Privacy & cookies
We are a security company, so we will be direct about this. Reading this site collects nothing that identifies you. There are no advertising trackers and no third-party scripts. Our own analytics run only if you accept them, and you can change that below at any time.
Your choice
Checking your current choice…
Who is responsible
STG — Swanswater Technology Group is the data controller for this website and for enquiries you send us. We operate from Stirling, Scotland. Write to [email protected] with any question about this policy or to exercise a right below.
Our registered company details and ICO registration number are available on request by email.
What we collect, and when
Reading this site collects nothing that identifies you unless you accept analytics or contact us. There is no advertising network, no social media pixel and no third-party tracker anywhere on this site.
There are three ways we end up with your information:
- You fill in the contact form. We receive the name, email address, company and message you type, plus the time you sent it. The form is handled by Netlify Forms and the submission is emailed to us.
- You email or call us. We keep the correspondence so we can answer you and, if you become a client, so we have a record of what was agreed.
- You accept analytics. We then record which pages you view, how long you stay, how far you scroll, which links and buttons you click, whether you started or submitted a form, the site or AI assistant that referred you, and technical details of your browser and device such as screen size, language, time zone and connection type. We do not record what you type into form fields, and we do not store your full IP address against your visit.
Why we are allowed to do this
For the contact form and correspondence, our lawful basis is legitimate interests: you asked us a question and we need your details to answer it. If we go on to work together, the basis becomes performance of a contract.
For analytics, our lawful basis is your consent, given through the banner. Storing an ID in your browser also needs consent under the Privacy and Electronic Communications Regulations, which is why nothing is stored and no analytics script runs until you accept. If your browser sends a Global Privacy Control signal we treat that as a refusal and never ask.
For security logging by our hosting and CDN providers, the basis is legitimate interests in keeping the site available and defended.
Exactly what is stored in your browser
This site sets no cookies. It uses browser storage instead, which the law treats the same way. Only the first row is written before you choose; everything below it is written only if you accept analytics.
| Name | Where | What it is for | How long |
|---|---|---|---|
| stg_analytics_consent | localStorage | Remembers whether you accepted or declined analytics, so you are not asked again. | Until you clear your browser storage |
| _stg_vid | localStorage | A random visitor ID. Lets us count one returning person rather than several new ones. | Until you clear your browser storage |
| _stg_vc | localStorage | How many times you have visited. | Until you clear your browser storage |
| _stg_ft | localStorage | What first brought you here: the referring site and any campaign tags on the link. | Until you clear your browser storage |
| _stg_sid | sessionStorage | A random ID for this browsing session, so pages you view are grouped into one visit. | Until you close the tab |
| _stg_px | sessionStorage | How many pages you have viewed in this session. | Until you close the tab |
| _stg_sr | sessionStorage | The site that referred you into this session. | Until you close the tab |
How long we keep it
Contact form submissions and email correspondence are kept for two years from our last exchange, unless you become a client, in which case business records are kept for six years after the engagement ends to meet accounting and tax obligations.
Analytics records are kept for 26 months and then deleted. The identifiers stored in your browser last as long as the table below sets out, and you can remove them at any time by declining analytics or clearing your browser storage.
Our suppliers
Netlify
Hosts this website and receives contact form submissions before they reach us.
United States, under the UK extension to the EU–US Data Privacy Framework
Cloudflare
Sits in front of the site as a content delivery network and security layer. Processes IP addresses to serve pages and block attacks.
Global network, with UK and EU points of presence
Microsoft 365
Our email and document platform. Anything you send us by email or through the form is handled here.
United Kingdom and European Union data centres
Clearview (our own platform)
Runs the analytics on this site. It is software we build and operate ourselves, on infrastructure we control, and no analytics data is passed to anyone else.
United Kingdom
If you are a client
This policy covers visitors to this website. When we deliver services, we usually process data on your behalf as your processor rather than as controller: device telemetry, security events, Microsoft 365 configuration and the compliance evidence we collect for you in Clearview. That relationship is governed by the data processing agreement in your contract, which sets out scope, security measures, sub-processors and what happens at the end of the engagement.
Clearview holds operational security data about your estate. It does not read the content of your documents or email, and access is restricted to the STG staff working on your account.
How we protect it
We hold Cyber Essentials certification and apply the same controls we recommend to clients: multi-factor authentication on every account, encrypted devices, least-privilege access, patching within defined windows, and monitoring of our own infrastructure. This site is served over HTTPS only, with HSTS enforced.
If you believe you have found a security issue with this site or our services, our contact details for reports are published at /.well-known/security.txt and we will acknowledge you.
Your rights
Under UK data protection law you can ask us for a copy of the personal data we hold about you, ask us to correct it or delete it, ask us to restrict or stop certain processing, object to processing based on legitimate interests, and ask for your data in a portable format. Where processing relies on consent, you can withdraw it at any time without affecting what came before.
Email us and we will respond within one month. We do not charge for this. If you are not satisfied with how we handle your request, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Changes to this policy
When this policy changes we update the date at the top of the page. If a change materially affects how we use your information, we will say so on the site rather than expecting you to notice.
Any question about your data
Ask us directly. We answer these ourselves, not through a form.