EEA, UK & Swiss Privacy Notice

#

The controller of your personal data is Equatorium Corporation, a Delaware corporation. You can reach our privacy team at privacy@equatorium.com. Requests and notices to Equatorium are made by email.

Equatorium is not established in the EEA, UK or Switzerland. Details of our representatives in the EU and the UK, and in Switzerland where one is required, are available on request to legal@equatorium.com.

When we release data to an Agency under the Disclosure Policy, the Agency becomes an independent controller of the data it receives. Its own law governs how it uses that data.

#

If information about your mobile device reaches us from our Data Partners, we may hold the following about it.

Where the data comes from

Third-party Data Partners collect it from mobile apps under their own notices and consents and license it to us. The current list of our Data Partners is available on request from legal@equatorium.com. The data is not from publicly accessible sources.

Categories of data

• Online identifiers: mobile advertising IDs, IP addresses and related network information, and hashed email addresses linked to the device.
• Location data: device location with timestamps, and household and workplace locations supplied by Data Partners.
• Network and device data: Wi-Fi access point identifiers, and device make, model, operating system and related device information.
• Consent records: the consent information received with the record.
• Data we derive: terminal records, terminal locations and history, classifications and reasons, nearest street address, and estimated home and work places.

Why we process it

We use it to detect and locate Starlink satellite terminals operating in countries where our Agency customers regulate spectrum and licensing. We also use it to give those Agencies location information about each terminal. Through a reviewed disclosure process, we release identity-linked data about devices seen with a terminal when an Agency shows a legal basis. See the Disclosure Policy.

The service focuses on terminals, not on individuals. However, identifiers such as advertising IDs and hashed emails can be used to identify a person, and we treat them as personal data.

Recipients

Recipients are:

• Agency customers: government licensing and regulatory bodies in the countries where we provide the Data Services
• our service providers, the list of which is available on request from legal@equatorium.com
• authorities, where the law requires it

#

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. The safeguards that support that balance are:

• identity-linked data is released only through our Disclosure Policy, which requires a stated legal basis and review by Equatorium
• requests concerning protected persons and protected activity are denied
• an opt-out is available to anyone

You can ask us for details of that balancing at privacy@equatorium.com.

#

We do not seek to collect special categories of personal data under Article 9 GDPR, such as health, religion, political opinions or sexual orientation. Our Data Partners must not send us such data.

Location data can sometimes reveal sensitive information, for example a visit to a place of worship or a clinic. We do not analyse location data to infer such characteristics. The Platform shows the history of a terminal, not a person’s movements. Estimated home and work places are released only through the Disclosure Policy.

We do not seek criminal-offence data (Article 10 GDPR) from Data Partners. Court orders uploaded with disclosure requests may contain it; we process it only to review the request, under the safeguards in the Disclosure Policy. Operating an unlicensed terminal may be an offence in some countries. Deciding whether it is one, and acting on it, is a matter for the Agency under its own law.

#

We use automated analysis to assess whether a terminal is likely a Starlink terminal and to estimate where devices are usually located. These outputs are not decisions about you that produce legal or similarly significant effects under Article 22 GDPR.

People review every release of identity-linked data under our Disclosure Policy; no release is made automatically. Any action an Agency takes after a release is its own decision under its own law.

#

We process data in the United States and in other countries where we or our service providers operate. Our Agency customers may be located outside the EEA, UK and Switzerland. Equatorium is not certified under the EU-U.S. Data Privacy Framework.

• To Equatorium and our service providers: we rely on the European Commission’s Standard Contractual Clauses (2021/914). For the UK we add the UK International Data Transfer Addendum, and for Switzerland the amendments the Swiss FDPIC requires. We also apply supplementary measures such as encryption in transit, access controls and audit logging.
• To Agencies: where no adequacy decision covers the destination country, we rely on Standard Contractual Clauses with the Agency where it can sign them. Otherwise we rely on the derogations in Article 49 GDPR, for example important reasons of public interest recognised in law, the establishment of legal claims, or the protection of vital interests.

You can request a copy of the safeguards we use by emailing privacy@equatorium.com.

#

We keep personal data only as long as the purposes above require. Full periods are in the Data Retention Schedule. In summary:

• device and location records from Data Partners: for the period set in our retention settings, chosen using the principles in the Data Retention Schedule
• disclosure releases: deleted when the release window shown on the release ends
• Quant conversations: 90 days after the last message
• account data: life of the account plus 2 years

#

Subject to the conditions and exceptions in the applicable law, you have these rights:

• Access: to confirm whether we process your data and to receive a copy of it.
• Rectification: to correct inaccurate or incomplete data.
• Erasure: to have your data deleted. We may need to keep some data to comply with the law or to establish, exercise or defend legal claims.
• Restriction: to have us limit processing while a dispute about accuracy or lawfulness is resolved.
• Portability: where processing is based on consent or contract and carried out by automated means, to receive the data you provided in a structured, machine-readable format.
• Objection: to object at any time to processing based on legitimate interests, on grounds relating to your situation. For device data, an objection is handled as an opt-out: we stop processing data linked to the device and keep a record so it is not used again, unless we have compelling legitimate grounds that override your interests.
• Withdraw consent: where processing relies on consent, at any time, without affecting earlier processing. You can also withdraw consent with the app or Data Partner that collected it.
• Automated decisions: not to be subject to a decision based solely on automated processing that significantly affects you (see section 5).

#

Device users: email privacy@equatorium.com with your device’s advertising ID. Full instructions are in Your Privacy Choices. Platform users and other contacts: email privacy@equatorium.com from the address we hold for you.

We respond within one month. We may extend that by two further months for complex or numerous requests, and we will tell you if we do. We do not charge a fee unless a request is manifestly unfounded or excessive. We may ask for information to verify your identity. For device data, we may ask you to show that you control the device.

You may act through an authorised representative, who must provide evidence of their authority.

#

Please contact us first at privacy@equatorium.com so we can try to resolve your concern. You also have the right to lodge a complaint with a supervisory authority:

• in the EEA, the authority in the Member State where you live, work, or where the alleged infringement took place (the European Data Protection Board lists them)
• in the UK, the Information Commissioner’s Office (ico.org.uk)
• in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch)

#

We update this Notice when our practices or the law change, and we revise the “Last updated” date when we do. Where a change materially affects how we use data we already hold, we will give notice as described in the Privacy Policy. Where the law requires it, we will seek consent.