Introduction
This Privacy Policy explains how Shieldvectaris INC collects, uses, stores and discloses information in the course of running a computer systems design and integration business and its watch keep desk. It was prepared by the developer Shield Vectaris together with the desk team, and it is written to be read by clients, visitors and partners without legal training. It applies to our website at shieldvectaris.mom, to enquiries that arrive by email or telephone, and to the records we keep while a watch desk engagement is active.
We believe that a privacy policy is part of the wall, not a decoration hung on it. The policy therefore describes the work we actually perform: the messages we read, the drawings we prepare, the drill reports we write and the roster records we keep. Where our practice changes, this page changes with it, and the effective date at the top of the page tracks the most recent revision. If any part of this policy is unclear, we welcome a question at request@shieldvectaris.mom before you share information with us.
Shieldvectaris INC is an independent business. We do not sell information, we do not trade contact lists, and we do not operate advertising networks. Our interest in information is narrow and practical: we need enough of it to answer your enquiry, to plan the work you ask for, and to keep a truthful record of the watch we have held.
Who We Are
Shieldvectaris INC is the entity responsible for the information described in this policy. The business is located at 3808 S 300 E, South Salt Lake - 84115-4824, United States (US). The primary contact address for privacy matters is request@shieldvectaris.mom and the desk telephone number is +18028023916.
Our work falls within Computer Systems Design and Related Services, and we serve clients in the Professional, Scientific, and Technical Services sector and in adjacent professional fields. We are not a security firm, we do not offer emergency response on behalf of third parties, and we do not hold ourselves out as a regulated financial institution. The watch desk we operate is a planning, drilling and record-keeping service delivered to clients under a written agreement.
Shieldvectaris INC
3808 S 300 E, South Salt Lake - 84115-4824, United States (US)
Email request@shieldvectaris.mom · Telephone +18028023916
Scope of This Policy
This policy covers information processed through our public website, through written and telephone enquiries, through proposals and engagement documents, and through the records generated while a watch desk engagement runs. It does not cover information that a client processes in its own systems independently of us, and it does not cover websites operated by other businesses even where we link to them.
Where we act as a processor for a client, meaning that we handle information on the instruction of that client, the client remains the controller and this policy operates alongside the data processing terms agreed in the engagement. Those terms take precedence to the extent of any conflict for the specific processing they describe. This policy continues to apply to our own business records, our correspondence and our website.
If you are an employee or contractor of a client, information about you may reach us as part of a roster, a drill or a handover. In that situation our role is usually that of processor for the client, and the client is the first place to direct questions about rights and access.
Information We Collect
The information we collect falls into four practical groups. First, information you give us directly, such as your name, organisation, email address, telephone number and the content of a message. Second, information generated while we prepare a proposal or run a drill, such as notes from a call, a drawing of an estate, a list of named contacts and a schedule of sessions. Third, information produced by the watch desk itself, including rosters, handover notes and drill reports. Fourth, limited technical information produced by ordinary web server operation, such as the pages requested and the time of a request.
- Contact details supplied through the contact form, by email or by telephone.
- Organisation details needed to prepare an accurate drawing of a client estate.
- Meeting notes and scheduling information connected to drills and handover evenings.
- Watch desk records describing who held the watch and what was handed over.
- Technical logs from our web server, kept briefly for reliability and abuse prevention.
- Billing and payment correspondence handled by ordinary business channels.
We do not ask for special categories of information such as health data, biometric data or information about political or religious beliefs, and we ask that you do not include such information in messages to the desk. If a drill scenario would require such information, we will discuss a sanitised substitute before any session is scheduled.
How We Use Information
We use information to answer enquiries, to prepare proposals, to plan and deliver the six watch desk routines, to keep accurate records of the work performed, to invoice correctly and to meet legal obligations. Where you have agreed, we may also use your contact details to send an occasional note about a new routine or a change in scheduling. We do not use information for automated profiling, we do not build advertising audiences, and we do not sell or rent information to any party.
Watch desk records are used to keep continuity between reliefs, to answer questions about what happened during a shift, and to support the audit routine that compares the written book against the behaviour of the systems. Drill notes are used to prove that a rehearsal took place and to track the closure of findings. Where a client asks for a specific retention arrangement, we follow the written agreement for that engagement.
We may aggregate information in a form that no longer identifies any person in order to describe our service in general terms or to improve the desk. Aggregated descriptions never single out a client and never reveal the contents of a drill, a roster or a handover.
Legal Bases for Processing
Where law requires us to name a legal basis for processing, we rely on the following. Performance of a contract covers information needed to prepare proposals, deliver drills and sessions, and invoice for the work. Legitimate interests cover the ordinary running of the business, including securing the website, responding to enquiries and keeping accurate records. Consent covers optional communications that you agree to receive, and you may withdraw that consent at any time. Legal obligation covers records we must keep or disclose under applicable law.
