This notice covers the SENGUARD app only. It explains what personal data the app processes, why and what your rights are. It does not cover the SENGUARD website. Please read it alongside your Participant Consent Form.
1. Who we are
SENGUARD Limited is a UK technology company that provides fraud prevention software. For the purposes of the data your app processes, SENGUARD Limited acts as the data controller.
Data Protection Officer: Grant McAdam, Co-founder and Technical Director
Email: dpo@senguard.co.uk
Website: senguard.co.uk
2. Our legal basis for processing your data
We process data under Legitimate Interest (Article 6(1)(f) of UK GDPR). Our legitimate interest is fraud prevention: helping to protect people from online scams and malicious content. We have assessed this against your interests and rights and are satisfied the processing is proportionate, limited to what is necessary and does not override your rights.
You may object to this processing at any time. The practical effect of doing so is the same as uninstalling the app (see Section 6).
3. What data we collect and why
Processed on your device only
The following is analysed on your phone in real time. It is never sent to SENGUARD’s servers:
- The full web addresses (URLs) of links you tap or pages you visit
- The content of web pages as they load in your browser
- DNS queries (the technical requests your device makes when connecting to websites)
This analysis happens locally and transiently. We do not compile a record of your browsing history.
Sent to SENGUARD’s servers (only for medium and high-risk threats detected)
When the app detects a potential threat, a small amount of non-identifying information is sent to our secure servers:
| Data item | What it means in plain terms |
|---|---|
| Device hash | A coded reference to your device. It cannot be reversed to identify you. |
| Participant / programme group identifier | A code indicating which group of the programme you are in. |
| Timestamp | The date and time of the event. |
| Hashed URL and hashed domain | A coded version of the web address. The readable address is not transmitted. |
| Threat score and risk level | How suspicious the app judged the content to be. |
| Action taken | Whether the content was blocked, allowed through, or flagged with a warning. |
| Category of threat | The type of potential scam or malicious content detected. |
| Whether you overrode a warning | If the app showed a warning and you chose to continue anyway. |
| App version and device type | Technical information to help us investigate issues. |
Sent to SENGUARD’s servers (low-risk threats detected)
For content assessed as low risk, no event-level data is transmitted. Once a day, the app sends a simple summary: the total number of links scanned and a broad breakdown by category. This summary cannot be linked to any specific page you visited.
Dispute submissions
If you believe a website has been blocked in error, you can submit the web address to us for review. This is the only situation in which a full, readable URL is transmitted from your device to our servers. We will not link this submission to information that identifies you personally.
4. What we do not collect
The following is never collected or processed by the SENGUARD app:
- Your name, address, or contact details
- Banking credentials, passwords, or authentication details
- Transaction data or account balances
- The content of personal messages, emails, or calls
- A compiled history of websites you have visited
5. Where your data is stored
Data transmitted from the app is stored on SENGUARD’s backend infrastructure. All data remains within the United Kingdom.
We do not share your data with external providers, law enforcement, or any third party, except where required to do so by law.
If you contact us for support, your communications may be handled through a third-party support platform whose servers are based in the EU, with backup infrastructure in the United States. This applies only to the content of support messages you send to us directly. It does not apply to any data collected or processed by the app itself, which remains within the United Kingdom as described above.
6. How long we keep your data
- Pseudonymised event logs (threat events linked to your device hash): retained for 18 months from the date of the event, then securely deleted.
- Aggregate statistics (daily summary totals containing no personal data): retained indefinitely for research and product development.
If you request erasure of your event log data, we will delete all records linked to your device hash. Because we do not hold your name on our servers, you will need to provide your device hash when making this request. We can explain how to find this.
7. Your rights
Under UK GDPR, you have the following rights in relation to the data the app processes:
Because we process data under legitimate interest rather than consent, there is no formal consent to withdraw. However, your right to object under Article 21 has the same practical outcome.
8. How to contact us
Email: dpo@senguard.co.uk
Website: https://senguard.co.uk
General enquiries Email: protect@senguard.co.uk
9. How to make a complaint
If you are unhappy with how we have handled your personal data, please contact us first and we will do our best to resolve the matter.
If you remain unsatisfied, you have the right to lodge a complaint with the UK’s data protection regulator:
Helpline: 0303 123 1113
Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF