Data Partner Requirements

Each Data Partner must:

• comply with every law that applies to the collection, use and sharing of the data it supplies, including privacy, data protection, consumer protection, telecommunications, export control and sanctions laws, in every country where the data is collected and where the Data Partner operates;
• have, and be able to show, a lawful basis for collecting the data and for disclosing it to Equatorium for the purposes in Section 2;
• impose equivalent obligations on every upstream source from which it obtains the data (for example mobile app publishers, software development kit providers and other suppliers) and monitor their compliance; and
• comply with Equatorium’s Responsible Use & Platform Enforcement Policy as it applies to suppliers.

Equatorium uses supplied data to detect, locate and classify satellite terminals, to provide those findings to government licensing authorities, regulators and other public-sector customers for spectrum management and licensing enforcement, to release identity-linked data to those customers only through its Disclosure Policy, to keep its service secure and to improve its service. The Data Partner must ensure that its notices and consents, and those of its sources, cover these purposes.

• The Data Partner, and each app or other source from which it obtains data, must keep a clearly labelled, easy-to-find privacy policy that explains the collection of device identifiers, IP addresses, precise location, Wi-Fi information and other device data, and the sharing of that data with third parties.
• That privacy policy must name, or clearly describe, disclosure to companies that provide services to government and public-sector customers, including for spectrum licensing enforcement. Disclosure only “for advertising” or “for analytics” is not enough.
• The Data Partner’s own privacy policy must name Equatorium as a recipient. Sample language:

“We share device and location data with Equatorium, which provides satellite terminal detection services to government licensing authorities. Learn more: equatorium.com/legal#privacy-policy”

• Notices must be available before collection, in the languages of the users concerned, and must be kept up to date. On request, the Data Partner must give Equatorium copies of the notices that applied when particular data was collected.
• Equatorium will not onboard a Data Partner, or a new source of a Data Partner, whose sample notices do not meet this Section 3.

• Where law requires consent for the collection of precise location, the access to device storage, or the disclosure of data to Equatorium, the Data Partner (or its source) must obtain a valid, specific, informed and freely given consent that covers the purposes in Section 2, before the data is collected or shared.
• Operating-system permissions (for example the location permission on iOS or Android) must be obtained in the way the platform requires, and the purpose string shown to users must not be misleading.
• The Data Partner must pass to Equatorium, with each record, the consent information received with it, and must not alter it.
• On request, the Data Partner must give Equatorium evidence of consent, including the date and the consent language shown to the user.
• Data collected where consent was refused, withdrawn or not obtained when required must not be supplied.

• The Data Partner must honour every privacy choice made known to it, including device settings that limit ad tracking or reset or zero the advertising ID, App Tracking Transparency choices, Global Privacy Control and other legally recognised opt-out preference signals, and opt-outs of sale, sharing or targeted advertising.
• Records from devices that have opted out must be removed before supply, and must not be supplied again after the opt-out.
• The Data Partner must keep a mechanism for individuals to exercise their rights (access, deletion, opt-out and others) and must pass deletion and opt-out signals concerning supplied data to Equatorium within five (5) business days, in the format Equatorium specifies, so that Equatorium can stop using data about the device.
• The Data Partner must cooperate with Equatorium to respond to requests and complaints from individuals and regulators about supplied data.

• The Data Partner must not supply data about any person under 16, or any higher age at which a person is treated as a child under applicable law.
• The Data Partner must not supply data collected through any app, website or service that is designed for or directed to children, or that falls under the U.S. Children’s Online Privacy Protection Act or similar laws, or from any device flagged as belonging to a child (for example through app store age signals or child-directed treatment flags).
• If the Data Partner learns that it has supplied such data, it must tell Equatorium promptly so that the data can be deleted.