When we process information as a processor for a client, the client is responsible for identifying the legal basis for its processing, and we follow the instructions we have agreed with it. If you believe that a basis has been applied incorrectly, write to request@shieldvectaris.mom and explain the circumstances. We will review the position promptly and explain what we can adjust.
Watch Desk Records
A watch desk lives or dies by its records. We keep a watch book that records who held the watch, what was handed over, which drills were run and which findings remain open. The book is used to preserve continuity across reliefs and to answer the simple question of who was accountable at a given moment. It is kept in a controlled store, it is readable only by members of the desk who need it, and it is never shared outside the engagement without written agreement.
Roster records name the people who hold the watch, their contact details and their coverage windows. We keep roster records because a roster without names is a fiction. Where a client asks us to use operational aliases in place of personal names, we will use them, provided that a private key to the aliases is kept with the client. Handover notes describe the state of a system rather than the lives of the staff, and we ask the desk to keep them focused on the equipment and the tasks.
Drill reports record the scenario, the participants, the outcome and the findings. Where a report names an individual, the name is used to record accountability and training, not to rank or evaluate people. We retain drill reports for the period agreed in the engagement and otherwise for no longer than is needed to close the findings and support a reasonable audit trail.
Client System Data
During drills and signal relay hours we may see technical data from a client estate, such as hostnames, account names, log excerpts and configuration files. We treat all of this as confidential. We collect only what the session requires, we prefer sanitised extracts over live data wherever the drill allows it, and we delete working copies once the written artefact is complete and accepted by the client.
We do not copy production databases, we do not retain credentials after a session ends, and we do not move client data into a personal account or a personal device. Temporary credentials issued for a drill are revoked at the close of the session and their issuance is recorded in the session note. Where a client requires additional controls, such as a specific region for storage or a specific ban on portable media, those controls are written into the engagement and applied without exception.
Service Providers
We rely on a small number of providers for ordinary business functions, such as hosting our website, operating our email and maintaining our bookkeeping. These providers act on our instructions and are bound by their own terms of service and, where applicable, by written processing terms. We choose providers that we believe are competent and that offer appropriate technical and organisational safeguards.
We keep the list of providers under review and remove any provider that no longer meets our standard. Where a provider will process information outside the United States, we apply the transfer safeguards described in the international transfers section. A client may ask, in writing, which categories of provider are used for a specific engagement, and we will answer that request as part of the proposal.
International Transfers
Our business is based in the United States and most processing happens here. Some service providers operate infrastructure in other countries, so information may be stored or processed outside the country where it was collected. Where that happens, we rely on appropriate safeguards such as standard contractual clauses or an equivalent recognised mechanism, and we require the provider to protect the information to a standard that is consistent with this policy.
If a client requires that information remains within a specific region, we will say plainly whether the proposed arrangement can meet that requirement. Where it cannot, we will suggest an alternative routine that avoids the transfer rather than promising something the desk cannot deliver. Clients are always free to ask for a written description of where information is stored before signing an engagement.
Data Retention
We keep information only for as long as we need it for the purpose for which it was collected. Enquiries that do not lead to an engagement are kept for a short period and then removed. Proposal documents, engagement records and invoices are kept for the period required by tax and business law. Watch books and drill reports are kept for the period agreed with the client and otherwise for no longer than is needed to support an audit trail and a reasonable change of watch.
When a retention period ends, information is deleted or irreversibly anonymised. Where deletion would conflict with a legal obligation, the relevant records are kept only for that obligation and are then removed. A client may specify a shorter period in the engagement where the law allows it. Retention decisions are recorded so that the desk can answer questions about them later without relying on memory.
How We Protect Information
We apply technical and organisational measures that are reasonable for a business of our size and for the sensitivity of the information we handle. Measures include access control with named accounts, full disk encryption on portable devices, encrypted transport for email and web traffic where the counterpart supports it, and a practice of keeping credentials in a managed store rather than in documents. Physical records are kept in locked storage at our premises.
We train the desk on handling information, we review access rights at each change of watch, and we rehearse the removal of access when a person leaves an engagement. No system is perfectly secure, and we do not claim otherwise. If a breach affects information under our control, we will investigate promptly, contain the damage, and notify affected parties and authorities as required by law. We will also tell clients what happened in plain language rather than in a notice that obscures the facts.
Your Rights
Depending on where you live, you may have rights in relation to information about you. These can include the right to know whether we hold information about you, to receive a copy of it, to correct errors, to request deletion, to restrict or object to certain processing, and to receive information in a portable format. You may also have the right to withdraw consent where processing is based on consent, without affecting processing that took place before withdrawal.
