#

These are the rules shown on the Platform. The other sections of this Policy explain how Equatorium applies them.

1. Every request needs a legal basis and an approver.
2. Equatorium reviews each request within your response time.
3. Requests concerning conflict areas, journalists, or other protected activity are denied.
4. Every request, and every time a release is opened, is recorded in your audit log.
5. A request is never approved just because time runs out.
6. A release can be opened only for a limited time, shown on the release.
7. Only the requester, the approver and admins can open a release.
8. A release holds identifiers, device details, Wi-Fi IDs and evidence, never a name.

A request that matches a protected person is always denied, whatever its case type, legal basis or urgency.

#

A “Disclosure Request” is a request by an Agency for Equatorium to release identity-linked information about one terminal. A “Release” is the time-limited package of information that Equatorium makes available to the Agency when it approves a Disclosure Request.

Without a disclosure, Agency users can see the information needed to account for a terminal under their licensing framework: where the terminal is, when it was active, the reasons it is believed to be a Starlink terminal, and the devices seen connected to it, including their advertising IDs and device details. Equatorium does not treat advertising IDs as identity-linked information for this Policy. They remain personal data under privacy law, as described in the Privacy Policy.

Other information Equatorium holds about a terminal can be resolved to a person by someone with access to other data sources. Hashed email addresses, hashed phone numbers, consent information, network prefixes, Wi-Fi access point identifiers and the home and work places of devices are in that category. Equatorium treats them as identity: they are not shown in the Platform’s ordinary views or exports, and they leave Equatorium only in a Release.

The purpose of the Platform is to help licensing authorities find and regularise unlicensed satellite terminals. Disclosure is for cases in which a lawful authority needs to go further than the terminal, and only to the extent the law allows.

#

Equatorium considers Disclosure Requests only for the following case types. A request that does not fit one of them is denied as outside policy.

A licensing matter that does not fall within these case types, including enforcement under a statutory information power and sending a notice to the operator of an unlicensed terminal, should be handled from the information available without a disclosure.

#

Every Disclosure Request names one or more scopes. Equatorium releases only the scopes approved, and only to the extent there is data for them. The request form shows, before submission, whether each scope has data for the terminal.

Evidence comes with every Release. So that the Agency can weigh the finding, each Release includes a summary of the evidence for the detection.

A Release never contains a name, an unhashed telephone number, an unhashed email address or the content of any communication. Equatorium does not hold the content of communications at all.

Data minimisation applies to scopes. Equatorium will deny or narrow a request that asks for more scopes than the stated purpose needs, and approvers in the Agency are expected to do the same.

#

Who can request

Any Agency user whose role allows it may start a Disclosure Request from a terminal’s page. The request is made on behalf of the Agency, not the individual user. The disclosure process is available only to Agencies that have signed an Order Form with Equatorium, as described in Section 2 of the Terms of Use. It is not available during a trial.

What every request must include

• The terminal. One terminal per request.
• A case type from section 3.
• The scopes requested, from section 4.
• A legal basis: the law, order or authorisation that permits the Agency to obtain the information, with its reference.
• A justification: why the information is necessary and proportionate for this case, and how it will be used.
• Supporting documents where they exist, such as a court order or a written authorisation.

The Agency’s approver

Every request must be approved inside the Agency by a user with the approver role who is not the requester. The approver confirms that the legal basis is valid, that the scope is no wider than needed and that the request complies with this Policy and the Agency’s own law. An approver may decline a request; a declined request does not reach Equatorium.

Only one request for the same terminal by the same Agency may be open at a time. A requester may withdraw a request at any time before it is released.

#

People review every request

After the Agency’s approver approves it, Equatorium staff review every Disclosure Request. No request is approved automatically or because a deadline has passed. If a review is not completed within the Agency’s response time, the request stays in review and the Agency is told; it is never released by default.

Response time

Equatorium aims to complete each review within the response time that applies to the Agency, as set out in the Platform or its Order Form. A response time is a target for completing the review. Meeting it does not mean the request will be approved, and asking for more information pauses it.

What a review considers

Equatorium considers whether the case type fits the facts, whether the legal basis exists and covers the scopes asked for, whether the request is necessary and proportionate, and whether it complies with this Policy and the Terms of Use.

Information needed

Equatorium may ask the Agency for more information or documents. The request then shows “info needed” until the Agency answers. A request still waiting after the reply date shown on it is withdrawn.

Protected persons and protected activity

Equatorium denies every request that concerns conflict areas, journalists or other protected activity, and every request that matches a protected person. Equatorium does not disclose how it identifies these requests, and the Agency is not told the reason for such a match beyond the denial.

Denial

A denied request carries one of three fixed reasons. The Agency sees the fixed wording only.

Holds

Equatorium may place an approved request on hold before release, for example where it receives information that changes the assessment, a legal challenge, or a security concern. A held request shows “held”, and Equatorium will tell the Agency what, if anything, it can do.

#

Threat-to-life requests are always handled at priority, whatever response-time tier the Agency has, and at no charge.

An emergency request still needs an approver in the Agency and is still subject to this Policy, including the rules on protected persons and protected activity. Where documents cannot be supplied at once, Equatorium may release a narrower scope first, and the Agency must provide the supporting documents within 72 hours. If they are not provided, Equatorium will record that in the Agency’s audit log and may suspend the Agency’s ability to make further requests.

#

• A limited window. A Release can be opened only for the period shown on it, from when it is issued. After that it expires and cannot be opened again, and its contents are deleted from the Platform.
• Who can open it. Only the requester, the approver and the Agency’s administrators.
• Every opening is recorded in the Agency’s audit log, alongside the request and the approval.
• Exports. A Release can be exported for the Agency’s case file while it is open. Export files carry the Release reference.
• Checking a Release. Anyone holding a copy of a Release, such as a court, can check that it is genuine on the Check a release page.

#

Once information is released, the Agency becomes an independent controller of that information under the law that applies to it and is responsible for its lawful use. In addition to the Terms of Use and the Customer Data Processing Agreement, the Agency must:

• use released information only for the case and the purpose stated in the request;
• restrict access to the people working on that case;
• keep it secure, at least to the standard its law requires for information of that sensitivity;
• not combine it with other data to build profiles of individuals beyond what the case requires;
• not disclose it to anyone else except as its law requires (for example, to a court or prosecutor in the same matter), and record any such disclosure;
• delete it when the case no longer needs it, or when its law requires; and
• tell Equatorium within seventy-two (72) hours at security@equatorium.com if released information was misused or exposed, and promptly at legal@equatorium.com if it was inaccurate.

Equatorium may ask an Agency to confirm in writing how released information was used and when it was deleted. Misuse of released information is a material breach of the Terms of Use and the Responsible Use & Platform Enforcement Policy.

#

Released information comes from third-party Data Partners and from Equatorium’s analysis of that data. It shows that devices were observed at or near a terminal; it does not prove who owns, operates or uses the terminal. Places are estimates with a stated confidence, not verified addresses. Agencies must corroborate released information before relying on it for any action that affects a person, and must not take such action on the basis of a Release alone.

#

An Agency may ask Equatorium to reconsider a denial through Support, with any new information. Equatorium’s decision on reconsideration is final under this Policy; it does not affect any rights the Agency has under its Order Form or the law.

#

Equatorium publishes an annual transparency report. It covers the number of Disclosure Requests received, released, denied (by reason), withdrawn and expired, by case type, aggregated so that no Agency or case can be identified, together with requests from authorities that are not Agencies. A draft of the current report, with underlying data where needed, is available on request from privacy@equatorium.com. See Privacy Request Statistics and Requests from Authorities & Third Parties.

#

Equatorium may update this Policy to reflect changes in the law, in the Platform or in its practices. We will post the updated Policy here and update the date above, and we will tell Agencies of material changes through the Platform or by email before they take effect. Equatorium may update its procedures, but never in a way that reduces the protection given to identity-linked data, and a change never reduces the protection of information already released. Questions about this Policy can be sent to legal@equatorium.com.

#

Three kinds of processing happen on the Platform, and the parties have a different role for each. This DPA deals with each separately.

Equatorium’s own processing of personal data for its business (for example, billing records, the security of the Platform, vetting sign-ups, and the operation of the Data Services) is described in the Privacy Policy and is not processing on the Agency’s behalf.

#

Capitalised terms not defined here have the meaning given in the Terms of Use. In this DPA:

• “Adequate Jurisdiction” means a country or territory that the European Commission, the UK Secretary of State or the Swiss Federal Data Protection and Information Commissioner (as relevant) has found to provide an adequate level of protection for personal data, or that is otherwise recognised as adequate under the Data Protection Laws that apply to the transfer.
• “Customer Content” means personal data that the Agency or its Users submit to, upload to or create on the Platform, other than Data Services Data, as listed in Section 1.
• “Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data covered by this DPA, and any similar term defined in Data Protection Laws.
• “Data Protection Laws” means every law on privacy or the protection of personal data that applies to a party’s processing under the Agreement, including, where applicable, the EU General Data Protection Regulation 2016/679 (“EU GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (“CCPA”) and other U.S. state privacy laws, and the data protection laws of the Agency’s country and of any other country whose law applies to the processing, each as amended or replaced. Country-Specific Privacy Information explains how to ask which local laws apply.
• “Data Services Data” means personal data contained in or derived from the device and location data Equatorium licenses from Data Partners, as displayed on the Platform or released through a Disclosure.
• “Data Subject”, “controller”, “processor”, “personal data” and “processing” have the meanings given in the applicable Data Protection Laws; where those laws use other terms for the same concepts (for example “business”, “service provider”, “personal information” or “data handler”), those terms are included.
• “Disclosure” means a disclosure request made, approved and released under the Disclosure Policy, and “Release” means the package of Data Services Data made available to the Agency when a Disclosure is approved.
• “Quant Data” has the meaning in Section 1.
• “SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914, together with, for transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner (the “UK Addendum”), and, for transfers from Switzerland, the SCCs as adapted under Section 8.
• “Sub-processor” means any third party Equatorium engages to process Customer Content or Quant Data on its behalf.
• “User” means an individual authorised by the Agency to use the Platform under its account, in any role available in the Platform.

#

Each party will:

• comply with the Data Protection Laws that apply to its own processing under the Agreement;
• process personal data only for the purposes allowed by the Agreement and this DPA;
• make sure that its personnel who access personal data are bound by appropriate confidentiality obligations and are trained in the handling of personal data;
• implement appropriate technical and organisational measures to protect personal data, taking into account its nature and the risks involved; Equatorium’s measures are described in Schedule 2;
• unless prohibited by law, tell the other party without undue delay about any regulatory inquiry, complaint or Data Subject request it receives that concerns the other party’s processing under the Agreement; and
• give the other party reasonable cooperation when it needs to respond to a regulator, a court or a Data Subject about processing under the Agreement.

#

4.1 Roles

Equatorium and the Agency are each an independent controller of Data Services Data. Equatorium decides how Data Services Data is collected from Data Partners, analysed, retained and made available on the Platform, and is responsible for that processing under its Privacy Policy. Once Data Services Data is displayed to the Agency’s Users or released to the Agency, the Agency decides for itself how it uses that data, and its processing is governed by the law that applies to the Agency and by the legal basis it relied on. Nothing in this DPA makes the parties joint controllers.

