U.S. State Privacy Notice

#

Equatorium Corporation (“Equatorium,” “we,” “us”) operates a platform that detects and locates Starlink satellite terminals for licensing authorities and other government bodies (“Agencies”). People interact with us in three main ways:

• Device users. We receive data about mobile devices, including devices that may belong to you, from third-party “Data Partners”. We use it to provide our “Data Services”. You may never have dealt with us directly. Most of this Notice is about this group.
• Platform users. Agency staff who hold an account on the Equatorium web application (the “Platform”), and the Agency contacts we deal with.
• Website visitors and enquirers. People who visit equatorium.com, request a briefing, apply to sign up, or send a message through public support.

Some State Privacy Laws exempt certain data or relationships. Examples are data processed in a business-to-business or employment context, and data a government entity processes for itself. Where an exemption applies, we may still choose to honour a request. We do so when it is practical and lawful.

#

The table below covers our practices now and during the 12 months before the date of this Notice. For each category of personal information it shows:

• the sources it comes from
• why we collect it
• who we disclose it to for a business purpose
• whether we sell or share it

Under the State Privacy Laws, “sell” has a wide meaning, and “share” covers disclosures for cross-context behavioural advertising.

We do not use personal information to decide anyone’s eligibility for employment, credit, insurance, housing, education or health care.

We use personal information for the purposes listed in the Privacy Policy. We do not use sensitive personal information to infer characteristics about you beyond what the Data Services need to identify and locate satellite terminals.

Identity-linked data, such as hashed email addresses, consent information, network prefixes, Wi-Fi access point identifiers and the home and work places of devices, is released to an Agency only through our Disclosure Policy, which requires a stated legal basis and review by Equatorium. Agencies can see device advertising IDs on terminal views without a disclosure.

#

• Data Partners. These are third parties who license us data about mobile devices, collected from mobile apps under their own notices and consents. We take no part in that collection.
• You and your devices. This covers information you give us when you request a briefing, sign up, use the Platform or contact support. It also covers information collected automatically when you use our website or Platform.
• Agencies. An Agency administrator may invite you to the Platform or assign you a role.
• Service providers. For example, our payment processor tells us whether a card was authorised, and our authentication provider tells us whether two-step verification is enabled.
• Derived information. This is information we generate from the above, such as terminal records, classifications and estimated places.

#

Notice: We may sell your sensitive personal data. Notice: We may sell your precise geolocation data.

We provide the Data Services to Agencies for a fee. The State Privacy Laws define “sale” broadly. Under them, disclosing personal information to our Agency customers as part of those services is a sale. In the 12 months before the date of this Notice, we sold the following categories of personal information:

• Identifiers (advertising IDs; through approved disclosures, also hashed email addresses and network prefixes)
• Internet or other network activity
• Precise geolocation data (sensitive personal information)
• Device information, including Wi-Fi access point identifiers (through approved disclosures)
• Inferences, including estimated home and work places of devices (through approved disclosures)

Categories of third parties to whom we sell. Government agencies that subscribe to the Platform. These are telecommunications and spectrum licensing authorities, regulators and ministries. We do not sell personal information to data brokers, advertisers or other commercial buyers. Our contracts with Agencies forbid them to resell personal information they receive from us.

Sharing for targeted advertising. We do not “share” personal information for cross-context behavioural advertising. We do not process personal information for targeted advertising. Our website and Platform carry no third-party advertising or analytics trackers.

Profiling. We use automated processing to classify terminals and to estimate device places. That processing is not used to make decisions that produce legal or similarly significant effects about a consumer. Any disclosure of identity-linked data is reviewed by people under our Disclosure Policy. What an Agency does with a release is governed by the Agency’s own laws and our Responsible Use & Platform Enforcement Policy.

Platform users and website visitors. We do not sell or share personal information collected from Platform users, applicants or website visitors.

Minors. We have no actual knowledge of selling or sharing the personal information of consumers under 16. Data Partners must exclude data from users under 16 and from child-directed apps.

