Privacy notice
What personal data sdmx.cloud keeps, why, for how long, and your rights over it.
Preview draft, 30 September 2026. This notice applies to sdmx.cloud's private preview. It will be reviewed before Production opens, and we will email you before any change applies to you.
Who is responsible
Statistical Networks Ltd, registered in England and Wales runs sdmx.cloud and is the controller of the personal data described here. For anything about your data, write to support@sdmx.cloud.
What we keep
| What | Why, and on what basis | How long |
|---|---|---|
| Your account: email address, name, sign-in identifier, whether your email is confirmed, your verification status, your appearance setting, and which terms you accepted and when. Your password is held only by our sign-in service, as a one-way hash. | To give you an account and sign you in. Needed for our contract with you. | While you have an account. |
| Your organisation: your membership and role, invitations (the address invited and who invited it), and what you told us when asking for approval or for a name. | To run your organisation's workspace and check who may use its names. Contract, and our legitimate interest in keeping names honest. | While the organisation exists. Removing an organisation deletes these records. |
| Activity records: who did what and when in an organisation (people, roles and registries), and every platform admin action, with the reason given. | Accountability and security. Our legitimate interest, and yours, in knowing who changed what. | An organisation's records go when it is removed. Platform admin records are not yet deleted automatically; we will set a period before Production. |
| The Production waiting list: your email address, the page you joined from, and when. | To tell you when Production opens. Your consent, which you can withdraw at any time. | Until we have told you, or until you ask us to remove it. |
| Directory suggestions: which account suggested a service. | To tell you our decision. Our legitimate interest in running the directory. | As long as the listing is kept. |
| Listings your organisation owns: the text its admins write (title, description, what it serves, a contact address, which is public), where its DNS record was found, and who did what with the listing. | To show the listing, check the record, and tell your admins about its review and its health. Contract, and our legitimate interest in running the directory. | While your organisation owns the listing. When it stops, the text is removed; the activity record stays with the organisation's. |
| Assistant access: for each request, the registry or service, the client's product name from its User-Agent, a salted hash of its address, the tool used, the outcome and the time. The address itself is never stored. | Rate limits, and showing an organisation how its assistant access is used. Our legitimate interest. | 30 days, then deleted automatically. |
| Rate limits: the address a request came from, or your account. | To stop abuse. Our legitimate interest. | In memory only, for the length of the limit (at most a day). Never written to disk. |
| Web server logs: the address, time and page of each request, and the address in any error the proxy records. | Security and fixing faults. Our legitimate interest. | Service logs 30 days. Our front proxy's request logs about 5 weeks, its error logs about 11 weeks. All then deleted automatically. |
The structures in your registries are yours; we handle them only to run your registries (see the terms). A registry's own history records which account made each change. Please do not put personal data in a registry.
Emails
We email you only about your account, your organisation, your registries, listings you suggested, and, if you joined the waiting list, Production opening. We do not send marketing email. Email is sent from no-reply@sdmx.cloud.
Where it is, and who else handles it
- sdmx.cloud's servers, database and sign-in service run on infrastructure Statistical Networks Ltd operates in the United Kingdom.
- Our email is relayed by Google Workspace, so the addresses and contents of the emails we send pass through Google, under Google's data processing terms, which cover any transfer outside the UK.
- No one else receives your personal data. We do not sell it, use it for advertising, or put third-party trackers or analytics on our pages.
Cookies
sdmx.cloud uses only the cookies it needs to sign you in and to remember your appearance and menu settings.
| Cookie | Purpose | Lasts |
|---|---|---|
| authjs.* | Keeps you signed in to the console. Encrypted; it holds your sign-in tokens. Short-lived companions protect the sign-in itself. | Until you sign out, or 30 days |
| KEYCLOAK_*, AUTH_SESSION_ID | Our sign-in service, on sso.statisticalnetworks.com, so one sign-in covers the console and your registries. | Your sign-in session |
| JSESSIONID | Set by a registry when you open it, to keep you signed in to that registry. | Until 60 minutes idle |
| sc-theme | Your light, dark or system appearance choice. | One year |
| sc-nav | Whether you collapsed the console's menu. | One year |
| sc-terms | Carries your acceptance of the terms from the sign-up page to your account. | One hour |
Your rights
Under UK data protection law you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, or to have it in a portable form. You can withdraw consent to the waiting list at any time. Write to support@sdmx.cloud; we will reply within a month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Security and changes
How we protect the service is on the security and trust page. Each version of this notice carries its date, and we will email account holders about any change that affects them.