4.2 The Agency’s obligations

For Data Services Data it receives, the Agency will:

• Have a lawful basis. Use Data Services Data only for the licensing, spectrum management and enforcement functions the Agency is legally mandated to perform, and, for any Disclosure, only for the case type, legal basis and justification stated in the approved request.
• Provide transparency where required. Give any notice to Data Subjects that the law applicable to the Agency requires, or rely on an exemption that applies to it (for example for law enforcement, national security or regulatory functions), and keep a record of the exemption it relies on.
• Handle rights requests. Respond to requests from Data Subjects about data the Agency holds, under the law that applies to the Agency. Equatorium handles requests about data Equatorium holds, as described in Your Privacy Choices.
• Not re-identify beyond the approved scope. Not combine Data Services Data with other information to identify an individual, a household or a device user, and not attempt to reverse hashed emails or other pseudonymous identifiers, except to the extent a Disclosure released those identifiers to the Agency for the stated case and the Agency’s law permits that step.
• Respect the terminal focus. Treat terminal-level data (locations, sites, activity levels, device lists) as information about a satellite terminal, and not use it to track, profile or monitor an individual outside an approved Disclosure.
• Limit onward transfers. Not sell, rent, publish or otherwise make Data Services Data available to any third party, including another public body, except (a) to a court, prosecutor or other authority where required for the case for which a Disclosure was approved, or (b) where required by the Agency’s law, and in each case only the minimum necessary. Any recipient must be bound to protect the data at least as strictly as this DPA requires.
• Secure the data. Protect exported files and Releases with measures at least as protective as those in Schedule 2, and restrict access to Users with a need to know.
• Delete when done. Delete or destroy Data Services Data it has exported or copied from a Release when the case for which it was released is closed, or when its own retention law requires, whichever is sooner, unless the law that applies to the Agency requires it to keep the data as evidence.
• Respect the Disclosure Policy and the Responsible Use Policy. Not use the Platform or any Data Services Data for any purpose prohibited by the Disclosure Policy or the Responsible Use & Platform Enforcement Policy, including any purpose concerning journalists, conflict areas or other protected activity.

4.3 Equatorium’s obligations

For Data Services Data, Equatorium will:

• obtain Data Services Data from Data Partners that are contractually bound by the Data Partner Requirements, including requirements on notice, consent and opt-out signals;
• publish and maintain its Privacy Policy, the Retention Schedule and the regional notices that describe its processing;
• honour opt-out and deletion requests it receives from Data Subjects, and stop including opted-out devices in future displays and Releases; where the law requires, Equatorium will tell the Agency about an opt-out or deletion that affects data the Agency still holds from a Release so that the Agency can decide what its own law requires;
• release identity-linked data only through the process in the Disclosure Policy, and apply the controls in Schedule 2; and
• keep the audit trail described in Schedule 2, available to the Agency’s administrators.

4.4 Data Breaches involving Data Services Data

Each party will notify the other without undue delay after becoming aware of a Data Breach affecting Data Services Data received from the other party, where the breach is likely to result in material loss, alteration, disclosure of or access to that data, and will cooperate in responding to it. Each party remains responsible for any notifications to regulators or Data Subjects that the law applicable to it requires.

4.5 CCPA and U.S. state laws

To the extent U.S. state privacy laws apply to the Agency’s receipt of Data Services Data: (a) Equatorium makes Data Services Data available to the Agency only for the limited and specified purposes of satellite terminal detection, spectrum licensing enforcement and, for Releases, the approved case; (b) the Agency will process that data only for those purposes and will provide the level of privacy protection the CCPA requires; (c) Equatorium may take reasonable and appropriate steps to stop and remediate any unauthorised use; and (d) the Agency will tell Equatorium if it can no longer meet these obligations.

#

5.1 Instructions

Equatorium processes Customer Content only on the Agency’s documented instructions. The Agreement, this DPA and the Agency’s use and configuration of the Platform (for example, inviting Users, uploading a document, creating a workflow, generating an export, or opening a support ticket) are the Agency’s complete instructions. Equatorium will tell the Agency if it believes an instruction breaks Data Protection Laws, and may suspend the affected processing until the instruction is changed. Equatorium may process Customer Content otherwise only where the law that applies to it requires; in that case, it will tell the Agency first unless the law forbids it.

5.2 Confidentiality

Equatorium will ensure that every person it authorises to process Customer Content is bound by a duty of confidentiality and accesses Customer Content only as needed to provide the Platform, give support, keep the Platform secure or comply with law. Equatorium staff access to Agency accounts is restricted by role, and staff changes to Agency accounts are logged.

5.3 Security

Equatorium will implement and maintain the technical and organisational measures in Schedule 2. Equatorium may update those measures as long as the update does not materially reduce the overall protection of Customer Content.

5.4 Sub-processors

• The Agency gives Equatorium general authorisation to engage Sub-processors. The current list is available on request from legal@equatorium.com, as described in Sub-processors & Data Partners.
• Equatorium will give at least thirty (30) days’ notice before adding or replacing a Sub-processor, by email to the Agency’s administrators.
• The Agency may object on reasonable grounds relating to data protection within that notice period by writing to privacy@equatorium.com. The parties will discuss the objection in good faith. If Equatorium cannot offer a reasonable alternative, the Agency may terminate the affected part of the Services and receive a pro-rata refund of prepaid, unused subscription fees for the terminated part. Unused credits are handled as set out in the Terms of Use.
• Equatorium will impose on each Sub-processor written data protection obligations no less protective than those in this DPA, and remains responsible to the Agency for each Sub-processor’s performance.

5.5 Assistance

Taking into account the nature of the processing, Equatorium will help the Agency, by appropriate technical and organisational measures, to respond to Data Subject requests about Customer Content, and to meet its obligations on security, breach notification, data protection impact assessments and prior consultation with regulators. Much of this is self-service: administrators can manage Users, change roles, read the audit log and export records. Equatorium may charge reasonable fees for assistance that goes beyond the Platform’s features, where the law allows.

5.6 Data Breach notification

Equatorium will notify the Agency without undue delay, and in any event within seventy-two (72) hours after becoming aware of a Data Breach affecting Customer Content. The notice will describe, as far as then known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed. Equatorium will supplement the notice as more information becomes available. Notice of a Data Breach is not an admission of fault or liability. Notices go to the Agency’s administrators by email and in the Platform.

5.7 Deletion and return

During the term, administrators can export Customer Content through the Platform’s export features. For ninety (90) days after the Agreement ends, the Agency may still export its Customer Content through those features. Within thirty (30) days after that export window closes, Equatorium will delete Customer Content, except for (a) billing and audit records it must keep under law or for the periods in the Retention Schedule, and (b) any residual copies, which are deleted in the ordinary course and are not restored to active use. Quant conversations are deleted as described in Section 6.

5.8 Records and audits

Equatorium will make available the information reasonably necessary to show its compliance with this Section 5. It will do this primarily by answering a reasonable security and privacy questionnaire once a year. If that is not enough to meet a requirement of Data Protection Laws or a regulator’s order, the Agency (or an independent auditor it appoints and that is bound by confidentiality) may audit Equatorium’s relevant processing on thirty (30) days’ notice, during business hours, no more than once a year, at the Agency’s cost, and in a way that does not compromise the security or confidentiality of other customers’ data or of the Data Services.

5.9 CCPA service-provider terms

Where the CCPA or a similar U.S. state law applies to Customer Content, Equatorium is a “service provider” or “processor”. Equatorium will not: (a) sell or share Customer Content; (b) retain, use or disclose it for any purpose other than the business purposes specified in the Agreement, or outside the direct business relationship with the Agency; or (c) combine it with personal information it receives from others, except as the law permits for service providers. Equatorium certifies that it understands and will comply with these restrictions, and will tell the Agency if it can no longer meet them.

#

Quant is the Platform’s AI assistant. It is described in full in Quant, the AI Assistant. For the purposes of this DPA:

• Questions a User asks, the parts of the Agency’s Platform data Quant reads to answer them, and Quant’s replies are processed by Equatorium as part of Customer Content under Section 5. Where Quant reads Data Services Data, Equatorium remains the controller of that data under Section 4.
• Quant uses an AI model provider acting as Equatorium’s Sub-processor. Quant Data is sent to that provider, which may process it in the United States.
• Under its commercial terms with Equatorium, the provider does not use Quant Data to train its models.
• Equatorium keeps Quant conversations for 90 days after their last message and then deletes them. A User can delete a conversation at any time in Quant, and it is deleted at once.
• Only the User who had a conversation can see it. The Agency’s administrators cannot.
• Quant never acts on its own. A suggestion takes effect only when a User presses Confirm, and confirmed suggestions are recorded in the Agency’s audit log.
• Quant is not used to make decisions that produce legal or similarly significant effects on any individual, and Quant cannot approve or release a Disclosure.

#

If Equatorium receives a request from a court, government authority or other third party (other than the Agency) for Customer Content, it will, unless legally prohibited, redirect the requester to the Agency and promptly notify the Agency so that it can seek a protective order or other remedy. Equatorium will disclose Customer Content only to the extent it is legally compelled to and will challenge requests it considers unlawful or overbroad. Equatorium’s approach is set out in Requests from Authorities & Third Parties.

#

8.1 Where data goes

Equatorium and its Sub-processors process personal data in the United States and in other countries where they operate. The current locations are available on request from legal@equatorium.com. Data Services Data released to an Agency is transferred to the Agency’s country.

Data residency. Equatorium hosts the Platform and Customer Content in the United States. In-country hosting is available only where agreed in an Order Form and may carry additional fees. The Agency is responsible for confirming that its national cybersecurity and government-data rules allow its Customer Content to be hosted outside its country.

8.2 SCCs

Where a transfer of personal data under this DPA is restricted under EU, UK or Swiss Data Protection Laws and is not to an Adequate Jurisdiction, the SCCs are incorporated into this DPA and apply as follows:

For each Module: Clause 7 (docking clause) applies; in Clause 9, Option 2 (general authorisation) applies with the notice period in Section 5.4; the optional language in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland; Annex I is completed by Schedule 1; Annex II by Schedule 2; and the competent supervisory authority is set out in Schedule 3.

For transfers from the United Kingdom, the UK Addendum applies: Table 1 is completed with the parties’ details in Schedule 1; Table 2 refers to the Modules above; Table 3 refers to Schedules 1 and 2; and in Table 4 either party may end the UK Addendum as allowed by its Section 19. For transfers from Switzerland, references to the GDPR include the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner is the competent authority, and “Member State” must not be read so as to exclude Data Subjects in Switzerland from bringing claims in their place of habitual residence.

8.3 Transfers under other laws

Where the Data Protection Laws of the Agency’s country require a transfer mechanism, approval or registration for transfers abroad, the parties will use the mechanism required by that law, which may include standard clauses issued by the local regulator, adequacy decisions or regulator approval. Equatorium’s legal team confirms the applicable requirements for each Agency on request at legal@equatorium.com.

8.4 Transfers to and between public bodies

A Release made to an Agency is a transfer to a public authority. The Agency is responsible for ensuring that its own law allows it to receive and use the data for the stated case. Where the Agency passes data to another public body (for example a prosecutor or court), the Agency is responsible for the lawfulness of that onward transfer and for applying any safeguards its law requires, including any government-to-government arrangement. Equatorium does not make Releases to any authority other than the Agency that made the approved request.