To exercise a right, write to request@shieldvectaris.mom and describe the request clearly. We may need to verify your identity before acting, and we will use proportionate methods that do not require you to send sensitive documents. We aim to respond within thirty days and will tell you promptly if a request concerns information that we process on behalf of a client, so that the request can also be directed to the client as controller.
Access and Correction
You may ask for a copy of the information we hold about you and for an explanation of where it came from and who it has been shared with. Where the information is incorrect or incomplete, you may ask us to correct it. We will correct our own records and, where we process information for a client, we will pass the request to the client and assist it as the engagement requires.
Where a correction would affect a watch desk record, we will keep a note of the correction rather than silently rewriting history. A watch book that can be edited without trace is not a reliable record, so corrections are recorded with a date and a short reason. This practice protects both the client and the desk in the event of a later audit.
Deletion Requests
You may ask us to delete information about you. Where we control the information and no legal or contractual obligation requires us to keep it, we will delete it and confirm the deletion in writing. Where a retention obligation applies, we will explain the obligation and delete the information when it expires. Where we process information for a client, we will forward the request to the client and help it act on the request.
Deletion does not apply to information that has been aggregated in a form that no longer identifies you, and it does not extend to records that must be preserved to answer a legal claim. We do not keep a hidden copy of deleted information for convenience. Backups are rotated on a defined cycle, and information removed from active systems is removed from backups as the cycle completes.
Privacy for Children
Our services are provided to businesses and professional organisations, and our website is not directed at children. We do not knowingly collect information from anyone under the age of sixteen. If you believe that a child has sent information to the desk, write to request@shieldvectaris.mom and we will remove the information promptly after verification.
Because our work concerns computer systems design and integration, a child would have no legitimate reason to contact the desk directly. Enquiries from schools or educational programs are welcome where they come through an authorised adult representative, and in those cases we collect only the contact details needed to answer the enquiry.
Marketing Communications
We send marketing communications only where you have agreed to receive them or where the law permits a soft opt-in for an existing client. Messages are infrequent and concern the desk itself: a new routine, a scheduling change or a short note on a drill season. Every message includes a clear way to opt out, and opting out does not affect the delivery of contractual communications such as handover notes or invoices.
We do not buy contact lists, we do not scrape addresses from websites, and we do not share a marketing list with any partner. If you receive a message that appears to come from Shieldvectaris INC but seems inconsistent with these practices, please report it to request@shieldvectaris.mom so that we can investigate.
Automated Decisions
We do not make decisions about individuals by automated means in a way that produces legal or similarly significant effects. Scheduling, invoicing and record keeping involve ordinary business software, but every decision that affects a client or a member of the desk is made by a person. Drill outcomes are reviewed by a named member of the desk before they are written into a report.
If a client asks us to automate a routine in future, we will describe the automation in the engagement and explain the human oversight that accompanies it. We will not silently introduce a system that ranks individuals or determines access without a documented review route.
Third Party Sites
Our website may link to other sites, for example a client site or a professional body. We are not responsible for the privacy practices of those sites, and a link is not an endorsement of their policies. We encourage you to read the privacy notice of any site before sharing information with it.
Where we embed a third party tool in our own site, we will describe it in this policy and, where consent is needed, ask for that consent before the tool loads. At the time of this revision the public site does not embed any third party analytics or advertising tool.
Changes to This Policy
We review this policy at least once a year and whenever our practices change in a material way. A new version is published on this page with a revised effective date, and material changes are described in a short note at the top of the page for a reasonable period. Where a change would affect an active engagement, we also notify the client in writing.
We do not apply a new policy retroactively to information collected under an earlier version unless the change is required by law or is clearly beneficial to the individuals concerned. If you continue to use the website or correspond with the desk after a revision, you accept the revised policy for information provided after that date.
How to Contact Us
Privacy questions, requests and complaints should be sent to the desk at request@shieldvectaris.mom or by telephone at +18028023916. Written correspondence may be addressed to Shieldvectaris INC, 3808 S 300 E, South Salt Lake - 84115-4824, United States (US). We aim to acknowledge every privacy request within five business days.
If you are not satisfied with our response, you may contact the relevant supervisory authority in your jurisdiction. We would always prefer to hear from you first so that we can explain our position and, where we have made a mistake, correct it.
Shieldvectaris INC · 3808 S 300 E, South Salt Lake - 84115-4824, United States (US)
Email request@shieldvectaris.mom · Telephone +18028023916
Governing Law
This policy is governed by the laws of the State of Utah and the applicable laws of the United States, without regard to conflict of law rules. Where local privacy law grants you stronger rights than this policy describes, those rights prevail and we will honour them. Nothing in this policy limits a right that cannot be limited by agreement.
If any provision of this policy is found to be invalid, the remaining provisions continue in force. A failure to enforce a provision on one occasion does not waive the right to enforce it later. Questions about the governing law of an engagement are addressed in the terms of service for that engagement.