PRIVACY POLICY

Last updated April 2026

Applies to: sightacre.com

Introduction

Sight Acre LLC acts as the Data Controller for the personal information collected through our Services. This means we are responsible for deciding how and why your personal data is processed.

We encourage you to read this policy carefully to understand your rights and our practices. If you have any questions, or wish to exercise your rights under the UK GDPR or EU GDPR, please contact our Data Protection team at [email protected].

1. What Personal Information Do We Process?

We process personal information based on your interactions with our website. Sight Acre (sightacre.com) does not currently operate email sign-ups, account creation, or direct data capture forms.

The personal data we collect is limited to information you provide if you contact us directly via our enquiry form, and data collected automatically through Google Analytics, subject to your cookie consent.

1.1 Information You Provide to Us

Name and contact details (email address, phone number) if you submit an enquiry
Any information you choose to include in a free-text enquiry form

1.2 Information Collected Automatically

IP address, browser type, operating system, and device identifiers
Pages visited, time on site, and navigation paths
Cookies and similar tracking technologies (see our Cookie Policy)
Google Analytics data: session information, pages visited, and imprecise location (city level), collected only with your consent via our cookie banner

2. How and Why We Use Your Information - Legal Basis

Under the UK GDPR and EU GDPR, we are required to have a lawful basis for processing your personal data. The table below sets out the activities we currently carry out, the data involved, and the specific legal basis we rely on.

Activity / Purpose	Data Categories	Legal Basis (GDPR)	Why This Basis?
Website Security and Navigation	IP address, browser type, device identifiers, essential cookies	Legitimate Interest (Art. 6(1)(f))	Necessary to ensure the website functions securely and to monitor for malicious activity.
Google Analytics	Usage patterns, pages visited, session data, imprecise location (city level)	Consent (Art. 6(1)(a))	Analytics cookies require consent under UK PECR. Data is collected only after you accept cookies via our banner.
Fraud and Abuse Prevention	Login logs, IP history, behavioural identifiers	Legitimate Interest (Art. 6(1)(f))	To protect the integrity of the Sight Acre ecosystem and prevent fraud or abuse.

Where we rely on Legitimate Interest, you have the right to object to that processing at any time by contacting us at [email protected].

3. International Data Transfers

Sight Acre LLC is incorporated in the United States of America. When you use our Services, your personal data may be transferred to and processed in the USA or other countries outside the UK and European Economic Area (EEA).

Where we transfer personal data outside the UK or EEA, we ensure appropriate safeguards are in place. Specifically, we use Standard Contractual Clauses (SCCs) approved by the European Commission to govern transfers to third-country recipients.

We are also evaluating certification under the EU-U.S. Data Privacy Framework (DPF) and will update this notice once that certification is in place. You may request a copy of the safeguards we rely upon by contacting us at [email protected].

We do not sell your personal data. We may share it with:

Service providers who assist us in operating our website, including cloud hosting providers and analytics platforms (Google Analytics)
Professional advisers including lawyers, accountants, and auditors
Regulatory and law enforcement authorities where required by law
Successor entities in the event of a business transfer, merger, or acquisition, in which case we will notify you and ensure your data continues to be protected

All third-party service providers are subject to contractual obligations requiring them to keep your data secure and to process it only on our instructions.

5. Cookies

We use cookies on our website.

Essential cookies are placed on the basis of Legitimate Interest and are strictly necessary for the site to function. Google Analytics cookies are placed only with your Consent, via the cookie consent banner displayed on your first visit. You may update your preferences at any time through the cookie settings on our website.

For full details, please see our Cookie Policy at sightacre.com/legal/cookies.

6. Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected. Our specific retention periods are:

Enquiry and contact data: 3 years from the date of your last interaction with us
Google Analytics data: 13 months from collection, in line with ICO guidance
Security and fraud prevention logs: up to 12 months, unless a specific investigation requires longer retention

Where data is no longer required, it is securely deleted or anonymised.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include encryption in transit (TLS), access controls, and regular security assessments.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify you directly.

8. Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. If this changes, we will update this policy and obtain any necessary consent before introducing such processing.

9. Your Rights

Under the UK GDPR and EU GDPR, you have the following rights regarding your personal data:

Right of Access - to obtain a copy of the personal data we hold about you
Right to Rectification - to request correction of inaccurate or incomplete data
Right to Erasure ("Right to be Forgotten") - to request deletion of your data where there is no compelling reason for its continued processing
Right to Restriction of Processing - to ask us to limit how we use your data in certain circumstances
Right to Data Portability - to receive your data in a structured, machine-readable format
Right to Object - to object to processing based on Legitimate Interest or for direct marketing purposes
Right to Withdraw Consent - where processing is based on consent, to withdraw at any time without affecting the lawfulness of prior processing
Right not to be subject to Automated Decision-Making - as noted in Section 8, we do not engage in such processing

To exercise any of these rights, please use the contact details in Section 13. We will respond within one calendar month. Where a request is complex or we have received a number of requests simultaneously, we may extend this period by a further two months. We will inform you of any extension within the first calendar month and explain the reason for the delay.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe your personal data has been processed unlawfully.

If you are in the United Kingdom: You may contact the Information Commissioner's Office (ICO) at ico.org.uk or by telephone on 0303 123 1113.

If you are in the European Economic Area: You may contact your local data protection authority. A full list is available at edpb.europa.eu.

We would appreciate the opportunity to address your concerns first - please contact us at [email protected] before approaching a supervisory authority.

11. Representative for Data Subjects in the EU and UK

As Sight Acre LLC is located outside the European Union and the United Kingdom, we are required under Article 27 of both the EU GDPR and the UK GDPR to appoint a Representative in each jurisdiction. These are separate obligations - a UK address does not satisfy the EU requirement following the end of the Brexit transition period on 31 December 2020.

11.1 UK Representative

Our UK Representative, appointed in accordance with Article 27 of the UK GDPR, can be contacted at:

Sight Acre UK Representative

5 The Quadrant, Coventry, CV1 2EL, United Kingdom

Email: [email protected]

11.2 EU Representative

As a US-based Data Controller processing the personal data of individuals in the European Economic Area (EEA), Sight Acre LLC is required under Article 27 of the EU GDPR to appoint a Representative established within an EU Member State. This is a separate and distinct requirement from the UK GDPR obligation above - a UK address does not satisfy it.

Action required: A formal EU Representative has not yet been appointed. Sight Acre LLC should engage a specialist Article 27 representative service provider based in an EU Member State (for example, Ireland, the Netherlands, or another jurisdiction where data subjects are most likely located). Established providers include DataRep, GDPR Local, and Bird & Bird. Once appointed, the representative's name, physical EU address, and contact details must be listed here. Failure to appoint an EU Representative carries a maximum penalty of EUR 10 million or 2% of global annual turnover under Article 83 of the EU GDPR. This should be treated as a priority compliance action.

If you are in the UK and wish to exercise your data rights or raise a concern, please contact our UK Representative at the address in Section 11.1. Please mark correspondence "GDPR Representative Inquiry".

12. Updates to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you through a notice on our website.

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a concern about our data practices, please contact:

Data Protection Team - Sight Acre LLC