8.5 U.S. bulk data rules

The Agency will not sell, give access to or otherwise transfer Data Services Data to any “country of concern” or “covered person” as defined in 28 CFR Part 202, and will notify Equatorium immediately if it knows or suspects such access has occurred.

#

• Order of precedence. If there is a conflict, the following order applies: (i) the SCCs and any other transfer mechanism incorporated under Section 8; (ii) a signed Order Form or data processing terms individually agreed with the Agency, to the extent they expressly override this DPA; (iii) this DPA; (iv) the rest of the Agreement.
• Liability. Each party’s liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Terms of Use or the applicable Order Form, except where those limitations are not permitted under the SCCs or Data Protection Laws.
• Sovereign immunity. Nothing in this DPA waives any immunity of the Agency beyond what the Agency has agreed in writing.
• Term. This DPA takes effect when the Agreement does and ends automatically when the Agreement ends, except that obligations on deletion, confidentiality and the protection of data still held by either party survive for as long as that party holds the data.
• Governing law. This DPA is governed by the law that governs the Agreement, except where Data Protection Laws or the SCCs require otherwise.
• Changes. Equatorium may update this DPA to reflect changes in Data Protection Laws, regulator guidance or the Platform. Material changes that reduce the protection of personal data will be notified at least thirty (30) days in advance, unless a shorter period is required by law.

#

Questions about this DPA, Sub-processor objections and audit requests should be sent to privacy@equatorium.com. Legal notices under the Agreement go to legal@equatorium.com. Requests and notices to Equatorium are made by email.

#

Parties

Description of processing

#

Equatorium maintains the following measures and may update them as long as the overall level of protection is not reduced. Further detail is available to an Agency under confidentiality on request from legal@equatorium.com.

Access control and authentication

• Every User signs in individually, and two-step verification is available.
• Role-based permissions limit what each User can see and do.
• Each Agency’s data is kept separate from every other Agency’s data.
• Equatorium staff access to Agency accounts is restricted by role, and staff changes to Agency accounts are logged.

Logging and accountability

• Changes made on the Platform and disclosure activity are recorded in the Agency’s audit log.
• Logs are protected against unauthorised access and kept for the periods in the Retention Schedule.

Data protection by design

• Identity-linked data is released only under the Disclosure Policy.
• Releases can be checked for authenticity on the Check a release page.
• Card payments are handled by our payment processor.

Infrastructure

• Data is encrypted in transit.
• Changes to the Platform are reviewed before release.
• Systems are monitored, and failures are alerted to staff.

Organisational measures

• Personnel with access to personal data are bound by confidentiality obligations.
• Sub-processors are assessed before they are engaged and are bound by written data protection terms.
• Equatorium follows an incident response process that meets the notification commitments in Section 5.6.

#

• EU transfers: where Equatorium has appointed a representative under Article 27 GDPR, the supervisory authority of the Member State in which that representative is established; otherwise, the supervisory authority of the Member State in which the Data Subjects concerned are located.
• UK transfers: the Information Commissioner’s Office.
• Swiss transfers: the Federal Data Protection and Information Commissioner.
• Other jurisdictions: the data protection authority of the relevant country, as confirmed on request (see Country-Specific Privacy Information).

#

Each Data Partner must:

• comply with every law that applies to the collection, use and sharing of the data it supplies, including privacy, data protection, consumer protection, telecommunications, export control and sanctions laws, in every country where the data is collected and where the Data Partner operates;
• have, and be able to show, a lawful basis for collecting the data and for disclosing it to Equatorium for the purposes in Section 2;
• impose equivalent obligations on every upstream source from which it obtains the data (for example mobile app publishers, software development kit providers and other suppliers) and monitor their compliance; and
• comply with Equatorium’s Responsible Use & Platform Enforcement Policy as it applies to suppliers.

#

Equatorium uses supplied data to detect, locate and classify satellite terminals, to provide those findings to government licensing authorities, regulators and other public-sector customers for spectrum management and licensing enforcement, to release identity-linked data to those customers only through its Disclosure Policy, to keep its service secure and to improve its service. The Data Partner must ensure that its notices and consents, and those of its sources, cover these purposes.

#

• The Data Partner, and each app or other source from which it obtains data, must keep a clearly labelled, easy-to-find privacy policy that explains the collection of device identifiers, IP addresses, precise location, Wi-Fi information and other device data, and the sharing of that data with third parties.
• That privacy policy must name, or clearly describe, disclosure to companies that provide services to government and public-sector customers, including for spectrum licensing enforcement. Disclosure only “for advertising” or “for analytics” is not enough.
• The Data Partner’s own privacy policy must name Equatorium as a recipient. Sample language:

“We share device and location data with Equatorium, which provides satellite terminal detection services to government licensing authorities. Learn more: equatorium.com/legal#privacy-policy”

• Notices must be available before collection, in the languages of the users concerned, and must be kept up to date. On request, the Data Partner must give Equatorium copies of the notices that applied when particular data was collected.
• Equatorium will not onboard a Data Partner, or a new source of a Data Partner, whose sample notices do not meet this Section 3.

#

• Where law requires consent for the collection of precise location, the access to device storage, or the disclosure of data to Equatorium, the Data Partner (or its source) must obtain a valid, specific, informed and freely given consent that covers the purposes in Section 2, before the data is collected or shared.
• Operating-system permissions (for example the location permission on iOS or Android) must be obtained in the way the platform requires, and the purpose string shown to users must not be misleading.
• The Data Partner must pass to Equatorium, with each record, the consent information received with it, and must not alter it.
• On request, the Data Partner must give Equatorium evidence of consent, including the date and the consent language shown to the user.
• Data collected where consent was refused, withdrawn or not obtained when required must not be supplied.

#

• The Data Partner must honour every privacy choice made known to it, including device settings that limit ad tracking or reset or zero the advertising ID, App Tracking Transparency choices, Global Privacy Control and other legally recognised opt-out preference signals, and opt-outs of sale, sharing or targeted advertising.
• Records from devices that have opted out must be removed before supply, and must not be supplied again after the opt-out.
• The Data Partner must keep a mechanism for individuals to exercise their rights (access, deletion, opt-out and others) and must pass deletion and opt-out signals concerning supplied data to Equatorium within five (5) business days, in the format Equatorium specifies, so that Equatorium can stop using data about the device.
• The Data Partner must cooperate with Equatorium to respond to requests and complaints from individuals and regulators about supplied data.

#

• The Data Partner must not supply data about any person under 16, or any higher age at which a person is treated as a child under applicable law.
• The Data Partner must not supply data collected through any app, website or service that is designed for or directed to children, or that falls under the U.S. Children’s Online Privacy Protection Act or similar laws, or from any device flagged as belonging to a child (for example through app store age signals or child-directed treatment flags).
• If the Data Partner learns that it has supplied such data, it must tell Equatorium promptly so that the data can be deleted.

#

The Data Partner must not supply:

• names, postal addresses, phone numbers, government ID numbers, unhashed email addresses or payment data;
• health information, protected health information, or any data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation;
• the contents of communications, browsing history or app usage beyond the fields listed in the Data Agreement;
• location records at or near sensitive locations, including medical and reproductive health facilities, places of worship, shelters for domestic violence or homeless people, refugee and migrant facilities, addiction and mental health facilities, schools and childcare facilities, correctional facilities, union offices, and military installations; and
• any data the Data Partner does not have the right to supply, or that was collected by deception, malware or any method that breaches a platform’s terms.

If prohibited data is supplied by mistake, the Data Partner must tell Equatorium and help it delete the data.

The Data Partner must remove sensitive-location records before supply.

#

• The Data Partner must not be, or be owned or controlled by, a person subject to sanctions administered by the United States, the United Nations, the European Union or the United Kingdom, or a “covered person” under 28 CFR Part 202.
• The Data Partner must not supply data in a way that would make the supply, or Equatorium’s use, a prohibited or restricted “data transaction” under 28 CFR Part 202, the U.S. Protecting Americans’ Data from Foreign Adversaries Act, or similar laws.
• The Data Partner must tell Equatorium which countries its data covers, and must meet the data localisation and cross-border transfer rules of each country where the data is collected.

#

• Data must be accurate to the best of the Data Partner’s knowledge, delivered in the agreed schema, and must not be fabricated, synthetic or padded unless clearly labelled.
• Each record must carry the fields needed to trace it, such as the collection timestamp, the source category and the consent signal.
• The Data Partner must keep records of its sources, the notices and consents that applied, and the opt-outs it has honoured, for at least as long as Equatorium holds the data, and give them to Equatorium on request.
• The Data Partner must tell Equatorium promptly about any change in its sources, collection methods or legal position that could affect the lawfulness of data already supplied.

#

• The Data Partner must protect the data with appropriate technical, physical and organisational measures, including encryption in transit and at rest, access controls and logging, and must use only the delivery channels Equatorium approves.
• The Data Partner must tell Equatorium without undue delay, and in any event within seventy-two (72) hours after becoming aware of a breach affecting supplied data or the systems used to supply it, and must cooperate in the response.
• The Data Partner must carry cyber and privacy liability insurance with limits of at least USD 1,000,000 per claim and provide a certificate on request.

#

Equatorium reviews each Data Partner before onboarding and periodically after that. On reasonable notice, the Data Partner must answer Equatorium’s due-diligence questionnaires, provide samples of notices and consent flows from its sources, and allow Equatorium, or an independent auditor bound by confidentiality, to verify compliance with these Requirements. The Data Partner pays for an audit that reveals a material breach; otherwise each party bears its own costs. Equatorium may stop accepting data from a Data Partner while a concern is investigated.

Each year, the Data Partner must certify in writing that it complies with Sections 3 to 8 and list the countries from which its data originates.

#

• If a Data Partner breaches these Requirements, Equatorium may stop accepting its data, quarantine or delete data already received, withhold or adjust payments, and terminate the Data Agreement.
• When the Data Agreement ends, Equatorium will stop accepting the Data Partner’s data. Data already received will be kept or deleted as set out in the Data Agreement and Equatorium’s Retention Schedule; data that the Data Partner tells Equatorium was supplied unlawfully will be deleted.
• The Data Partner will defend, indemnify and hold harmless Equatorium from claims, regulatory investigations, fines, deletion costs and reasonable legal fees arising from (a) data supplied without the notices, consents or rights these Requirements call for, or (b) breach of Sections 3 to 8. No limitation of liability in the Data Agreement applies to this obligation.
• Sections 5, 7, 8, 9 and 12 survive the end of the Data Agreement for as long as Equatorium holds data the Data Partner supplied.

#

Equatorium may update these Requirements to reflect changes in law, regulator guidance or its service, and will give Data Partners at least thirty (30) days’ notice of material changes. Questions should be sent to privacy@equatorium.com. The current list of Data Partners is available on request from legal@equatorium.com, as described in Sub-processors & Data Partners.

#

Equatorium Corporation is a Delaware corporation. Equatorium is responsible for the personal data described in this Policy (it is the “controller” or “business” for that data under most privacy laws), except where Section 2 says otherwise. Requests and notices to Equatorium are made by email.

