Privacy notice

Effective date: 23 September 2026

1. Who this notice covers

This notice explains how Scout Atlas Limited (company number 16625642, registered office 1 Armstrong House, High Street, Uxbridge, UB8 1GJ) ("the Company") processes personal data collected through its corporate website at scoutatlas.uk and its documentation subdomain at docs.scoutatlas.uk, as the data controller for that processing. It does not cover any operating division's own product or service. Each operating division will publish its own privacy notice before it collects personal data from clients, candidates or employers, and that notice, not this one, will govern that data.

2. What personal data the Company collects

Across both sites, the Company collects personal data submitted through the contact form on scoutatlas.uk or by email (name, email address, and the content of the message), and technical data generated automatically by visiting either site (IP address, browser type, device type, pages requested, and timestamps, captured in server logs). Providing personal data through the contact form or by email is voluntary; without a name and email address the Company cannot reply.

On scoutatlas.uk, the Company also stores preference data locally in the visitor's own browser: the theme choice, and a session flag that stops the entry sequence replaying within the same visit. These are stored locally, are not cookies, and never leave the visitor's device.

On the documentation subdomain, docs.scoutatlas.uk, the preference data stored locally in the visitor's own browser is the theme choice alone, because that site has no entry sequence and so keeps no session flag. That site additionally collects a page-feedback signal (a thumbs up or down) together with a daily-rotating, one-way hashed identifier used only to prevent the same visitor voting on the same page twice within a day; this hashed identifier does not identify an individual, is not a cookie, and is never stored in the visitor's browser.

3. Why the Company processes this data, and the legal basis

Contact messages are processed to respond to the enquiry and, where the enquiry leads to a commercial discussion, to take steps at the sender's request before entering into a contract (UK GDPR Article 6(1)(b)); where no contract is in prospect, the basis is the Company's legitimate interest in communicating with people who contact it (Article 6(1)(f)). Technical data in server logs is processed to keep the website secure and available, under the Company's legitimate interests (Article 6(1)(f)). The Company has recorded a legitimate interests assessment for each of these purposes and will supply a summary on request.

Right to object. Any individual may object at any time to processing that rests on legitimate interests. Objections can be sent to the contact details in clause 12; the Company will stop the processing unless it can show compelling legitimate grounds that override the individual's interests, rights and freedoms.

The Company does not carry out automated decision-making or profiling that produces legal or similarly significant effects.

4. How long data is kept

Contact messages, and the Company's replies, are kept for as long as needed to deal with the enquiry and for no longer than 24 months after the last exchange, unless the Company needs them for longer to establish, exercise or defend a legal claim, or the law requires a longer period. Where an enquiry leads to an engagement with one of the Company's divisions, the message becomes part of that engagement's records and the division's own privacy notice governs its retention from that point. Server logs are kept for no longer than 90 days.

5. Who this data is shared with

The Company does not sell or rent personal data. The website is served from the Company's own self-hosted infrastructure: a server rented from Hetzner Online GmbH (Germany) on which the Company itself deploys and operates the website using Coolify, an open-source deployment tool, so no third-party hosting platform or content delivery network handles visitor data on the Company's behalf, and Hetzner acts only as the provider of the server on which the Company's server logs are held; the domain name system for scoutatlas.uk is provided by Cloudflare, Inc. (United States), which therefore handles the domain lookups that visitors' devices make. The Company runs no analytics on this website and no third-party analytics company receives visitor data. Messages sent by email are received in a mailbox provided by Google LLC (United States), which acts as a processor under its published terms. This clause will be updated before any analytics run or before the hosting arrangement changes, so that it names the processors actually involved. The Company may also disclose personal data where the law requires it, for example to a court or regulator, or to its professional advisers under a duty of confidence. Feedback data collected on docs.scoutatlas.uk is stored on the same self-hosted infrastructure described above and is not shared with any third party.

Cloudflare and Google process data in the United States and elsewhere; the Company relies on their certification under the UK Extension to the EU-US Data Privacy Framework and, as a fallback, on the International Data Transfer Addendum approved by the Information Commissioner, which forms part of the Company's terms with each of them. A copy of the relevant safeguard can be requested from the contact details in clause 12.

6. Children

This website is intended for adults and is not directed at children; the Company does not knowingly collect personal data from anyone under 18. Anyone who believes a child has provided personal data through this website should contact the Company so it can be removed.

7. Marketing communications

This website does not currently collect sign-ups for marketing communications. If that changes, any sign-up will use a clear, unchecked opt-in checkbox, never a pre-ticked box, and consent to receive marketing can be withdrawn at any time.

8. Visitors outside the United Kingdom

This website is operated from the United Kingdom and this notice is written to UK data protection law. Where the law of another country gives a visitor rights in relation to personal data the Company holds, the Company will consider any request made under that law on its merits and respond in line with this notice.

9. Data subject rights

Under UK data protection law, any individual has the right to ask the Company for access to, correction of, erasure of, or restriction of their personal data, the right to object to its processing, and the right to data portability where it applies. Requests can be sent to the contact details in clause 12. The Company will respond within one month of receiving a request, or within three months where a request is complex, in which case it will explain the delay within the first month. The Company may ask for proof of identity before acting on a request. Anyone unhappy with how the Company has handled their personal data is invited to complain to the Company first, and it will acknowledge the complaint within 30 days and respond without undue delay. Any individual also has the right to complain at any time to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

10. Accessibility

This notice is available in plain text on request. See the Company's accessibility statement for how to request this website's content in an alternative format, or to report an accessibility problem.

11. Changes to this notice

The Company may update this notice from time to time. The effective date at the top of this page shows when it was last updated.

12. Contact

Questions about this notice, and requests relating to personal data, can be sent by email to sharifhamza635@gmail.com or by post to Scout Atlas Limited, 1 Armstrong House, High Street, Uxbridge, UB8 1GJ. The contact form on scoutatlas.uk can also be used once it is live; the documentation subdomain has none, so email or post is the route from there. The Company has not appointed a data protection officer, as the law does not require one for an organisation of its size and activity; the directors are responsible for data protection.

---

The version of this notice published at scoutatlas.uk/privacy is the canonical and authoritative text; this page is a mirror of it.