The Data Partner must not supply:

• names, postal addresses, phone numbers, government ID numbers, unhashed email addresses or payment data;
• health information, protected health information, or any data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation;
• the contents of communications, browsing history or app usage beyond the fields listed in the Data Agreement;
• location records at or near sensitive locations, including medical and reproductive health facilities, places of worship, shelters for domestic violence or homeless people, refugee and migrant facilities, addiction and mental health facilities, schools and childcare facilities, correctional facilities, union offices, and military installations; and
• any data the Data Partner does not have the right to supply, or that was collected by deception, malware or any method that breaches a platform’s terms.

If prohibited data is supplied by mistake, the Data Partner must tell Equatorium and help it delete the data.

The Data Partner must remove sensitive-location records before supply.

• The Data Partner must not be, or be owned or controlled by, a person subject to sanctions administered by the United States, the United Nations, the European Union or the United Kingdom, or a “covered person” under 28 CFR Part 202.
• The Data Partner must not supply data in a way that would make the supply, or Equatorium’s use, a prohibited or restricted “data transaction” under 28 CFR Part 202, the U.S. Protecting Americans’ Data from Foreign Adversaries Act, or similar laws.
• The Data Partner must tell Equatorium which countries its data covers, and must meet the data localisation and cross-border transfer rules of each country where the data is collected.

• Data must be accurate to the best of the Data Partner’s knowledge, delivered in the agreed schema, and must not be fabricated, synthetic or padded unless clearly labelled.
• Each record must carry the fields needed to trace it, such as the collection timestamp, the source category and the consent signal.
• The Data Partner must keep records of its sources, the notices and consents that applied, and the opt-outs it has honoured, for at least as long as Equatorium holds the data, and give them to Equatorium on request.
• The Data Partner must tell Equatorium promptly about any change in its sources, collection methods or legal position that could affect the lawfulness of data already supplied.

• The Data Partner must protect the data with appropriate technical, physical and organisational measures, including encryption in transit and at rest, access controls and logging, and must use only the delivery channels Equatorium approves.
• The Data Partner must tell Equatorium without undue delay, and in any event within seventy-two (72) hours after becoming aware of a breach affecting supplied data or the systems used to supply it, and must cooperate in the response.
• The Data Partner must carry cyber and privacy liability insurance with limits of at least USD 1,000,000 per claim and provide a certificate on request.

Equatorium reviews each Data Partner before onboarding and periodically after that. On reasonable notice, the Data Partner must answer Equatorium’s due-diligence questionnaires, provide samples of notices and consent flows from its sources, and allow Equatorium, or an independent auditor bound by confidentiality, to verify compliance with these Requirements. The Data Partner pays for an audit that reveals a material breach; otherwise each party bears its own costs. Equatorium may stop accepting data from a Data Partner while a concern is investigated.

Each year, the Data Partner must certify in writing that it complies with Sections 3 to 8 and list the countries from which its data originates.

• If a Data Partner breaches these Requirements, Equatorium may stop accepting its data, quarantine or delete data already received, withhold or adjust payments, and terminate the Data Agreement.
• When the Data Agreement ends, Equatorium will stop accepting the Data Partner’s data. Data already received will be kept or deleted as set out in the Data Agreement and Equatorium’s Retention Schedule; data that the Data Partner tells Equatorium was supplied unlawfully will be deleted.
• The Data Partner will defend, indemnify and hold harmless Equatorium from claims, regulatory investigations, fines, deletion costs and reasonable legal fees arising from (a) data supplied without the notices, consents or rights these Requirements call for, or (b) breach of Sections 3 to 8. No limitation of liability in the Data Agreement applies to this obligation.
• Sections 5, 7, 8, 9 and 12 survive the end of the Data Agreement for as long as Equatorium holds data the Data Partner supplied.

Equatorium may update these Requirements to reflect changes in law, regulator guidance or its service, and will give Data Partners at least thirty (30) days’ notice of material changes. Questions should be sent to [email protected]. The current list of Data Partners is available on request from [email protected], as described in Sub-processors & Data Partners.