Different people interact with us in different ways, so this Policy is organised around three contexts:

• Data Services. Our “Data Services” are the detection, location and evidence services we provide to our customers through the Platform. To provide them, we license device and location data from third-party data suppliers (“Data Partners”). If you use a mobile device, information about that device may reach us from a Data Partner even though you have never visited our website or heard of us. Sections 3 to 8 explain this processing.
• Platform. Our “Platform” is the secure web application used by our customers, which are government bodies we call “Agencies,” and by Equatorium staff. If you are an employee or contractor of an Agency who holds a Platform account (a “User”), Sections 9 and 10 explain how we handle your information.
• Website. Our “Website” is equatorium.com and its public pages, including the briefing request form, sign-up, public support, Privacy & Legal and “Check a release.” If you visit the Website, request a briefing, apply for an account, or contact our support team, Sections 9 and 10 also apply to you.

Separate notices cover job applicants (Applicant Privacy Notice) and requests made to us by governments and other third parties outside the disclosure process (Requests from Authorities & Third Parties).

#

This Policy does not describe how others handle data, including:

• Agencies’ own use of information. When an Agency views terminal information on the Platform, exports it, or receives a release through our Disclosure Policy, the Agency uses that information for its own regulatory, licensing or legal purposes. Each Agency is an independent controller of the information it receives and is responsible for its own compliance with the laws that apply to it, including its own retention, onward-sharing and individual-rights obligations. Our Terms of Use, Responsible Use & Platform Enforcement Policy and Customer Data Processing Agreement restrict what Agencies may do, but this Policy does not govern an Agency’s activities after information leaves the Platform.
• Data Partners and the apps they work with. Data Partners and the mobile applications and software providers they obtain data from have their own privacy policies and are responsible for the notices and consents they provide to you. We require them to meet our Data Partner Requirements.
• Third-party websites and services. Links from our Website or Platform to other websites, or services you reach through them, are governed by those third parties’ policies.
• Starlink. Equatorium is not affiliated with, endorsed by, or acting on behalf of Starlink or its operator. We do not receive subscriber records from Starlink.

#

Data Partners collect information from mobile devices, typically through mobile applications and the technologies built into them, and make it available to us. We do not collect it directly from your device, and we do not operate consumer apps.

Depending on the Data Partner and the record, we may receive the following categories of information:

We do not ask Data Partners for, and do not seek to receive, names, readable phone numbers, government identifiers, financial account details, health information, biometric data, the content of communications, or information about racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, or sex life or sexual orientation. If we receive any such information by mistake, we delete it. Our Data Partner Requirements prohibit Data Partners from sending it.

Some of the information above can identify you, alone or in combination. Precise geolocation is treated as “sensitive” personal data under many privacy laws. Section 7 explains how this is treated as a “sale” under certain U.S. state laws.

#

Our Data Services are designed to find terminals: Starlink satellite dishes and similar equipment operating in a country, so that the Agency responsible can check them against its licensing records. The object of our analysis is the terminal, not a person. A “terminal record” represents one terminal as we observe it over time.

We identify terminals by automated analysis of the information described in Section 3. Detection is automated: the results reach the Agency without a person at Equatorium reviewing each one, and the Agency decides what, if anything, to do about them.

From that analysis we create and maintain:

• Terminal records, each with a terminal number.
• Location information: an estimated position of the terminal, the area it falls in, and the nearest street address. The nearest address is derived, not verified, and may be wrong.
• History: the places a terminal has been and when it was active there.
• Classification: an assessment of whether the record is likely to be a Starlink terminal, with plain-language reasons.
• Device lists: the devices seen connected through a terminal, with their advertising ID and device information.
• Device places: for some devices, an estimate of the device’s home and work places.

We may combine information from more than one Data Partner, and with reference information such as maps and administrative boundaries, to improve accuracy.

#

We use the information we receive and derive in our Data Services to:

• Provide the Data Services: detect and locate terminals, maintain terminal records, run the scans and alerts that Agencies schedule, answer Agency searches, and prepare releases approved under our Disclosure Policy.
• Maintain quality: measure and improve the accuracy of detection and location, and correct errors.
• Protect people and the service: apply our policies to disclosure requests, including denying requests that concern conflict areas, journalists or other protected activity; detect misuse of the Platform; and secure our systems.
• Honour your choices: keep a record of devices whose users have opted out so that their information is not used again.
• Comply with law: meet legal obligations, respond to lawful requests as described in our Requests from Authorities & Third Parties page, and establish, exercise or defend legal claims.

We do not use the information we receive for our Data Services to market to you, and we do not use information collected through our Website to provide our Data Services.

#

Agencies

We provide Data Services only to Agencies that pass our vetting process and agree to our Terms of Use and Responsible Use & Platform Enforcement Policy. Agencies receive information at two levels:

• Terminal information, available to Agency Users without a disclosure request. This includes a terminal’s estimated location, area and nearest address; when it was active; the reasons for its classification; and the devices seen connected through it, with their advertising IDs and device information. Equatorium does not treat advertising IDs as identity-linked information for the purposes of the Disclosure Policy, but they are personal data and are covered by this Policy.
• Identity-linked information, available only through an approved disclosure. Hashed contact identifiers, consent information, network prefixes, Wi-Fi access point identifiers, device details released as evidence, and device home and work places are made available to an Agency only through our Disclosure Policy, which requires a stated legal basis and review by Equatorium.

Agencies may use information they receive for spectrum licensing, enforcement of licensing requirements and other purposes within their mandate as approved by Equatorium, in each case as permitted by our terms and the law that applies to them. Agencies may combine what they receive with other information they hold, including information that identifies individuals.

Service providers

We disclose information to service providers that host, store, process or secure data for us under contracts that limit their use of it to providing services to us. The current list of our sub-processors and Data Partners is available on request from legal@equatorium.com.

Legal, safety and protection

We may disclose information where we believe in good faith it is required by law, regulation or valid legal process, or necessary to protect the life, safety or rights of any person, to detect and prevent fraud or security incidents, or to establish, exercise or defend legal claims. Requests from governments that are not Agencies using the Platform are handled under our Requests from Authorities & Third Parties page.

Business transfers

If we are involved in a merger, acquisition, financing, reorganisation, sale of assets, or insolvency or similar proceeding, information may be disclosed or transferred as part of that transaction, subject to this Policy or protections at least as strong.

Affiliates

We may share information with companies under common control with Equatorium, who must handle it in line with this Policy.

#

Notice: We sell personal data, including sensitive personal data (precise geolocation).

Agencies pay us for access to our Data Services. Because the information Agencies receive includes device identifiers, network information and precise geolocation linked to devices, our provision of the Data Services is a “sale” of personal data, and of sensitive personal data, as those terms are defined under several U.S. state privacy laws, and may be treated similarly under other laws. In the preceding twelve months, the categories of personal data we have sold or made available in this way are:

• identifiers (advertising IDs, network information, and, through approved disclosures, hashed contact identifiers);
• precise geolocation (terminal locations and, through approved disclosures, device home and work places);
• internet or network activity (including, through approved disclosures, Wi-Fi access point identifiers);
• device information; and
• inferences (classifications and estimated places).

The categories of third parties to whom we sell this information are government Agencies that subscribe to the Platform. We do not sell personal data about Platform Users, Website visitors, briefing requesters or support contacts.

You can opt out of the sale of your device’s information, and request deletion, as described in Section 11 and on our Your Privacy Choices page.

#

• We do not include names in releases, and we do not resolve hashed contact identifiers or other identifiers to names on behalf of Agencies.
• We do not use Data Services information to make or support decisions about credit, employment, housing, insurance, education, healthcare or eligibility for benefits, or to set prices.
• We do not use Data Services information to market to individuals, to build advertising audiences or to target advertising.
• We do not sell or license Data Services information to data brokers, advertisers, marketers or other commercial resellers.
• We do not allow Agencies to use the Platform to monitor journalists, human rights defenders, political activity, religious practice or other protected activity, and requests concerning conflict areas are denied. See our Responsible Use & Platform Enforcement Policy.
• We do not approve a disclosure request automatically because time has run out.
• We do not knowingly process information about children (see Section 15).

#

This section applies to Agency Users, Equatorium staff using the Platform, Website visitors, people who request a briefing or apply for an account, and people who contact our support team.

If you provide information about another person, for example by inviting a colleague, naming an assignee or uploading a court order, you confirm that you are entitled to do so.

#

How we use it

• To vet briefing requests and sign-ups, confirm that applicants act for a genuine public authority, and create and manage accounts.
• To provide the Platform: run searches, scans, alerts, tasks, disclosures, exports and Quant, and show each User only what their role permits.
• To bill Agencies, process payments, manage credits and subscriptions, and keep financial records.
• To provide support, including calling you back when you ask us to.
• To send service messages, such as sign-up and security emails, task and alert notifications, billing notices and policy changes, at the frequency you choose where a choice is offered.
• To keep audit logs so that Agencies and Equatorium can see who did what and when.
• To secure the Platform, prevent fraud and abuse, enforce our terms, and investigate misuse.
• To understand how the Platform is used and improve it.
• To comply with law and establish, exercise or defend legal claims.

Who we share it with

• Your Agency. Administrators at your Agency can see your account details, role and activity in the audit log. They cannot see your Quant conversations.
• Service providers that host, authenticate, process payments, send email, provide maps and power Quant for us. The current list is available on request from legal@equatorium.com.
• Legal and safety recipients as described in Section 6.
• Business transfer recipients as described in Section 6.
• Others with your consent or at your direction.

We do not sell Platform or Website information, and we do not share it for cross-context behavioural advertising.

Marketing

We may send business contacts information about our services where the law allows. You can unsubscribe at any time using the link in the email or by writing to privacy@equatorium.com. We will still send service messages that are needed to run your account.

Quant, the AI assistant

When you ask Quant a question, your question, the organisation data Quant reads to answer it and Quant’s reply are processed by an AI model provider acting as our sub-processor. Only you can see your conversations, and you can delete them at any time. About Quant, the AI Assistant explains what is sent and how long it is kept.

Cookies

We use only cookies and similar technologies that are needed to sign you in, keep the Platform secure, process payments and remember your preferences. We do not use advertising or analytics cookies. See our Cookie & Similar Technologies Notice.

#

If information about your device may be in our Data Services

• Opt out and delete. Email privacy@equatorium.com with your device’s advertising ID. We will stop using and selling information linked to that advertising ID, delete the records we hold for it, and keep a record of the opt-out so the information is not used again.
• Opt-outs are device-specific. An opt-out applies to the advertising ID you give us. If you use more than one device, send a request for each. If you reset your advertising ID, the new ID is not covered and you will need to send a new request.
• Device settings. You can limit the information available to Data Partners by turning off location services for apps you do not trust, deleting or resetting your advertising ID or limiting ad tracking in your device settings, and reviewing the privacy settings of the apps you use.
• Access. You may ask us to confirm whether we hold information associated with your advertising ID and to provide a copy.

Records already released to an Agency before your request are held by that Agency as an independent controller. We cannot delete them, but our deletion stops any further disclosure by us.

If you are a Platform User, Website visitor or support contact

You may ask to access, correct, delete or receive a copy of your information, or object to or restrict certain uses, by emailing privacy@equatorium.com. Agency Users can update much of their information in their account settings; some requests, such as deleting a User, are handled through your Agency’s administrator.

