Disclosure Policy

#

These are the rules shown on the Platform. The other sections of this Policy explain how Equatorium applies them.

1. Every request needs a legal basis and an approver.
2. Equatorium reviews each request within your response time.
3. Requests concerning conflict areas, journalists, or other protected activity are denied.
4. Every request, and every time a release is opened, is recorded in your audit log.
5. A request is never approved just because time runs out.
6. A release can be opened only for a limited time, shown on the release.
7. Only the requester, the approver and admins can open a release.
8. A release holds identifiers, device details, Wi-Fi IDs and evidence, never a name.

A request that matches a protected person is always denied, whatever its case type, legal basis or urgency.

#

A “Disclosure Request” is a request by an Agency for Equatorium to release identity-linked information about one terminal. A “Release” is the time-limited package of information that Equatorium makes available to the Agency when it approves a Disclosure Request.

Without a disclosure, Agency users can see the information needed to account for a terminal under their licensing framework: where the terminal is, when it was active, the reasons it is believed to be a Starlink terminal, and the devices seen connected to it, including their advertising IDs and device details. Equatorium does not treat advertising IDs as identity-linked information for this Policy. They remain personal data under privacy law, as described in the Privacy Policy.

Other information Equatorium holds about a terminal can be resolved to a person by someone with access to other data sources. Hashed email addresses, hashed phone numbers, consent information, network prefixes, Wi-Fi access point identifiers and the home and work places of devices are in that category. Equatorium treats them as identity: they are not shown in the Platform’s ordinary views or exports, and they leave Equatorium only in a Release.

The purpose of the Platform is to help licensing authorities find and regularise unlicensed satellite terminals. Disclosure is for cases in which a lawful authority needs to go further than the terminal, and only to the extent the law allows.

#

Equatorium considers Disclosure Requests only for the following case types. A request that does not fit one of them is denied as outside policy.

A licensing matter that does not fall within these case types, including enforcement under a statutory information power and sending a notice to the operator of an unlicensed terminal, should be handled from the information available without a disclosure.

#

Every Disclosure Request names one or more scopes. Equatorium releases only the scopes approved, and only to the extent there is data for them. The request form shows, before submission, whether each scope has data for the terminal.

Evidence comes with every Release. So that the Agency can weigh the finding, each Release includes a summary of the evidence for the detection.

A Release never contains a name, an unhashed telephone number, an unhashed email address or the content of any communication. Equatorium does not hold the content of communications at all.

Data minimisation applies to scopes. Equatorium will deny or narrow a request that asks for more scopes than the stated purpose needs, and approvers in the Agency are expected to do the same.

#

Who can request

Any Agency user whose role allows it may start a Disclosure Request from a terminal’s page. The request is made on behalf of the Agency, not the individual user. The disclosure process is available only to Agencies that have signed an Order Form with Equatorium, as described in Section 2 of the Terms of Use. It is not available during a trial.

What every request must include

• The terminal. One terminal per request.
• A case type from section 3.
• The scopes requested, from section 4.
• A legal basis: the law, order or authorisation that permits the Agency to obtain the information, with its reference.
• A justification: why the information is necessary and proportionate for this case, and how it will be used.
• Supporting documents where they exist, such as a court order or a written authorisation.

The Agency’s approver

Every request must be approved inside the Agency by a user with the approver role who is not the requester. The approver confirms that the legal basis is valid, that the scope is no wider than needed and that the request complies with this Policy and the Agency’s own law. An approver may decline a request; a declined request does not reach Equatorium.

Only one request for the same terminal by the same Agency may be open at a time. A requester may withdraw a request at any time before it is released.

#

People review every request

After the Agency’s approver approves it, Equatorium staff review every Disclosure Request. No request is approved automatically or because a deadline has passed. If a review is not completed within the Agency’s response time, the request stays in review and the Agency is told; it is never released by default.

Response time

Equatorium aims to complete each review within the response time that applies to the Agency, as set out in the Platform or its Order Form. A response time is a target for completing the review. Meeting it does not mean the request will be approved, and asking for more information pauses it.

