Privacy Policy

Last Updated: 14 October 2026

1. Introduction

SAR Portal (“we”, “us”, or “our”) operates the SAR Portal platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Company Details:

  • Legal Name: Sekhon IT Consultants Ltd. (trading as SAR Portal)
  • Company Registration: Ireland
  • Registered Address: 1 Beaufield Crescent, Maynooth, Co. Kildare, Republic of Ireland
  • Email: info@sarportal.com
  • Data Protection Officer: dpo@sarportal.com
  • Lead Supervisory Authority: Data Protection Commission (Ireland) - dataprotection.ie

2. Information We Collect

2.1 Information You Provide

  • Account Information: Name, email address, company name, phone number
  • Billing Information: Processed securely through Stripe (we do not store full payment card details)
  • Case Data: Information you upload related to DSAR cases you manage
  • Communications: Messages you send to our support team

2.2 Information Collected Automatically

  • Usage Data: IP address, browser type, pages visited, time spent
  • Cookies: Authentication tokens and, with your consent, analytics and advertising (see Section 11)
  • Security Logs: Login attempts, API access, rate limiting events

3. How We Use Your Information

We process personal data only for the following purposes:

  • Service Delivery: Provide, maintain, and improve SAR Portal
  • Authentication: Secure access via Azure Entra External ID
  • Billing: Process subscriptions and send invoices
  • Communication: Send service updates, security alerts, and support responses
  • Legal Compliance: Comply with GDPR and other data protection laws
  • AI Features: Provide risk assessment and text assistance (all processing is confidential and not used for training)
  • Security: Detect fraud, prevent abuse, and protect our systems

We process your personal data under the following legal bases:

Data Type Legal Basis Purpose
Account Information Contract Performance Providing the SAR Portal service
Billing Information Contract Performance Processing payments and invoices
Case Data Contract Performance Enabling DSAR management features
Marketing Communications Consent Sending newsletters and promotional content
Contact Form Submissions Legitimate Interests / Contract Responding to inquiries, demos, and sales requests
Usage Analytics (Google Analytics) Consent Improving our service and user experience
Advertising measurement (Google Ads) Consent Which ads lead to demo requests or sign-ups
Security Logs Legitimate Interests Protecting our systems and detecting fraud
Audit Logs Legitimate interests (defending legal claims) Showing how requests were handled

You may withdraw consent at any time for consent-based processing. For legitimate interests, you have the right to object (see Section 8).

5. Data Sharing and Disclosure

We do not sell your personal data. We share data only with:

5.1 Service Providers

  • Microsoft Azure Entra External ID: Authentication and identity management
  • Azure Cosmos DB: Database storage (AES-256 encryption at rest, West Europe, Netherlands)
  • Azure Blob Storage: Document storage (AES-256 encryption at rest, West Europe, Netherlands, with a second copy of documents in North Europe, Ireland)
  • Azure OpenAI Service: AI-powered features including personal data detection, risk assessment and text assistance (your data is not used for model training; Azure Sweden Central)
  • Azure AI Document Intelligence: Text extraction from documents and scanned pages for redaction analysis (Azure Sweden Central)
  • Azure AI Language Service: PII detection and entity recognition (Azure Sweden Central)
  • Stripe (Stripe Payments Europe, Ireland): Billing and payments. Stripe may process billing data in the US under the EU-US Data Privacy Framework and SCCs. We never see or store full card numbers.
  • Twilio SendGrid: Transactional email delivery (EU processing)
  • Google reCAPTCHA Enterprise: Bot protection and spam prevention
  • Microsoft Graph API: User invitation and management (your users’ names and emails)
  • HubSpot: Business customer relationship management, hosted in HubSpot’s EU data region (Frankfurt). Used for our own sales, marketing and customer relationship management. If you contact us through this website or request a demo, your name, business contact details and message are recorded there. No case data, uploaded documents or data subject records are ever stored in HubSpot — it is entirely separate from the SAR Portal platform.

We may disclose data when required by law, court order, or to protect our legal rights.

