Privacy policy
Last updated 8 October 2026
This policy explains what happens to personal data in connection with the scatterkey.com website and the ScatterKey Readiness Check survey linked from it. It is short because we collect very little: there are no accounts, no analytics and no cookies.
Who we are
ScatterKey Ltd is the data controller. We are registered in England and Wales, company number 17499423, with a registered office at 1 Worsley Court, High Street, Worsley, Manchester, M28 3NJ, United Kingdom.
For anything in this policy, including a request about your own data, write to team@scatterkey.com.
What this policy covers
This policy covers the website and the Readiness Check survey. Where we provide encryption or key management services under a contract, the data handling for that service is governed by that contract and its data processing terms, not by this page.
What we collect when you browse
No cookies, no analytics and no tracking. Our pages set no cookies, runs no analytics, and has no sign-in. Nothing you do on the page is recorded by us, and no consent banner is needed because there is nothing to consent to.
Hosting logs. One thing does happen automatically. The site is hosted by Netlify, which records ordinary server request information such as your IP address, the page requested, the time, and your browser type. This is standard for any website and is used to serve the site and keep it available and secure. Netlify holds these logs for a limited period set by them, and acts as our processor. Everything else the page needs, including its fonts, is served from our own hosting, so no other company is contacted when you load it.
What we collect if you take the Readiness Check
The Readiness Check is a short survey about how organisations protect their encryption keys. It is hosted on Microsoft Forms, part of our Microsoft 365 account, and opens when you choose the "Check your keys" button: in a window on this page on larger screens, or in a new tab on phones. Taking it is entirely voluntary. Our own pages set no cookies, but once you open the survey, Microsoft Forms may set its own cookies inside the survey window so that the form works; these are covered by Microsoft's privacy statement.
Your answers. Most questions are about your organisation's systems and practices, such as your sector, where your keys are held and how they are managed. They are not about you personally. You do not need to sign in, and Microsoft Forms does not tell us who you are unless you choose to give us your details.
Your contact details, only if you give them. If you choose to give your name, email address or organisation, we will hold them with your answers so that we can send you your results or follow up, if that is what you asked for. Please do not include personal information about anyone else, or any passwords, keys or other secrets, in your answers.
How we use it. We use the answers to understand how organisations handle encryption keys today, to improve our product, and, where you ask us to, to reply to you. Our lawful basis is legitimate interests: we have an interest in researching the market we serve and in responding to people who ask us to. We treat your answers as confidential. If we publish findings, they will only ever be combined figures that do not identify you or your organisation. We will only contact you if you ask us to, and we do not use survey answers for marketing or sell them to anyone.
What we collect if you contact us
If you email us, we will hold your name, your email address, and whatever you choose to tell us, including anything you say about your own systems. Our email is provided by Microsoft 365.
We use it to reply to you and to keep a record of the conversation. Our lawful basis is legitimate interests: we have an interest in responding to people who approach us, and in keeping a record of what was discussed. If a conversation turns into a contract, our basis for the contact details in it becomes performance of that contract.
We do not use your details for marketing unless you ask us to, we do not sell them, and we do not add you to a mailing list because you emailed us.
How long we keep it
Correspondence is kept while the conversation is live and for up to 24 months after the last contact, after which it is deleted unless it forms part of a contract record or we have another reason to keep it that we can justify. Readiness Check responses are kept for up to 24 months after they are submitted, then deleted; combined figures that cannot identify anyone may be kept after that. Hosting logs are kept for the limited period our hosting provider applies.
Who else sees it
We use a small number of service providers, and only for the purposes above:
- Netlify — website hosting and request logs.
- Microsoft 365 — our email, and Microsoft Forms, which hosts the Readiness Check and stores its responses.
Both are based outside the United Kingdom, or store data outside it. Where that is the case, the transfer is covered by the safeguards those providers put in place, such as the UK addendum to the standard contractual clauses. We do not otherwise share your information with anyone, and we do not disclose it to third parties except where we are legally required to.
Your rights
You have the right to ask us for a copy of the personal data we hold about you, to have it corrected if it is wrong, and to ask us to delete it. You can also ask us to restrict what we do with it, object to us processing it on the basis of legitimate interests, and ask for it in a portable form. Email team@scatterkey.com and we will respond within one month.
If you are not happy with how we have handled your data, please tell us first so we have a chance to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Changes
If this policy changes we will update this page and change the date at the top. There is no archive of previous versions, so if the wording matters to you, keep your own copy.