What a review considers

Equatorium considers whether the case type fits the facts, whether the legal basis exists and covers the scopes asked for, whether the request is necessary and proportionate, and whether it complies with this Policy and the Terms of Use.

Information needed

Equatorium may ask the Agency for more information or documents. The request then shows “info needed” until the Agency answers. A request still waiting after the reply date shown on it is withdrawn.

Protected persons and protected activity

Equatorium denies every request that concerns conflict areas, journalists or other protected activity, and every request that matches a protected person. Equatorium does not disclose how it identifies these requests, and the Agency is not told the reason for such a match beyond the denial.

Denial

A denied request carries one of three fixed reasons. The Agency sees the fixed wording only.

Holds

Equatorium may place an approved request on hold before release, for example where it receives information that changes the assessment, a legal challenge, or a security concern. A held request shows “held”, and Equatorium will tell the Agency what, if anything, it can do.

#

Threat-to-life requests are always handled at priority, whatever response-time tier the Agency has, and at no charge.

An emergency request still needs an approver in the Agency and is still subject to this Policy, including the rules on protected persons and protected activity. Where documents cannot be supplied at once, Equatorium may release a narrower scope first, and the Agency must provide the supporting documents within 72 hours. If they are not provided, Equatorium will record that in the Agency’s audit log and may suspend the Agency’s ability to make further requests.

#

• A limited window. A Release can be opened only for the period shown on it, from when it is issued. After that it expires and cannot be opened again, and its contents are deleted from the Platform.
• Who can open it. Only the requester, the approver and the Agency’s administrators.
• Every opening is recorded in the Agency’s audit log, alongside the request and the approval.
• Exports. A Release can be exported for the Agency’s case file while it is open. Export files carry the Release reference.
• Checking a Release. Anyone holding a copy of a Release, such as a court, can check that it is genuine on the Check a release page.

#

Once information is released, the Agency becomes an independent controller of that information under the law that applies to it and is responsible for its lawful use. In addition to the Terms of Use and the Customer Data Processing Agreement, the Agency must:

• use released information only for the case and the purpose stated in the request;
• restrict access to the people working on that case;
• keep it secure, at least to the standard its law requires for information of that sensitivity;
• not combine it with other data to build profiles of individuals beyond what the case requires;
• not disclose it to anyone else except as its law requires (for example, to a court or prosecutor in the same matter), and record any such disclosure;
• delete it when the case no longer needs it, or when its law requires; and
• tell Equatorium within seventy-two (72) hours at security@equatorium.com if released information was misused or exposed, and promptly at legal@equatorium.com if it was inaccurate.

Equatorium may ask an Agency to confirm in writing how released information was used and when it was deleted. Misuse of released information is a material breach of the Terms of Use and the Responsible Use & Platform Enforcement Policy.

#

Released information comes from third-party Data Partners and from Equatorium’s analysis of that data. It shows that devices were observed at or near a terminal; it does not prove who owns, operates or uses the terminal. Places are estimates with a stated confidence, not verified addresses. Agencies must corroborate released information before relying on it for any action that affects a person, and must not take such action on the basis of a Release alone.

#

An Agency may ask Equatorium to reconsider a denial through Support, with any new information. Equatorium’s decision on reconsideration is final under this Policy; it does not affect any rights the Agency has under its Order Form or the law.

#

Equatorium publishes an annual transparency report. It covers the number of Disclosure Requests received, released, denied (by reason), withdrawn and expired, by case type, aggregated so that no Agency or case can be identified, together with requests from authorities that are not Agencies. A draft of the current report, with underlying data where needed, is available on request from privacy@equatorium.com. See Privacy Request Statistics and Requests from Authorities & Third Parties.

#

Equatorium may update this Policy to reflect changes in the law, in the Platform or in its practices. We will post the updated Policy here and update the date above, and we will tell Agencies of material changes through the Platform or by email before they take effect. Equatorium may update its procedures, but never in a way that reduces the protection given to identity-linked data, and a change never reduces the protection of information already released. Questions about this Policy can be sent to legal@equatorium.com.