Privacy Policy
Last updated 19 August 2026
This site records detailed technical information about every device that loads it, whether or not you contact us. This policy sets out exactly what is recorded, why, how long it is kept and what you can require us to do about it. We would rather state it plainly than bury it.
1. Who we are
Stag Atlas ([[REGISTERED ENTITY NAME]], registered in [[JURISDICTION]], registered address [[POSTAL ADDRESS]]) is the controller of the personal data described in this policy. Stag Atlas acts as an intermediary and broker in the defence and critical-infrastructure sector.
For any question about this policy, or to exercise any right described in section 9, write to naftali@stagatlas.international.
2. What this site collects
We collect two categories of information: technical and device information gathered automatically, and whatever you choose to type into the contact form. Nothing in the contact form is mandatory.
2.1 Collected automatically
When your browser loads this page, a script gathers the following and sends it to our server together with information our server observes about the connection itself:
| Category | Specifically |
|---|---|
| Connection | IP address; approximate country, region, city and postal district derived from that IP address by our infrastructure provider; the latitude and longitude of that approximate location; the network operator and autonomous system number; the edge location that served you; HTTP protocol version; TLS version. |
| System | Operating system and version; browser and version; device type; platform; full user-agent string; preferred languages; time zone and UTC offset. |
| Display | Screen width and height; available screen area; browser window dimensions; colour depth; device pixel ratio; screen orientation. |
| Hardware | Number of logical processor cores; approximate device memory; maximum simultaneous touch points; graphics vendor and renderer as reported by WebGL. |
| Fingerprint surfaces | Hashes derived from how your device renders a test image to a canvas, how it renders a WebGL scene, and how it processes a test audio waveform; the set of fonts installed on your system that we can detect; the browser plugins reported. |
| Context | The page you arrived from, if your browser sends it; the path you landed on; whether cookies are enabled; your Do Not Track setting; the date and time of each visit. |
| Derived identifier | A visitor ID: a one-way SHA-256 hash computed from the stable items above. It lets us recognise that the same device has returned without setting a cookie on it. |
On MAC addresses. No website can read your device's hardware MAC address. Browsers do not expose it on any platform, by deliberate design, and this one does not attempt to obtain it by any other route. We say so explicitly because it is a common assumption.
On the visitor ID. It is a hash, not an account. We cannot reverse it to recover the underlying characteristics, and it does not identify you by name unless you separately tell us your name through the contact form.
2.2 Information you give us
The contact form has fields for name, email address, organisation, country, telephone number and a free-text message. None of them is required. Send only what you are willing to send; a message with no identifying details at all is accepted, and is a legitimate way to use this site. The only rule enforced is that a completely empty form is not a message.
Anything you type into the free-text field is stored as written. Please do not put information there that you would not want held in a commercial contact record — including classified, export-controlled or otherwise restricted material, which must never be sent through this form. See the Terms of Use.
When you submit the form, the technical record of the connection it arrived on is stored alongside it, and your submission is emailed to us.
2.3 The private area of this site
This site has a password-protected area used by Stag Atlas personnel. Attempts to enter it are logged with the IP address, timestamp and whether the attempt succeeded — a security measure, and the basis on which repeated failed attempts from one address are rate-limited.
3. Why we collect it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Responding to your enquiry and pursuing the business relationship you initiated | Legitimate interests (GDPR Art. 6(1)(f)), and steps taken at your request prior to a contract (Art. 6(1)(b)) |
| Understanding who is interested in our services, at what scale, and from which countries and organisations | Consent (Art. 6(1)(a)) where consent is required for the collection — see section 4. Otherwise legitimate interests (Art. 6(1)(f)) in understanding demand for the business |
| Detecting and blocking automated abuse, spam and intrusion attempts; securing the private area | Legitimate interests (Art. 6(1)(f)) in the security of the service; legal obligation to secure personal data (Art. 32) |
| Keeping a record of business communications | Legitimate interests (Art. 6(1)(f)); legal obligation where retention is separately required of us |
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. We consider the balance defensible because the data is used only to run and secure a business-to-business enquiry channel, is not sold, is not used for advertising, is not combined with data brokered from third parties, and is not used to make any decision that produces legal or similarly significant effects about you. You may object to this processing at any time — see section 9.
4. Consent, and where it applies
Storing information on, or reading information from, your device requires your consent in the European Economic Area, the United Kingdom and Switzerland under Article 5(3) of the ePrivacy Directive and its national implementations. That rule is technology-neutral: it reaches device fingerprinting, not only cookies.
