Privacy Policy & Explicit Consent Notice

1. Who Is Responsible for Your Data (Data Controller)

The data controller responsible for personal data processed on Sovereign Right Network (sovereignrightnetwork.org) is Sovereign Chain Ltd, a private limited company registered in England and Wales, operating from Luton, United Kingdom.

For all privacy enquiries, subject access requests, consent withdrawals, or account deletion requests, please contact our Data Protection Desk at: privacy@sovereignrightnetwork.org.

2. Special Category Data — Political Opinions (UK GDPR Article 9(2)(a))

Sovereign Right Network is a voluntary directory connecting business owners, sole traders, corporations, and independent professionals who publicly align with conservative and right-wing economic and civic principles. Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, information revealing an identifiable individual's political opinions constitutes special category personal data.

We only publish an identifiable member's profile as right-aligned where the member has provided explicit, freely given, specific, and informed consent pursuant to Article 9(2)(a) UK GDPR (and Article 6(1)(a) UK GDPR) by actively ticking an unchecked-by-default consent box during registration on /join. We record the exact date and timestamp (UTC) of that explicit consent.

3. What Personal Data We Collect

• Account Registration Data: full name, email address, password stored strictly as a salted cryptographic hash (scrypt), country, optional WhatsApp contact number, referral code, and the date and timestamp of your Values Charter and public listing consent.
• Public Business Listing Data: business or professional name, category, city/municipality (we deliberately restrict location fields to city level to protect residential privacy), headline, description, specialties, optional allied discount offer, and optional public contact channels (website, public email, WhatsApp, phone, social media profiles).
• Optional Verification Reference (Admin-Only): corporate registry number (e.g. Companies House number, EIN, tax or professional registration reference) voluntarily supplied to apply for the Verified Right Member badge. This reference is visible only to authorised governance administrators and is not displayed publicly.
• Client Quote Enquiries & Verified Reviews: when a visitor submits a quote request to a listed business, we collect the sender's name, email, optional WhatsApp, message, and issue a one-time cryptographic review code (SRN-XXXX-XXXX) to prevent fabricated reviews and ideological brigading.
• Technical & Security Data: an HTTP-only session cookie (srn_session) for signed-in members, a language preference cookie/localStorage key (srn_lang), and a salted SHA-256 hash of the request IP address for rate-limiting and anti-abuse audit logs (raw IP addresses are not stored in plaintext in our database).

4. Why We Process Your Data & Lawful Bases

• Public Directory Publication: publishing and indexing your business profile and community posts so prospective customers and B2B partners can discover and contact you — lawful basis: Explicit Consent (Art. 6(1)(a) & Art. 9(2)(a) UK GDPR).
• Account & Portal Operation: authenticating member sign-in, delivering quote enquiries to business owners, and managing optional paid featured placements or services — lawful basis: Contractual Necessity (Art. 6(1)(b) UK GDPR).
• Platform Security & Anti-Fraud Moderation: rate-limiting login/registration endpoints, preventing review sabotage, and investigating reports of unlawful content or commercial fraud — lawful basis: Legitimate Interests (Art. 6(1)(f) UK GDPR).

5. How Long We Keep Your Data (Retention Periods)

• Active Accounts & Directory Profiles: retained for as long as your account remains active, or until you withdraw consent or request deletion.
• Authentication Sessions: expire automatically after 30 days (or immediately upon signing out).
• Quote Enquiries, Moderation Reports & Security Audit Logs: retained for up to 24 months to maintain anti-brigading review verification and audit accountability, unless earlier erasure is requested and no overriding legal obligation applies.

6. Your Rights — Including Withdrawal of Consent & Account Deletion

Under the UK GDPR (and EU GDPR / Brazilian LGPD where applicable), you have the right to:

• Withdraw your consent at any time (Art. 7(3) UK GDPR) and have your profile unpublished;
• Request complete deletion (erasure) of your account, business profile, and personal data (Art. 17 UK GDPR);
• Access, rectify, or export a copy of the personal data we hold about you.

To request deletion or exercise any of these rights, email privacy@sovereignrightnetwork.org from your registered email address. Sovereign Chain Ltd will process and confirm erasure requests without undue delay and within 30 calendar days. You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO) at ico.org.uk.

7. Infrastructure & Data Sharing

We do not sell personal data to third-party data brokers. Personal data is processed solely through trusted infrastructure providers necessary to host the web application and PostgreSQL database under strict confidentiality and security controls. Information you choose to place in public directory fields is publicly accessible on the internet for the duration of your active listing.