How we handle requests

We will verify requests in a way appropriate to the information involved, respond within the time required by applicable law, and not discriminate against you for exercising your rights. You may use an authorised agent where the law allows. If we decline a request, we will explain why and how to appeal. Details are on our Your Privacy Choices page and in the regional notices.

#

Sensitive data

Precise geolocation, and estimates of where a device is at home or at work, are sensitive. We limit their use to the purposes in this Policy, restrict access by role, and make device places available only through our Disclosure Policy. We do not seek to collect any other category of sensitive data, and we do not infer characteristics such as health, religion, ethnicity, political views or sexual orientation from location data. Where location may reveal attendance at a sensitive place, we do not label or report it as such.

Automated processing

Our automated analysis produces classifications and reasons. These are information for the Agency, not decisions. Equatorium does not make any decision that produces legal or similarly significant effects for an individual. Every disclosure is reviewed by people under our Disclosure Policy, and any enforcement or licensing action is decided by the Agency under its own legal authority and procedures.

#

Equatorium and many of our service providers are located in, or host data in, the United States. Data Partners may provide information about devices located in many countries, and Agencies are located in many countries. As a result, personal data is transferred to and processed in countries other than the one where it was collected, which may not provide the same level of protection.

Where the law requires, we protect transfers with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent mechanisms recognised in the relevant country. Equatorium is not certified under the EU-U.S. Data Privacy Framework. You may request a copy of the relevant safeguards by contacting us.

We do not sell, provide access to or otherwise transfer Data Services information to countries of concern or covered persons as defined in 28 CFR Part 202, and our Terms of Use prohibit Agencies from doing so.

#

We use administrative, technical and physical safeguards designed to protect personal data against loss, misuse and unauthorised access, disclosure, alteration and destruction, taking into account the sensitivity of location data. They include:

• encryption of data in transit;
• role-based access, so each User sees only what their role and Agency permit, and data of one Agency is never visible to another;
• two-step verification for Platform accounts;
• an audit log of changes made on the Platform;
• release of identity-linked data only under our Disclosure Policy;
• limited access for Equatorium staff, based on their role;
• vetting of Agencies before accounts are activated; and
• confidentiality obligations for staff.

No security measure is perfect, and we cannot guarantee that information will never be accessed, disclosed or altered without authorisation. We maintain procedures for responding to suspected incidents, and we will notify affected Agencies, individuals and regulators where the law requires. Please report security concerns to security@equatorium.com.

#

Retention

We keep personal data only as long as needed for the purposes described in this Policy, unless a longer period is required by law or to resolve disputes. For example, release contents are deleted when the release window shown on the release ends; Quant conversations are kept for 90 days after their last message; and account information is kept for the life of the account plus 2 years. Other periods are set in our retention settings, within the limits or using the criteria given for each kind of record in our Data Retention Schedule.

Children

Our Website and Platform are intended for officials of government Agencies and are not directed to children. We do not knowingly collect or process personal data about children. Our Data Partner Requirements require Data Partners to exclude data about users under 16 (or any higher age set by local law) and data from apps directed to children. If we learn that we hold information about a child, we delete it. If you believe we may hold such information, contact privacy@equatorium.com.

#

Additional information and rights apply depending on where you live:

• United States. Residents of U.S. states with comprehensive privacy laws should read our U.S. State Privacy Notice.
• European Economic Area, United Kingdom and Switzerland. See our EEA, UK & Swiss Privacy Notice for our lawful bases, your rights and how to complain to a supervisory authority.
• Other countries. Local law may give you more rights. See Country-Specific Privacy Information for how to ask us about the law where you live.

Where a regional notice conflicts with this Policy for residents of that region, the regional notice prevails.

#

We may update this Policy to reflect changes in our practices, legal requirements or services. We will post the updated Policy here and change the “Last updated” date. If we make material changes, we will give notice before they take effect, for example by email to Agency Users, by a notice on the Platform, or by a prominent notice on the Website. Where the law requires your consent to a change, we will ask for it.

#

If you have questions or complaints about this Policy or our privacy practices, or wish to exercise your rights, contact our privacy team at privacy@equatorium.com.

Details of our representatives in the EU and the UK, where one is required, are available on request to legal@equatorium.com. Requests and notices to Equatorium are made by email. Agency Users with account or Platform questions should use in-app Support; others can reach our support team at /support/public.

#

• Purpose-limited. We keep each record only as long as it is needed for the purpose for which we hold it, as described in the Privacy Policy.
• Shortest workable period. Where a record is sensitive, such as precise geolocation and identity-linked device data, we choose the shortest period that still allows us to provide accurate Data Services and to account for what we have disclosed.
• Defined triggers. Every period runs from a defined event, such as the date a record was collected, an account was closed, or a release expired.
• Deletion by default. Records are deleted when their period ends, unless a legal hold applies (Section 3) or the law requires us to keep them longer.
• Longer periods only where required. We keep records longer than the periods below only where required by law, tax or accounting rules, or to establish, exercise or defend legal claims.

#

Agencies are independent controllers of the information they export from the Platform or receive in a release. Once information leaves the Platform, the Agency’s own retention rules apply to its copy.

#

We suspend deletion of specific records when we are under a legal obligation to preserve them, for example because of litigation, a regulatory investigation, an audit, or a preservation request we are required to honour. A hold applies only to the records it covers and only for as long as it is needed; when it is lifted, the normal schedule resumes and records already past their period are deleted. We may also keep a record longer where it is needed to investigate a security incident or a breach of our Responsible Use & Platform Enforcement Policy.

#

If a copy of a deleted record remains in any recovery copy, it is not restored to active use and is deleted in the normal course.

#

We may keep information that has been de-identified or aggregated so that it can no longer reasonably be linked to a device or a person, such as counts of terminals per area and service usage totals, for longer than the periods above. We take reasonable measures to prevent re-identification of such data, we do not attempt to re-identify it, and we require anyone we share it with to do the same.

#

If you ask us to opt out and delete under our Your Privacy Choices page, we do not wait for the scheduled period to end:

• we delete the device records associated with the advertising ID you give us;
• we keep a record of the opt-out so the device’s data is not used again;
• terminal records are updated so they no longer rely on your device; and
• we keep the minimum information needed to show that we handled your request, and the disclosure audit trail, where the law requires it or to defend legal claims.

Deletion does not reach copies already held by an Agency that received a release before your request. Requests from Platform Users and Website contacts are handled under the same approach, subject to records we must keep for billing, tax, audit or legal reasons.

#

“Cookies” are small text files that a website stores in your browser and reads back on later visits. Session cookies are deleted when you close your browser; persistent cookies remain until they expire or you delete them. First-party cookies are set by the site you are visiting; third-party cookies are set by another domain, such as a service embedded in the page.

“Local storage” and “session storage” are areas of your browser where a site can keep small amounts of data, such as a display preference. Pixels and web beacons are tiny images or scripts that report when a page or email is opened. We refer to all of these together as “cookies and similar technologies.”

#

All of the technologies below are strictly necessary to provide a service you have asked for, or to keep it secure, except continuity, which is functional.

What we do not use

• No advertising or retargeting cookies.
• No analytics cookies or session-recording tools.
• No social media plug-ins or pixels.

If we ever add a technology that is not strictly necessary, we will update this notice first and ask for your consent where the law requires.

#

The Platform’s maps come from a map provider. When your browser loads a map, it sends requests directly to that provider, which receives your IP address, browser information and the map area being displayed.

Card fields on billing pages are provided by our payment processor, which receives the card details you enter.

The current list of our service providers is available on request from legal@equatorium.com.

#

Our emails are service messages: sign-up steps, security alerts, task and alert notifications, billing notices and policy changes. They contain links that perform a specific action, for example to confirm your email or to unsubscribe from a type of notification. We do not use our emails to track your browsing.

#

We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale or sharing of personal data associated with that browser, in line with applicable law. Because we do not use advertising or analytics technologies on the Website or Platform, and do not sell Website or Platform information, there is no further cookie-based processing for the signal to switch off. A GPC signal does not by itself opt your mobile device out of our Data Services, because we cannot link your browser to your device’s advertising ID; to do that, see our Your Privacy Choices page.

There is no agreed standard for responding to Do Not Track signals. Our practices are the same whether or not your browser sends one, since we do not track you across sites.

#

Most browsers let you view, block and delete cookies and local storage in their settings. Because the technologies we use are strictly necessary, blocking them will prevent you from signing in to the Platform, completing sign-up or adding a payment method; the public pages of the Website will still work. Clearing local storage resets your display preferences.

Where the law requires consent for any non-essential technology, we will ask for it before using that technology and let you change your choice at any time.

#

We will update this notice if we change the technologies we use, and change the “Last updated” date above. Questions can be sent to privacy@equatorium.com.

#

Email privacy@equatorium.com and tell us what you would like us to do: opt out, access, delete or correct. For device data, include the device’s advertising ID. Platform users should write from the email address on their account.

Requests are free. We do not require you to create an account. We will never ask for your name to process a device opt-out.

#

The data we receive from Data Partners is organised around a device's mobile advertising ID, not around your name. To stop us using your device’s data, email us an opt-out request with that advertising ID.

Find your advertising ID

• Android: Settings › Google › All services › Ads, or Settings › Privacy › Ads. The ID is shown as “Your advertising ID”. Menu names vary by manufacturer and Android version.
• iPhone and iPad (iOS): iOS does not show the Identifier for Advertisers (IDFA) in Settings, and most apps can read it only if you allowed them to track you. If you have never allowed tracking, apps may have received no IDFA from your device. In that case, contact us and we will help you with your request.

What happens when you opt out

• We stop using and selling data linked to that advertising ID.
• We delete the device records we hold for that ID within 30 days, including location, network and device information and estimated home and work places.
• We stop showing the device to Agencies and exclude it from any future disclosure release.
• We keep a record of the opt-out for as long as we operate the Data Services, so the device’s data is not used again.

Limits you should know about

• Device-specific. An opt-out covers only the advertising ID you submit. If you use several devices, send each one.
• Resetting your ID. If you reset or delete your advertising ID, the device gets a new one that is not covered by your opt-out. Send a new opt-out for the new ID. Deleting the ID entirely also stops most apps from sharing it.
• Past releases. Before your opt-out, an Agency may already have received data about the device through an approved disclosure. We cannot recall data from an Agency. Where the law requires, we will tell the Agency about your request. To make a request about data an Agency holds, contact that Agency directly.
• Data Partners and apps. Our opt-out does not stop the apps on your device or our Data Partners from collecting data for their own purposes. Use the controls below as well.

Device controls that reduce data collection

• Location Services. Turn off location access for apps that do not need it. On iOS go to Settings › Privacy & Security › Location Services. On Android go to Settings › Location › App location permissions.
• Tracking and ads. On iOS, turn off “Allow Apps to Request to Track” (Settings › Privacy & Security › Tracking). On Android, delete your advertising ID (Settings › Privacy › Ads › Delete advertising ID).
• App permissions. Review which apps can see nearby Wi-Fi networks or precise location.

#

You can ask us to confirm whether we hold data about you and to send you a copy.

For a device, we will tell you:

• the categories of data linked to the advertising ID and the date range we hold
• whether the device has been associated with a terminal record
• whether any of its data has been released to an Agency, where the law allows us to say so and doing so would not prejudice a lawful investigation

Location history is precise and sensitive. An advertising ID alone does not prove you own a device. We therefore send precise location data only after the stronger verification described in section 6. We deliver it in a structured, machine-readable format.