So if our infrastructure indicates your connection originates in one of those jurisdictions, this site asks before it collects anything. Until you accept, no fingerprint is taken and no record of your visit is written anywhere — the collection script does not run and nothing reaches our database. If you decline, the same is true permanently, and your choice is remembered in your browser's local storage so you are not asked again on that browser. Declining does not restrict the site: you can still read every page and still use the contact form.
Where we cannot determine your location with confidence, we treat you as though consent is required. Connections arriving over anonymising networks are treated the same way.
Outside those jurisdictions, collection is on the legitimate-interests basis set out above and begins when the page loads. This policy is the notice of it. You may still object; see section 9.
5. Cookies and local storage
This site sets no advertising cookies, no analytics cookies and no third-party cookies of any kind. There is no Google Analytics, no advertising pixel, no social widget, no embedded font service and no content-delivery script loaded from anyone else. Every file this page loads comes from this domain.
Two small items are used:
-
Local storage entry
sa_consent— stores only whether you accepted or declined, so you are not asked on every visit. Set only where the consent banner is shown. Clearing your browser storage removes it. -
Session cookie
sa_session— set only after a successful login to the private area, so Stag Atlas personnel stay signed in. It is cryptographically signed, marked HttpOnly, Secure and SameSite=Strict, expires after 12 hours, and is never set for ordinary visitors.
6. Who else sees this data
We do not sell personal data, we do not share it with data brokers, and we do not use it for advertising. Three categories of recipient exist:
- Cloudflare, Inc. — hosts this site and its database, and provides network security. Cloudflare processes the connection data described above as our processor and as a controller for its own network security purposes.
- Resend (Plus Five Five, Inc.) — delivers the notification email when you use the contact form. It processes the contents of that email on our behalf.
- Professional advisers, and authorities — where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims. Given the sector in which we operate, this includes disclosures required under applicable export-control, sanctions and anti-money-laundering law. We will not volunteer your data beyond what such an obligation requires.
If Stag Atlas is ever sold or reorganised, contact records may transfer to the successor, which would remain bound by this policy until it lawfully replaces it with notice to you.
7. International transfers
Our infrastructure is globally distributed, so data may be processed outside your country, including in the United States. Where personal data of people in the EEA, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, the transfer is made under the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), which our providers incorporate into their terms. You may request a copy of the relevant safeguards from the address in section 1.
8. How long we keep it
| Record | Retention |
|---|---|
| Visit and device records | 24 months from the visit, then deleted |
| Contact submissions | 36 months from your last contact with us, unless a live commercial relationship or a legal obligation requires longer |
| Login attempt logs | 24 hours, pruned automatically |
| Notification emails | Retained in our mailbox under our ordinary business correspondence practice |
We will delete sooner on a valid request under section 9, subject to any overriding legal obligation to retain.
9. Your rights
Depending on where you live, you have some or all of the following rights. We extend them to everyone who asks, regardless of location, because operating two standards is not worth the complexity.
- Access — obtain a copy of what we hold about you.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted.
- Restriction — have processing paused while a dispute is resolved.
- Objection — object to processing based on legitimate interests, including the analytical use of your visit record.
- Portability — receive your data in a machine-readable form.
- Withdraw consent — at any time, without affecting what was lawfully done beforehand. Clear this site's local storage to be asked again.
- Non-discrimination — we will not degrade the service or treat you differently for exercising any of these.
To exercise any of them, write to naftali@stagatlas.international. We respond within 30 days. There is one practical limit worth stating honestly: if you never gave us your name or email, the only handle we hold is a device fingerprint, and we may need you to send your request from the same browser and device so that we can identify the correct record rather than someone else's. If we cannot verify which record is yours, we will say so rather than disclose the wrong person's data.
If you are in the EEA or the UK you may complain to your national supervisory authority. We would ask you to raise it with us first, but that is a request, not a precondition.
10. Automated decision-making
We do not carry out automated decision-making that produces legal or similarly significant effects about you within the meaning of GDPR Article 22. The automated rules on this site are limited to spam filtering and rate-limiting.
11. Children
This site addresses a professional defence and critical-infrastructure audience and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has sent us data, write to us and we will delete it.
12. Security
Data is transmitted over TLS and stored on managed infrastructure. The private area is protected by authentication, rate-limiting and signed session tokens, and no visitor or submission data appears in any page served to an unauthenticated request. No system is perfectly secure, and we do not claim otherwise; if a breach affects your rights, we will notify you and the relevant authority as the law requires.
13. Changes
If we change this policy we will update the date at the top. Where a change materially affects how we use data we already hold, we will seek fresh consent or give notice before it takes effect, as the law requires.
Stag Atlas · naftali@stagatlas.international · Terms of Use · Home