Privacy Policy

Sentinel Shield ("we", "us") is committed to protecting the privacy of individuals whose personal data we process. This Privacy Policy explains what we collect, why, how long we keep it, and the rights you have. We act as a data controller for the personal data described here and as a data processor for the Customer Data you submit to the Service.

Data Controller

The data controller responsible for your personal data under GDPR is Sentinel Shield Ltd (company number available on request). You can contact our Data Protection Officer or privacy team at sentinelshield-help@mail.uk. Full postal address details are available on request.

1. Data We Collect

Account data: name, email address, role, and organisation details you provide when registering or inviting users.

Usage data: information about how you interact with the Service, including log-in times, features used, and device and IP information, collected automatically.

Customer Data: the records, documents, and compliance information you upload or create within the Service, which may include personal data of your staff or data subjects.

2. Legal Basis for Processing

We process personal data under the following lawful bases under GDPR: (a) contract — to provide the Service you have signed up for; (b) legal obligation — where required to comply with applicable law; (c) legitimate interests — to operate, secure, and improve the Service, balanced against your rights; and (d) consent — for optional analytics or marketing, which you can withdraw at any time.

3. How We Use Your Data

We use personal data to set up and administer accounts, deliver and support the Service, maintain security, generate aggregated analytics, communicate with you about your account, and meet legal obligations. We do not sell personal data.

4. International Transfers

Your data may be processed in countries outside your own. Where this occurs, we rely on recognised transfer mechanisms — such as adequacy decisions or Standard Contractual Clauses — to ensure your data is protected to a standard equivalent to GDPR.

5. Data Retention

We keep personal data only as long as necessary for the purposes set out here. Customer account data is retained while your subscription is active and for 24 months after termination, on the basis of our legal and audit obligations, and is then deleted. Backups are purged within 90 days of deletion. Audit logs are retained for 12 months. Customer Data is retained for the duration of your subscription and deleted in line with your retention settings or within 30 days of termination unless law requires otherwise. You can request export or deletion of your data at any time.

6. Sharing

We may share data with trusted sub-processors that help us run the Service (such as cloud hosting and email delivery), bound by written agreements requiring equivalent protection. Our current sub-processor list is available on our Sub-processors page, and the terms governing our processing on your behalf are set out in our Data Processing Agreement. We may also disclose data where required by law or to protect rights, safety, or property.

Where a customer connects an Incident Response Bot integration (Google or Microsoft), the minimum necessary metadata — email headers, file IDs, and sharing permissions — is processed via that provider's API under the customer's own OAuth2 authorisation to execute the remediation actions the customer configures. No provider credentials are stored by Sentinel Shield; access tokens are held in our managed token vault and used solely to perform the authorised actions.

7. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls, and regular review. However, no system can be guaranteed completely secure. You are responsible for securing your account credentials.

8. Cookies

The Service uses essential cookies to function correctly and optional cookies for analytics. You can control non-essential cookies through your browser settings. We do not use cookies for cross-site advertising profiling.

9. Your Rights

Under GDPR and equivalent laws, you may request access to, rectification of, erasure of, restriction of, or objection to processing of your personal data, as well as data portability. You can also withdraw consent where we rely on it, and lodge a complaint with your supervisory authority. To exercise any right, contact us using the details within the Service. We will verify your identity before acting on a request and respond within one month.

10. Children

The Service is intended for business use and is not directed at individuals under 16. We do not knowingly collect personal data from children. If you believe we have done so, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes by email or within the Service. The "Last updated" date above indicates when it was last revised.

12. Contact

For privacy questions, data subject requests, or to exercise your rights, contact our team at sentinelshield-help@mail.uk. We will handle your request in accordance with this policy and applicable data protection law.