Privacy Policy

1. Who we are

SovereignStack ("we", "us") provides digital-sovereignty advisory and tooling. We are the data controller for the personal data described in this policy. Contact us at info@sovereignstack.org.uk.

2. What we collect

• Assessment details — your name, work email, company, sector and size, plus your aggregate category scores (never your individual answers).
• Enquiry details — anything you send us via our contact form.

3. How assessment data is processed

The risk assessment is scored entirely in your browser. Your individual answers, and any tools you select in the ROI calculator, are never transmitted to or stored by us. We receive only the details you submit (name, email, company, sector, size) and your aggregate category scores, so we can email you a copy of your report.

We treat a description of your technology stack as sensitive business information: we deliberately avoid collecting a full vendor inventory through the website, and we do not sell your data, ever.

4. Lawful basis

We rely on your consent (to email your results) and our legitimate interests (to respond to enquiries and improve our services). You can withdraw consent at any time.

5. Where your data lives

Consistent with our mission, your personal data is stored and processed within the EU/EEA and UK. Our sub-processors are listed in our Trust Center.

6. Retention

We keep enquiry and assessment data for as long as needed to provide our services, then delete it on request.

7. Your rights

You have the right to access, correct, delete, restrict or port your data, and to object to processing. To exercise any right, email info@sovereignstack.org.uk.

8. Changes

We'll post any changes to this policy here, with an updated date.