For Platform users and contacts, we will send your account, contact, support and audit data that relates to you. Quant conversations are visible only to you in the Platform, and you can delete them there at any time.

#

Deletion. For a device, a deletion request does everything an opt-out does (section 2). We keep a record of the request so that the device’s data is not used again. For Platform users, we delete your account data under the periods in the Data Retention Schedule after your Agency's administrator removes you from the Platform, or sooner when you ask us. We may keep some records that we are legally required to keep, or that we need to establish or defend legal claims. Examples are:

• audit log entries showing that you made or approved a disclosure request
• invoices

The Data Retention Schedule sets out the periods.

Correction. You may ask us to correct inaccurate data. Device data reflects what Data Partners observed. If you believe a device or place has been wrongly associated with a terminal or with you, tell us why. We will review the record, correct or remove it where appropriate, and note the dispute. Platform users can update their name and notification settings in their account settings. An Agency administrator can change roles.

#

• Emails. Every non-essential email from the Platform contains an unsubscribe link. You can change email frequency in your notification settings. We will still send essential account, security and billing messages.
• Cookies. We use only strictly necessary cookies. See the Cookie & Similar Technologies Notice.
• Global Privacy Control. We honour GPC browser signals as an opt-out of sale and sharing for that browser. A browser signal cannot reach a mobile advertising ID, so email us to opt out a device.
• Quant. You can delete any Quant conversation at any time. It is deleted at once. See About Quant, the AI Assistant.

#

• Opt-out: no verification beyond a valid advertising ID. Anyone who submits an ID can stop its use. This protects people quickly and carries little risk.
• Deletion: a valid advertising ID and a working email address to receive confirmation.
• Access to device data: proof that you control the device, for example a screenshot of the device’s settings showing the ID.
• Platform users and contacts: a confirmation from the email address we hold.

We use verification information only to process your request. We then delete it, keeping a record of the request as the law requires.

#

Someone you authorise may submit a request for you. They must provide your signed written permission or a valid power of attorney. We may ask you to confirm the authorisation directly with us and to verify your identity for access and deletion requests. Parents and legal guardians may submit requests for a minor.

#

We publish yearly figures in our annual transparency report, described in Privacy Request Statistics.

#

We may decline all or part of a request. Reasons include:

• we cannot verify it
• it would reveal another person's data
• it is manifestly unfounded or excessive
• the law requires or allows us to keep the data

We will explain our reasons. You can appeal by replying to our decision, or by emailing privacy@equatorium.com with the subject “Privacy request appeal”. Someone who was not involved in the first decision will review it. You can also complain to your data protection regulator. Regulators are listed in the regional notices.

#

• Agencies. Data an Agency received through an approved release is held by that Agency under its own law. Contact the Agency to exercise rights over it.
• Data Partners and apps. They collect and share data under their own privacy notices. Contact them, or use your device controls, to stop collection at the source. The current list of our Data Partners is available on request from legal@equatorium.com.
• Starlink. We are not affiliated with Starlink. We cannot act on your Starlink account.

#

Each report covers one calendar year and includes:

• Privacy requests from individuals: the number of requests to know or access, delete, correct, opt out of sale, and limit the use of sensitive personal information; how many we complied with in whole or in part; how many we denied; and the median number of days we took to respond.
• Disclosure requests from Agencies: the number of requests submitted, released, denied, declined, withdrawn and expired, broken down by case type.
• Requests from other authorities and third parties: the number of requests we received under legal process or in an emergency from bodies that are not Agency customers, as described in Requests from Authorities & Third Parties, and how many resulted in disclosure. Where the law allows, requests under non-disclosure orders are reported in ranges.

Figures are aggregated so that no individual, Agency or case can be identified.

#

• A request is counted once, under the type the requester chose. A combined request, such as delete and opt out, is counted under each type.
• Complied with in whole or in part includes opt-outs we applied to an advertising ID even where we held no data for that ID.
• Denied includes requests we could not verify, requests from unauthorised agents, and requests the law allowed us to refuse.
• Median days runs from receipt to our substantive response.
• A disclosure request that expires before a decision is counted as expired, not as released.

#

The report is published here each year. A draft of the current report, including the underlying data where needed, is available on request from privacy@equatorium.com.

#

Before engaging a Sub-processor, Equatorium assesses its security and privacy practices. Each Sub-processor is bound by a written agreement that limits its use of personal data to providing services to Equatorium, requires appropriate security measures and confidentiality, and includes the transfer safeguards required by law. Equatorium remains responsible for each Sub-processor’s performance as set out in the Customer Data Processing Agreement.

Each Data Partner must meet the Data Partner Requirements, including the rules on notice, consent, opt-outs and prohibited data, and is reviewed before onboarding and periodically after that.

#

The current list of Sub-processors and Data Partners, with the function each performs and where it processes data, is available on request from legal@equatorium.com. Agencies, their counsel and individuals exercising privacy rights can ask for it.

Equatorium gives Agencies at least thirty (30) days’ notice before adding or replacing a Sub-processor, by email to each Agency’s administrators. An Agency may object as described in Section 5.4 of the Customer Data Processing Agreement.

#

Equatorium Corporation (“Equatorium,” “we,” “us”) operates a platform that detects and locates Starlink satellite terminals for licensing authorities and other government bodies (“Agencies”). People interact with us in three main ways:

• Device users. We receive data about mobile devices, including devices that may belong to you, from third-party “Data Partners”. We use it to provide our “Data Services”. You may never have dealt with us directly. Most of this Notice is about this group.
• Platform users. Agency staff who hold an account on the Equatorium web application (the “Platform”), and the Agency contacts we deal with.
• Website visitors and enquirers. People who visit equatorium.com, request a briefing, apply to sign up, or send a message through public support.

Some State Privacy Laws exempt certain data or relationships. Examples are data processed in a business-to-business or employment context, and data a government entity processes for itself. Where an exemption applies, we may still choose to honour a request. We do so when it is practical and lawful.

#

The table below covers our practices now and during the 12 months before the date of this Notice. For each category of personal information it shows:

• the sources it comes from
• why we collect it
• who we disclose it to for a business purpose
• whether we sell or share it

Under the State Privacy Laws, “sell” has a wide meaning, and “share” covers disclosures for cross-context behavioural advertising.

We do not use personal information to decide anyone’s eligibility for employment, credit, insurance, housing, education or health care.

We use personal information for the purposes listed in the Privacy Policy. We do not use sensitive personal information to infer characteristics about you beyond what the Data Services need to identify and locate satellite terminals.

Identity-linked data, such as hashed email addresses, consent information, network prefixes, Wi-Fi access point identifiers and the home and work places of devices, is released to an Agency only through our Disclosure Policy, which requires a stated legal basis and review by Equatorium. Agencies can see device advertising IDs on terminal views without a disclosure.

#

• Data Partners. These are third parties who license us data about mobile devices, collected from mobile apps under their own notices and consents. We take no part in that collection.
• You and your devices. This covers information you give us when you request a briefing, sign up, use the Platform or contact support. It also covers information collected automatically when you use our website or Platform.
• Agencies. An Agency administrator may invite you to the Platform or assign you a role.
• Service providers. For example, our payment processor tells us whether a card was authorised, and our authentication provider tells us whether two-step verification is enabled.
• Derived information. This is information we generate from the above, such as terminal records, classifications and estimated places.

#

Notice: We may sell your sensitive personal data. Notice: We may sell your precise geolocation data.

We provide the Data Services to Agencies for a fee. The State Privacy Laws define “sale” broadly. Under them, disclosing personal information to our Agency customers as part of those services is a sale. In the 12 months before the date of this Notice, we sold the following categories of personal information:

• Identifiers (advertising IDs; through approved disclosures, also hashed email addresses and network prefixes)
• Internet or other network activity
• Precise geolocation data (sensitive personal information)
• Device information, including Wi-Fi access point identifiers (through approved disclosures)
• Inferences, including estimated home and work places of devices (through approved disclosures)

Categories of third parties to whom we sell. Government agencies that subscribe to the Platform. These are telecommunications and spectrum licensing authorities, regulators and ministries. We do not sell personal information to data brokers, advertisers or other commercial buyers. Our contracts with Agencies forbid them to resell personal information they receive from us.

Sharing for targeted advertising. We do not “share” personal information for cross-context behavioural advertising. We do not process personal information for targeted advertising. Our website and Platform carry no third-party advertising or analytics trackers.

Profiling. We use automated processing to classify terminals and to estimate device places. That processing is not used to make decisions that produce legal or similarly significant effects about a consumer. Any disclosure of identity-linked data is reviewed by people under our Disclosure Policy. What an Agency does with a release is governed by the Agency’s own laws and our Responsible Use & Platform Enforcement Policy.

Platform users and website visitors. We do not sell or share personal information collected from Platform users, applicants or website visitors.

Minors. We have no actual knowledge of selling or sharing the personal information of consumers under 16. Data Partners must exclude data from users under 16 and from child-directed apps.

#

We keep each category of personal information for the periods set out in our Data Retention Schedule. In summary:

• Device and location records from Data Partners: for the period set in our retention settings, chosen using the principles in the Data Retention Schedule.
• Terminal records: while the terminal remains in the service, and then for the period set in our retention settings, chosen the same way.
• Disclosure releases: contents deleted when the release window shown on the release ends. The request record and audit trail are kept for the period set in our retention settings, chosen the same way.
• Platform account data: the life of the account plus 2 years.
• Billing records: 7 years or as tax law requires.

We may keep information longer where the law requires it, to resolve disputes, or to enforce our agreements.

#

Depending on the state you live in, you may have the following rights. Each is subject to exceptions and to verification of your identity.

We will not respond to more than two access or portability requests from the same person in a 12-month period, unless the law requires otherwise.

#

Device users (Data Services)

Most of the personal information we hold about device users is linked to a mobile advertising ID, not to a name. To opt out, or to access or delete that data, email privacy@equatorium.com with your device’s advertising ID. Step-by-step instructions are in Your Privacy Choices.

Your request applies only to the advertising ID you give us. If you use several devices, or reset your advertising ID, you will need to send each ID.

Platform users, applicants and website contacts

Email privacy@equatorium.com from the email address associated with your account or enquiry. Agency administrators can also update user details directly in the Platform.

Global Privacy Control

We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of sale and sharing for that browser. Because we do not sell website data, the signal has no further practical effect on our website. It cannot opt out a mobile device, because the browser signal is not linked to your device’s advertising ID. Email us for that.

Timing

We will confirm receipt of your request within 10 business days. We will respond within 45 days. Where reasonably necessary, we may extend that by a further 45 days, and we will tell you why. We act on opt-out requests as soon as feasible, and in any case within 15 business days.

Fees

We do not charge a fee. If requests are manifestly unfounded, excessive or repetitive, we may charge a reasonable fee or decline, as the law allows.

#

We verify requests to protect the people whose data we hold. How we verify depends on the data:

• Device data. We match the advertising ID you send to our records. You can opt out with an advertising ID alone, without other information. For access and deletion requests, we may ask for more proof that the device is yours, because an advertising ID can be copied, for example a screenshot of the device’s settings showing the ID. We will not release precise location history in response to an unverified access request.
• Platform users and contacts. We match the email address against our records and may ask you to confirm the request from that address.

