Privacy Policy

ETOS GateKeeper is intellectual property of, and is operated by, Sunday Machine Ltd (“we”, “us”), a company registered in England and Wales, company number 11935976, registered office 10A The Rock, Bury, BL9 0NT, United Kingdom.

Sunday Machine Ltd is the data controller for customer and user personal data processed through this website and the ETOS GateKeeper platform.

For any question about this policy, or to exercise your rights over personal data we hold, contact privacy@etosgatekeeper.com. General and commercial enquiries: Demo@etosgatekeeper.com.

Contact and enquiry data: name, organisation, work email, role and the content of your message when you request a demonstration, an enterprise evaluation or agent assurance access.

Access-screening data: the organisation you declare, declared turnover, and the outcome of the eligibility assessment.

Account data: email address, authentication identifiers and account status where an account is approved.

Platform usage data: assurance submissions, evidence references and determination outputs associated with your organisation.

Payment data: order reference, package, amount and payment status. Card details are entered with our payment provider and are never received or stored by ETOS.

Technical data: aggregate page and event analytics used to understand which parts of the site are used. We do not use advertising trackers.

To assess and administer access requests, and to operate accounts we approve.

To deliver governed assurance outputs and to keep the evidence trail those outputs depend on.

To process payments for assurance credits and to meet accounting obligations.

To respond to enquiries and to improve the site and platform.

We rely on legitimate interests for assessing enterprise access requests, operating the platform securely and improving our service; on contract performance for delivering purchased assurance and account access; and on legal obligation for financial and record-keeping duties. Where we rely on consent, you may withdraw it at any time.

Sunday Machine Ltd remains the controller. The following third parties process personal data on our instructions as processors, each for a single stated purpose: Lovable (application hosting, database, storage, transactional email delivery and AI model access used by the assistant and assurance features), SumUp (card payments charged in GBP) and Paystack (card payments charged in NGN). A provider that stores or processes data on our instructions is a processor, not a controller of your data.

We do not sell personal data and we do not use advertising trackers. The current processor list is maintained by us and is provided on request and before onboarding; processing locations for an engagement can be confirmed in writing before onboarding.

Account records, enquiries and access requests, assurance submissions and their evidence, determination outputs and payment records are retained for the duration of the relationship and for the period needed to evidence a decision that has been relied upon or to satisfy legal and accounting obligations.

We are transparent about how this works today: deletion is carried out on written request rather than by an automatic timer, so records remain available until a request is made or an engagement-specific period is agreed in writing. Where a defined retention period is required, it is set out in the engagement agreement. Requests to privacy@etosgatekeeper.com.

Traffic is served over TLS. Application data is protected by row-level authorisation, administrative records are reachable only through validated server-side functions, and integration credentials are stored encrypted and never returned to the browser. Further detail is on our Trust & Security page.

Subject to applicable law you may request access to your personal data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Write to privacy@etosgatekeeper.com and we will respond within one month. If you are in the UK, you may complain to the Information Commissioner's Office.

Where data is processed outside your region, we use providers that offer recognised transfer safeguards. Residency requirements for an engagement can be confirmed before onboarding.

We will update this policy when our processing changes and will revise the date shown below.