Privacy Policy

DatSov is a trading name of ProSolve Ltd. ProSolve Ltd is a company registered in England & Wales under company number 13955695, with its registered office at 483 Green Lanes, London, England, N13 4BS.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, ProSolve Ltd is the data controller responsible for your personal data. This policy explains what we collect, why, and the rights you have over your information.

We collect only the information necessary to respond to enquiries and deliver engagements:

• Contact details you provide — name, organisation, email address, and any details you include in an enquiry or booking form.
• Engagement information — correspondence and scoping notes relating to services you ask us to provide.
• Technical data — aggregated, anonymised site-usage data collected via Vercel Analytics when you have given consent (see Section 4).

We do not sell personal data. We do not use advertising pixels, retargeting networks, session-recording tools, or social-media tracking buttons. No third-party advertising script runs on this site and your browser is never made to contact an advertising network. Where we advertise, we measure it the way described in Section 6 instead.

We process personal data on the following lawful bases:

• Legitimate interests — to respond to enquiries, provide quotations, and operate our business securely.
• Contract — to deliver services you have engaged us for and to administer those engagements.
• Legal obligation — to meet accounting, tax, and other statutory requirements.
• Consent — where you have explicitly opted in (e.g. analytics cookies). You may withdraw consent at any time via the Cookie settings link in the footer.

We engage the following third-party processors. We share personal data with each only to the extent necessary for the stated purpose.

• Vercel Inc. (399 Bush St, San Francisco CA 94104, USA) — website hosting and infrastructure. Vercel processes server request logs inherent to hosting. Additionally, if you consent to analytics cookies, Vercel Analytics collects aggregated, anonymised usage data (pages visited, referrer, browser type). No persistent cookies are set by Vercel Analytics; data is not used for advertising. International transfer basis: Standard Contractual Clauses.
• Web3Forms (api.web3forms.com) — enquiry form submissions. When you submit an enquiry form, your form data is forwarded to us by email via Web3Forms. Web3Forms acts as a processor on our behalf. Data submitted is limited to what you enter in the form.
• Cal.com (cal.eu, operated by Cal.com Inc.) — appointment scheduling. When you click 'Initiate Architecture Call', you are directed to Cal.com's scheduling platform where Cal.com's own privacy policy applies. We receive your name, email address, and any notes you provide when booking.
• Stripe Inc. (354 Oyster Point Blvd, South San Francisco CA 94080, USA) — payment processing. Clicking a Buy Now button opens Stripe's hosted checkout at buy.stripe.com in a new browser tab. From that point Stripe acts as an independent data controller and Stripe's own Privacy Policy applies. We do not receive your full payment card details; Stripe transmits order confirmation data to us. Sovereign Phone hardware is not sold this way — see Section 8.
• Stripe Identity (Stripe Inc., as above) — identity verification for hardware customers only. Stripe Identity collects and holds your identity document and liveness image as our processor and returns only a pass or fail result and a reference. DatSov never receives or stores the document or any biometric data. International transfer basis: Standard Contractual Clauses. See Section 8.

We use one strictly necessary cookie (datsov_region_override) to prevent redirect loops when you choose to remain on a specific regional domain. No consent is required for this cookie.

We use Vercel Analytics only if you accept analytics cookies. Your preference is stored in your browser's localStorage. You can change your preference at any time using the Cookie settings link in the footer, or by visiting our Cookie Policy.

When we run paid advertising, the platform adds a reference to the link you click — a string such as gclid in the address of the page you land on. It identifies the click, not you, and it is put there by the platform before you ever reach us.

Nothing is stored unless you turn on the advertising category. If you do, we keep that reference in your browser for up to 90 days so that, if you go on to make an enquiry, we can tell the advertising platform from our own server that its campaign led to it. Our server sends the platform the fact of the conversion and the click reference it issued. Your browser never contacts the platform, and we do not build or share a profile of you.

Lawful basis: consent, under PECR and the UK GDPR. Leave the advertising category off and the reference is discarded when you close the page — we would simply not know which campaign worked. You can withdraw consent at any time via the Cookie settings link in the footer, which deletes anything already stored.

We retain personal data only for as long as necessary for the purposes set out above, or as required to meet legal, accounting, or reporting obligations. Enquiry correspondence is retained for up to two years. Engagement records are retained for seven years to satisfy statutory accounting requirements. When data is no longer required it is securely deleted.

Because we supply hardened devices, we are required to know who we are supplying. If you request a Sovereign Phone we carry out customer due diligence before any payment is taken. This section applies only to hardware customers; it does not apply to general enquiries or to our other services.

What we collect. The details you give at the request stage — your full legal name, date of birth, contact details, organisation where relevant, and the shipping destination — together with your lawful-use attestation and your acceptance of our Acceptable Use Policy.

Identity documents.Your identity document and the accompanying liveness image are collected and held by our verification provider, Stripe. DatSov does not receive, download, or store your document or any biometric data. We record only the outcome of the check and the provider's reference. Where a reviewer needs to inspect a document, they do so within the provider's own access-logged system. Stripe processes this material on our instructions for the purpose of verifying you, and separately for its own purposes, for which it is responsible in its own right rather than on our behalf.

Biometric information and your consent.Verification compares a selfie against the photograph in your identity document, which involves processing biometric information. You are asked to consent to this by the provider before it happens, and you may decline. If you decline, contact us and we will agree an alternative way to establish your identity; declining does not by itself end your request. Your information is used and shared by both DatSov and Stripe, each according to our respective privacy policies — Stripe's is at stripe.com/privacy. Stripe applies its own retention periods to the material it holds, which are shorter than ours and independent of them.

Screening. We screen your name and date of birth against published sanctions, politically-exposed-person, and adverse-media sources. For shipments outside the United Kingdom we additionally carry out export-eligibility and denied-party checks. We record which sources were checked, the outcome, and the reviewer.

Lawful basis. Compliance with a legal obligation, and our legitimate interest in not supplying secure hardware to people who intend to use it unlawfully. Where a check touches special-category or criminal-offence data, we rely on the substantial public interest condition for preventing or detecting unlawful acts.

Access and retention. Due-diligence records are held in an access-controlled system, restricted to named reviewers who authenticate with multi-factor authentication, and every access to a record is logged. Records are retained for the period set out in our due-diligence policy and are then deleted, unless a legal hold applies. You may exercise the rights in Section 10 in respect of this data; where a record must be kept to meet a legal obligation, we will tell you and restrict its use instead of erasing it.

Decisions. No decision to supply or refuse is made by automated means. A named person reviews every case and records their reasoning. Where we decline a request we are not always able to explain why.

Our processors Vercel, Web3Forms, Cal.com, and Stripe (including Stripe Identity) may process data in the United States and other jurisdictions. Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place — such as an adequacy decision or Standard Contractual Clauses — so that your data receives an equivalent level of protection.

Under UK data protection law you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data where there is no overriding reason to retain it.
• Object to or restrict processing in certain circumstances.
• Request portability of data you have provided to us.
• Withdraw consent at any time where processing is based on consent.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk.

To exercise any of your rights, or for any privacy question, contact us at contact@datsov.co.uk or +44 330 321 3113. Written requests may be sent to our registered office at 483 Green Lanes, London, England, N13 4BS.