We use information you give us for verification only to verify you and to respond to your request. We then delete it, except for a record of the request that we keep as required by law.

#

You may use an authorized agent to make a request for you. The agent must give us written permission signed by you, or a valid power of attorney. Unless the agent holds a power of attorney, we may ask you to verify your own identity directly with us and to confirm that you authorised the agent. We may deny a request from an agent who cannot show they are authorised.

#

If we decline to act on your request in whole or in part, we will explain why. You may appeal by emailing privacy@equatorium.com with the subject line “Privacy request appeal” within 60 days of our decision. Someone who was not involved in the original decision will review the appeal. We will respond in writing within 45 days, or within the period your state’s law requires. If the appeal is denied, you may contact your state Attorney General. Where your state’s law requires it, we will tell you how.

#

California Civil Code §1798.83 lets California residents who have an established business relationship with us ask what personal information we disclosed to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing. To make a request, email privacy@equatorium.com.

#

The Platform and website are for government professionals and are not directed to minors. We do not knowingly collect, process or sell personal information of anyone under 16, or a higher age where local law sets one. Our Data Partners must exclude data from users under 16, or a higher local age, and from apps directed to children.

If you believe we hold data about a child, contact privacy@equatorium.com. We will delete it and keep a record of the device identifier so the data is not used again.

#

We review this Notice at least once every 12 months and update the “Last updated” date when we change it. Material changes are handled as described in the Privacy Policy.

Questions: privacy@equatorium.com. Our annual transparency report is described in Privacy Request Statistics.

#

The controller of your personal data is Equatorium Corporation, a Delaware corporation. You can reach our privacy team at privacy@equatorium.com. Requests and notices to Equatorium are made by email.

Equatorium is not established in the EEA, UK or Switzerland. Details of our representatives in the EU and the UK, and in Switzerland where one is required, are available on request to legal@equatorium.com.

When we release data to an Agency under the Disclosure Policy, the Agency becomes an independent controller of the data it receives. Its own law governs how it uses that data.

#

If information about your mobile device reaches us from our Data Partners, we may hold the following about it.

Where the data comes from

Third-party Data Partners collect it from mobile apps under their own notices and consents and license it to us. The current list of our Data Partners is available on request from legal@equatorium.com. The data is not from publicly accessible sources.

Categories of data

• Online identifiers: mobile advertising IDs, IP addresses and related network information, and hashed email addresses linked to the device.
• Location data: device location with timestamps, and household and workplace locations supplied by Data Partners.
• Network and device data: Wi-Fi access point identifiers, and device make, model, operating system and related device information.
• Consent records: the consent information received with the record.
• Data we derive: terminal records, terminal locations and history, classifications and reasons, nearest street address, and estimated home and work places.

Why we process it

We use it to detect and locate Starlink satellite terminals operating in countries where our Agency customers regulate spectrum and licensing. We also use it to give those Agencies location information about each terminal. Through a reviewed disclosure process, we release identity-linked data about devices seen with a terminal when an Agency shows a legal basis. See the Disclosure Policy.

The service focuses on terminals, not on individuals. However, identifiers such as advertising IDs and hashed emails can be used to identify a person, and we treat them as personal data.

Recipients

Recipients are:

• Agency customers: government licensing and regulatory bodies in the countries where we provide the Data Services
• our service providers, the list of which is available on request from legal@equatorium.com
• authorities, where the law requires it

#

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. The safeguards that support that balance are:

• identity-linked data is released only through our Disclosure Policy, which requires a stated legal basis and review by Equatorium
• requests concerning protected persons and protected activity are denied
• an opt-out is available to anyone

You can ask us for details of that balancing at privacy@equatorium.com.

#

We do not seek to collect special categories of personal data under Article 9 GDPR, such as health, religion, political opinions or sexual orientation. Our Data Partners must not send us such data.

Location data can sometimes reveal sensitive information, for example a visit to a place of worship or a clinic. We do not analyse location data to infer such characteristics. The Platform shows the history of a terminal, not a person’s movements. Estimated home and work places are released only through the Disclosure Policy.

We do not seek criminal-offence data (Article 10 GDPR) from Data Partners. Court orders uploaded with disclosure requests may contain it; we process it only to review the request, under the safeguards in the Disclosure Policy. Operating an unlicensed terminal may be an offence in some countries. Deciding whether it is one, and acting on it, is a matter for the Agency under its own law.

#

We use automated analysis to assess whether a terminal is likely a Starlink terminal and to estimate where devices are usually located. These outputs are not decisions about you that produce legal or similarly significant effects under Article 22 GDPR.

People review every release of identity-linked data under our Disclosure Policy; no release is made automatically. Any action an Agency takes after a release is its own decision under its own law.

#

We process data in the United States and in other countries where we or our service providers operate. Our Agency customers may be located outside the EEA, UK and Switzerland. Equatorium is not certified under the EU-U.S. Data Privacy Framework.

• To Equatorium and our service providers: we rely on the European Commission’s Standard Contractual Clauses (2021/914). For the UK we add the UK International Data Transfer Addendum, and for Switzerland the amendments the Swiss FDPIC requires. We also apply supplementary measures such as encryption in transit, access controls and audit logging.
• To Agencies: where no adequacy decision covers the destination country, we rely on Standard Contractual Clauses with the Agency where it can sign them. Otherwise we rely on the derogations in Article 49 GDPR, for example important reasons of public interest recognised in law, the establishment of legal claims, or the protection of vital interests.

You can request a copy of the safeguards we use by emailing privacy@equatorium.com.

#

We keep personal data only as long as the purposes above require. Full periods are in the Data Retention Schedule. In summary:

• device and location records from Data Partners: for the period set in our retention settings, chosen using the principles in the Data Retention Schedule
• disclosure releases: deleted when the release window shown on the release ends
• Quant conversations: 90 days after the last message
• account data: life of the account plus 2 years

#

Subject to the conditions and exceptions in the applicable law, you have these rights:

• Access: to confirm whether we process your data and to receive a copy of it.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to have your data deleted. We may need to keep some data to comply with the law or to establish, exercise or defend legal claims.
• Restriction: to have us limit processing while a dispute about accuracy or lawfulness is resolved.
• Portability: where processing is based on consent or contract and carried out by automated means, to receive the data you provided in a structured, machine-readable format.
• Objection: to object at any time to processing based on legitimate interests, on grounds relating to your situation. For device data, an objection is handled as an opt-out: we stop processing data linked to the device and keep a record so it is not used again, unless we have compelling legitimate grounds that override your interests.
• Withdraw consent: where processing relies on consent, at any time, without affecting earlier processing. You can also withdraw consent with the app or Data Partner that collected it.
• Automated decisions: not to be subject to a decision based solely on automated processing that significantly affects you (see section 5).

#

Device users: email privacy@equatorium.com with your device’s advertising ID. Full instructions are in Your Privacy Choices. Platform users and other contacts: email privacy@equatorium.com from the address we hold for you.

We respond within one month. We may extend that by two further months for complex or numerous requests, and we will tell you if we do. We do not charge a fee unless a request is manifestly unfounded or excessive. We may ask for information to verify your identity. For device data, we may ask you to show that you control the device.

You may act through an authorised representative, who must provide evidence of their authority.

#

Please contact us first at privacy@equatorium.com so we can try to resolve your concern. You also have the right to lodge a complaint with a supervisory authority:

• in the EEA, the authority in the Member State where you live, work, or where the alleged infringement took place (the European Data Protection Board lists them)
• in the UK, the Information Commissioner’s Office (ico.org.uk)
• in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch)

#

We update this Notice when our practices or the law change, and we revise the “Last updated” date when we do. Where a change materially affects how we use data we already hold, we will give notice as described in the Privacy Policy. Where the law requires it, we will seek consent.

#

The law of the country where you live may give you rights in addition to those described in our Privacy Policy. Where such a law applies to our processing of your personal data, Equatorium honours the rights it gives you.

When we provide the Data Services to an Agency, that processing may also fall under rules that apply to public authorities in the Agency’s country. This page does not limit those rules.

#

Email privacy@equatorium.com and tell us the country concerned. Agencies and their counsel can write to legal@equatorium.com. We will tell you:

• which data protection law applies to our processing of your data;
• the rights that law gives you and how to exercise them;
• the safeguards we use when data is transferred to or from that country; and
• the regulator you can complain to.

We respond within the time the applicable law requires. To exercise a right, you can also use the options in Your Privacy Choices.

#

You can complain to the data protection authority in the country where you live. We ask that you contact us first at privacy@equatorium.com, so we can try to resolve the issue.

#

• Quant is powered by an AI model provider that acts as Equatorium’s sub-processor for Quant.
• When you ask Quant something, your question, the parts of your organization’s Equatorium data Quant reads to answer it, and Quant’s reply are sent to that provider, which may process them in the United States.
• Under its commercial terms with Equatorium, the provider does not use this data to train its models.
• Equatorium keeps your Quant conversations for 90 days after their last message, then deletes them. You can delete a conversation at any time in Quant; it is deleted at once.
• Only you can see your conversations. Your organization’s administrators cannot.
• Quant never acts on its own. Nothing it suggests happens until you press Confirm, and confirmed suggestions are recorded in your organization’s audit log.
• Quant can make mistakes. Check important figures on the page it links to.

#

Quant answers questions in plain language and points to the page where the answer can be checked. Typical uses include:

• summarising what is new in an area since the last scan;
• explaining a terminal’s classification, using the reasons shown on the terminal’s page;
• finding terminals, areas, workflows, tasks and support tickets;
• explaining how a feature works or what a status means; and
• for users who can see billing, answering questions about the organization’s credits and subscriptions.

Quant may also prepare “Proposals”, for example to create a scan for an area, assign a terminal to a colleague as a task, or change an alert. A Proposal shows what would happen and, where relevant, what it would cost. It takes effect only if the user presses Confirm, and only if the user’s role permits the action. Confirmed Proposals are recorded in the organization’s audit log like any other change.

#

What Quant reads

To answer a question, Quant reads the parts of the asking user’s organization’s data that the question needs, through the same permission checks as the rest of the Platform. It sees only what the user could see. Depending on the question, that can be:

• terminals, their locations, activity, classifications and network details, including IP addresses;
• the devices seen connected to a terminal, with their advertising IDs and device details;
• areas, places, workflows, runs, alerts and exports;
• tasks, support tickets, the team and its roles, and the organization’s audit log;
• disclosure requests, and the contents of releases the user may open; and
• for users with permission to see billing, subscriptions, invoices, credits and usage.

Email addresses and phone numbers are removed before anything is sent to the model provider, and the user’s own name is not sent.

What Quant never sees

• data belonging to any other organization;
• payment card details, which are held by our payment processor; and
• other users’ Quant conversations.

#

Quant has usage limits to protect the service. If Quant is unavailable or a limit is reached, the rest of the Platform works as normal. Equatorium can switch Quant off for an organization on request.

The AI model provider processes Quant data as Equatorium’s sub-processor. The current list of sub-processors is available on request from legal@equatorium.com, and international transfers are covered as described in the Privacy Policy.

#

Quant does not make decisions. It does not approve or deny Disclosure Requests, it does not change data without a user’s confirmation, and it is not used to make any decision with legal or similarly significant effects on any person.