#

We keep each category of personal information for the periods set out in our Data Retention Schedule. In summary:

• Device and location records from Data Partners: for the period set in our retention settings, chosen using the principles in the Data Retention Schedule.
• Terminal records: while the terminal remains in the service, and then for the period set in our retention settings, chosen the same way.
• Disclosure releases: contents deleted when the release window shown on the release ends. The request record and audit trail are kept for the period set in our retention settings, chosen the same way.
• Platform account data: the life of the account plus 2 years.
• Billing records: 7 years or as tax law requires.

We may keep information longer where the law requires it, to resolve disputes, or to enforce our agreements.

#

Depending on the state you live in, you may have the following rights. Each is subject to exceptions and to verification of your identity.

We will not respond to more than two access or portability requests from the same person in a 12-month period, unless the law requires otherwise.

#

Device users (Data Services)

Most of the personal information we hold about device users is linked to a mobile advertising ID, not to a name. To opt out, or to access or delete that data, email privacy@equatorium.com with your device’s advertising ID. Step-by-step instructions are in Your Privacy Choices.

Your request applies only to the advertising ID you give us. If you use several devices, or reset your advertising ID, you will need to send each ID.

Platform users, applicants and website contacts

Email privacy@equatorium.com from the email address associated with your account or enquiry. Agency administrators can also update user details directly in the Platform.

Global Privacy Control

We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of sale and sharing for that browser. Because we do not sell website data, the signal has no further practical effect on our website. It cannot opt out a mobile device, because the browser signal is not linked to your device’s advertising ID. Email us for that.

Timing

We will confirm receipt of your request within 10 business days. We will respond within 45 days. Where reasonably necessary, we may extend that by a further 45 days, and we will tell you why. We act on opt-out requests as soon as feasible, and in any case within 15 business days.

Fees

We do not charge a fee. If requests are manifestly unfounded, excessive or repetitive, we may charge a reasonable fee or decline, as the law allows.

#

We verify requests to protect the people whose data we hold. How we verify depends on the data:

• Device data. We match the advertising ID you send to our records. You can opt out with an advertising ID alone, without other information. For access and deletion requests, we may ask for more proof that the device is yours, because an advertising ID can be copied, for example a screenshot of the device’s settings showing the ID. We will not release precise location history in response to an unverified access request.
• Platform users and contacts. We match the email address against our records and may ask you to confirm the request from that address.

We use information you give us for verification only to verify you and to respond to your request. We then delete it, except for a record of the request that we keep as required by law.

#

You may use an authorized agent to make a request for you. The agent must give us written permission signed by you, or a valid power of attorney. Unless the agent holds a power of attorney, we may ask you to verify your own identity directly with us and to confirm that you authorised the agent. We may deny a request from an agent who cannot show they are authorised.

#

If we decline to act on your request in whole or in part, we will explain why. You may appeal by emailing privacy@equatorium.com with the subject line “Privacy request appeal” within 60 days of our decision. Someone who was not involved in the original decision will review the appeal. We will respond in writing within 45 days, or within the period your state’s law requires. If the appeal is denied, you may contact your state Attorney General. Where your state’s law requires it, we will tell you how.

#

California Civil Code §1798.83 lets California residents who have an established business relationship with us ask what personal information we disclosed to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing. To make a request, email privacy@equatorium.com.

#

The Platform and website are for government professionals and are not directed to minors. We do not knowingly collect, process or sell personal information of anyone under 16, or a higher age where local law sets one. Our Data Partners must exclude data from users under 16, or a higher local age, and from apps directed to children.

If you believe we hold data about a child, contact privacy@equatorium.com. We will delete it and keep a record of the device identifier so the data is not used again.

#

We review this Notice at least once every 12 months and update the “Last updated” date when we change it. Material changes are handled as described in the Privacy Policy.

Questions: privacy@equatorium.com. Our annual transparency report is described in Privacy Request Statistics.