Quant can be wrong. It may misread a question, summarise incompletely or state a figure incorrectly. Each answer links to the Platform page it relies on, and users should check important figures there before relying on them. Users remain responsible for actions they confirm.

#

Quant is separate from the way Equatorium detects terminals. Detection is Equatorium’s own automated analysis, reviewed by people. Quant only reads and explains its results; it cannot change them.

#

Under its commercial terms with Equatorium, the AI model provider does not use Quant questions, data or replies to train its models. Equatorium may use aggregated usage measures, such as the number of questions asked, response times, errors and whether Proposals were confirmed, to operate and improve Quant.

#

• Delete any conversation at any time in Quant; it is deleted at once.
• Do not include personal information about individuals in your questions unless it is necessary; Quant does not need it.
• Ask your organization’s administrator, or Equatorium Support, to switch Quant off for your organization.
• Report a wrong or unhelpful answer through Support.

Questions about Quant and privacy can be sent to privacy@equatorium.com.

#

An Agency that wants identity-linked information about a terminal must use the Disclosure process on the Platform. Equatorium will not release that information by email, telephone, letter or any other channel, and will not treat a separate legal demand from an Agency as a way around the Disclosure Policy. If an Agency serves Equatorium with compulsory legal process, Equatorium will ask it to submit the same matter as a Disclosure Request, and will respond to the process itself only as described below.

#

Equatorium may receive requests from bodies that are not Agencies, for example courts or law enforcement in another country, regulators, or parties to civil litigation. Equatorium handles them as follows.

• Valid legal process. We require legal process that is valid and binding on Equatorium under the law that applies to Equatorium and to the data, such as a court order, warrant or subpoena. We do not respond to informal requests for personal information.
• Jurisdiction. We check that the requesting body has authority over Equatorium and the data requested. Requests from foreign authorities must normally come through a mutual legal assistance treaty or other recognised international channel.
• Specific and narrow. The request must identify the information sought with particularity, for example a terminal number and a time period. We do not respond to requests for bulk data, for all terminals in an area, or for information about people identified only by characteristics.
• Challenge. We will seek to narrow or challenge requests that are overbroad, unclear, not legally valid, or that would require us to act inconsistently with the protected-person rules of the Disclosure Policy, and we will disclose only the minimum information legally required.
• Data held for an Agency. Where a request concerns information that relates only to an Agency’s use of the Platform, such as its account, workflows, Disclosure Requests or audit log, we will direct the requester to the Agency where we can, and will notify the Agency unless we are legally prohibited from doing so.

Requests by private parties for personal information about another person will be refused unless accompanied by a court order binding on Equatorium.

#

Unless prohibited by law or by a court order, or where notice would create a risk of death or serious harm, we will notify an affected Agency before disclosing its information, so that it can seek to protect it. Where a gag order applies, we will consider whether to challenge it and will give notice when it lapses.

Where a request concerns an individual identifiable from the data we hold, we will consider whether we can lawfully notify that individual, taking into account that we generally do not know the individual’s name or contact details.

#

We may disclose information without legal process where we believe in good faith that doing so is necessary to prevent an imminent risk of death or serious physical harm, and the request comes from an authority competent to act on it. Emergency requests must explain the emergency and be confirmed in writing by the authority. We disclose only what is needed to address the emergency, record the request and the disclosure, and may later ask for legal process. Emergency requests can be sent to legal@equatorium.com with “EMERGENCY” in the subject line.

#

Equatorium does not build backdoors into the Platform, does not give any government direct or unsupervised access to its systems or data, and does not voluntarily hand over encryption keys. Every access to identity-linked data, by Agencies or by Equatorium staff, goes through the controls described in the Disclosure Policy, or through the legal-process and emergency procedures on this page, and is logged. If Equatorium is ever compelled to change this, it will, to the extent the law permits, update this page.

#

Equatorium will not provide information to any person or body where doing so would breach applicable sanctions or export control laws, including restrictions on the transfer of sensitive personal data, such as precise geolocation, to countries of concern or covered persons under 28 CFR Part 202.

#

Our annual transparency report includes the number of requests received from authorities and third parties other than Agencies, by type of requester, and how many resulted in disclosure of some, all or no data. Where the law allows, it also reports the number of requests subject to non-disclosure orders, in ranges. A draft of the current report is available on request from privacy@equatorium.com. See Privacy Request Statistics.

#

Send legal process to legal@equatorium.com. Our address for service: 16192 Coastal Hwy, Lewes, DE 19958, United States, c/o Harvard Business Services Registered Office Mail. Please include the requesting body, the legal authority, the specific information sought (terminal number and time period), a deadline and a contact for questions. Equatorium does not accept service by Platform support tickets.

#

Depending on the role and where you are, we may collect:

• Contact information, such as your name, address, telephone number and email address;
• Application materials, such as your CV or résumé, cover letter, work samples, references and information from recruiters or people who refer you;
• Professional qualifications, such as degrees, licences, certifications and memberships;
• Information from the selection process, such as interview notes, assessments, technical exercises and outcomes;
• Right-to-work information, such as nationality, immigration or visa status and identity documents;
• Employment history and preferences, such as previous roles, notice period, desired salary and location preferences;
• Screening information, where permitted by law, such as the results of background, reference, criminal record or security vetting checks; and
• Other information you choose to give us.

Where the law allows or requires, we may also ask for information about health or disability (to make adjustments for you) or for equal opportunity monitoring. Providing that information is voluntary unless the law requires it, and it is kept separate from your application.

You do not have to give us personal information, but if you do not give us enough we may not be able to consider your application.

#

• from you, when you apply and during the selection process;
• from job boards, recruitment agencies and recruiters;
• from referees and former employers you authorise us to contact;
• from screening and vetting providers, where permitted by law;
• from public professional profiles and other publicly available sources relevant to the role; and
• from Equatorium staff who interview or refer you.

#

• Recruitment: assessing your skills and suitability, arranging and conducting interviews, communicating with you, making and documenting hiring decisions, and improving our recruitment process;
• Screening and vetting: confirming your identity and right to work and, for roles that require it, carrying out background and security checks;
• Adjustments: making reasonable adjustments to the process;
• Compliance and protection: complying with laws and internal policies, responding to lawful requests, and establishing or defending legal claims; and
• Future roles: considering you for other suitable roles, if you agree or where the law allows.

Screening for roles with access to sensitive data

Some Equatorium roles involve access to identity-linked data and the review of Disclosure Requests from government Agencies. For those roles we may require enhanced background or security screening, including criminal record checks, before an offer becomes final and periodically after, to the extent the law of your country permits. We will tell you before any such check is carried out.

#

Where the law requires a legal basis, we generally rely on our legitimate interest in recruiting suitable people and running a fair and efficient process; on taking steps at your request before entering into a contract with you; on compliance with legal obligations (for example, right-to-work checks); and, where required, on your consent, which you can withdraw at any time. For special category or sensitive information, we rely on an additional condition permitted by law, such as employment law obligations or your explicit consent.

#

Equatorium does not make hiring decisions by automated means. People make every hiring decision.

#

• Affiliates of Equatorium, for the purposes in this Notice;
• Service providers that help us recruit, such as applicant tracking systems, video interview tools, recruiters, screening providers and travel providers, under contracts that limit their use of your information;
• Professional advisers, such as lawyers and immigration advisers;
• Authorities and courts, where required by law or to protect rights and safety; and
• Parties to a business transaction, such as a merger or acquisition, subject to confidentiality.

We do not sell applicants’ personal information or share it for targeted advertising, and have not done so in the past 12 months. Applicant information is never used in the Platform’s Data Services.

#

Equatorium and its service providers operate in several countries, including the United States. Your information may be transferred to and stored in countries other than your own. Where the law requires it, we protect those transfers with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and the UK Addendum. Equatorium is not certified under the EU-U.S. Data Privacy Framework. You can ask for a copy of the safeguards we use at careers@equatorium.com.

#

Please make sure the information you give us is accurate and complete and that you have the right to share any information about others, such as referees. Tell us if your details change during the process.

#

Depending on where you live, you may have the right to:

• know what personal information we hold about you and how we use it, and receive a copy;
• correct inaccurate information;
• ask us to delete your information, or to restrict or object to how we use it;
• receive your information in a portable format;
• withdraw consent where we rely on it; and
• not be treated less favourably for exercising your rights.

To exercise a right, email careers@equatorium.com. We may need to verify your identity first. Where the law allows, you may use an authorised agent, who must show your signed permission. You may also complain to the data protection authority where you live or work.

#

If you join Equatorium, your application information becomes part of your personnel file and is handled under our employee privacy notice. If you do not, we keep your information for up to 2 years after the role is filled, so that we can respond to questions or claims and consider you for other roles, unless you ask us to delete it sooner or local law requires a shorter period. Screening results are kept only as long as the law permits.

#

We use appropriate technical and organisational measures to protect your information against unauthorised access, loss or misuse, and limit access to the people involved in your application.

#

We may update this Notice and will post the updated version with a new date. This Notice does not cover third-party websites or job boards, which have their own privacy policies. Questions: careers@equatorium.com.

#

If you believe that material available on or through equatorium.com or the Platform infringes your copyright, send a written notice (a “Notification”) to our designated agent. A copy of your Notification may be sent to the person responsible for the material. Under Section 512(f) of the DMCA you may be liable for damages if you knowingly misrepresent that material is infringing, so if you are unsure, consider taking legal advice first.

Your Notification must include:

• a physical or electronic signature of a person authorised to act on behalf of the owner of the exclusive right allegedly infringed;
• identification of the copyrighted work claimed to be infringed or, for multiple works, a representative list;
• identification of the material claimed to be infringing and information reasonably sufficient for us to locate it, such as a URL;
• your name, address, telephone number and, if available, email address;
• a statement that you have a good-faith belief that use of the material is not authorised by the copyright owner, its agent or the law; and
• a statement that the information in the Notification is accurate and, under penalty of perjury, that you are authorised to act on behalf of the owner.

#

If material you provided was removed and you believe that was a mistake or misidentification, you may send a counter-notice to our designated agent including: your signature; identification of the material and where it appeared before removal; a statement under penalty of perjury that you have a good-faith belief the material was removed by mistake or misidentification; your name, address and telephone number; and a statement that you consent to the jurisdiction of the courts for your address (or, if outside the United States, any judicial district in which Equatorium may be found) and will accept service from the person who sent the Notification. We may restore the material in 10 to 14 business days unless the complainant tells us it has filed a court action.

#

Equatorium may, in appropriate circumstances and at its discretion, suspend or terminate the accounts of users who are repeat infringers.

#

If you believe material on the website or Platform infringes your trademark, email copyright@equatorium.com with your name and contact details, the trademark and its registration details, the material complained of and where it appears, and why you believe it infringes. “Equatorium” and the Equatorium logo are trademarks of Equatorium Corporation. “Starlink” is a trademark of Space Exploration Technologies Corp.; Equatorium is not affiliated with, endorsed by or sponsored by SpaceX or Starlink.

#

Map data shown on the Platform is used under licences from its providers. If you reproduce a map from the Platform, for example in an export or a screenshot, you must keep any credit or notice that appears with it.

#

Copyright Agent, Equatorium Corporation
Email: copyright@equatorium.com

Postal address: 16192 Coastal Hwy, Lewes, DE 19958, United States, c/o Harvard Business Services Registered Office Mail.