6. International Data Transfers

Case data and documents are stored in Microsoft Azure West Europe (Netherlands), with a second copy of documents in North Europe (Ireland). AI processing runs in Azure Sweden Central. A few supporting services work outside the EU under Standard Contractual Clauses or the EU-US Data Privacy Framework: Microsoft Graph (your users’ names and emails, for invitations), Google reCAPTCHA (browser signals from people using your request forms) and Stripe (billing). None of them receive case content or documents.

6.1 Third Country Transfers

Any transfers outside the EU/EEA are protected by:

  • Standard Contractual Clauses (SCCs): European Commission’s 2021 SCCs for third country transfers
  • Named EU regions: our Azure services run in West Europe (Netherlands) and North Europe (Ireland), and our AI runs in Azure Sweden Central on regional deployments
  • Adequacy Decisions: Transfers to countries with EU adequacy decisions (e.g., UK, Switzerland) rely on those decisions

6.2 UK Data Transfers

For services with UK-based processing, transfers are protected by the UK adequacy decision, renewed by the European Commission in December 2025. Case data and documents are stored, and AI processing runs, in the Azure regions listed above.

6.3 Sub-Processor Locations

Sub-Processor Purpose Processing Location Transfer Mechanism
Microsoft Azure Hosting, database, storage, AI EU: West Europe (Netherlands); second copy of documents in North Europe (Ireland); AI in Sweden Central N/A — EU only
Microsoft Graph Sending invitations to your users (name and email) Global Microsoft SCCs / EU-US DPF
Stripe Billing and payments EU (Ireland); may process billing data in the US EU-US DPF / SCCs
Twilio SendGrid Email delivery EU (configured) SCCs where applicable
Google reCAPTCHA Enterprise Bot protection Global Enterprise DPA / SCCs
HubSpot Business CRM — website enquiries and sales contacts only (no case data) EU (Frankfurt) N/A — EU only

7. Data Retention

  • Active Accounts: Data retained while subscription is active
  • Cancelled Accounts: Data available for export for 90 days. After 90 days, all tenant data (cases, documents, users, settings) is permanently deleted. You will receive a reminder email 10 days before deletion.
  • Audit Logs: Retained per our documented retention policy (default 7 years), based on our legitimate interest in defending potential legal claims within the applicable limitation period. This period is documented and no longer than necessary.
  • Billing Records: Retained for at least 6 years, in line with Irish tax record-keeping requirements
  • Contact Form Inquiries and Demo Requests: Kept for up to 24 months after our last contact with you, then deleted, unless you become a customer. If you become a customer, we keep them with your account records while you are a customer and for up to 6 years after the contract ends, so we can deal with any legal claims (the limitation period for contract claims under Irish law). You can ask us to delete them sooner at any time: dpo@sarportal.com
  • Marketing Data: When you unsubscribe we stop marketing to you straight away and keep only your email address on a suppression list so we do not contact you again.

8. Your Rights Under GDPR

As an EU data subject, you have the following rights:

  • Right to Access: Request a copy of your personal data
  • Right to Rectification: Correct inaccurate data
  • Right to Erasure: Request deletion of your data
  • Right to Restriction: Limit how we process your data
  • Right to Data Portability: Receive your data in machine-readable format
  • Right to Object: Object to processing based on legitimate interests
  • Right to Withdraw Consent: Withdraw consent at any time
  • Right to Lodge a Complaint: Complain to your local Data Protection Authority

To exercise your rights, contact: dpo@sarportal.com

9. Security Measures

We implement technical and organisational security measures including:

  • Encryption in transit (TLS 1.2+) and at rest (AES-256)
  • Sign-in via Azure Entra External ID: a Microsoft or Google account, or a one-time code sent to your email
  • Role-based access control (RBAC) with four defined roles
  • Secrets management via Azure Key Vault
  • Security headers (CSP, HSTS, and others)
  • Rate limiting on all public endpoints
  • Every change is built and tested automatically and is deployed to Dev and UAT before a manually approved Production release; we check for vulnerable packages at every release and at least monthly
  • We mask personal data (emails, phone numbers, names, financial data) before it is written to our application logs

For full details of our security controls, see our Security page.

10. AI and Automated Decision-Making

SAR Portal uses AI for:

  • Risk Scoring: Automated case risk assessment
  • Text Assistance: Suggestions for text improvement
  • Contextual Workflow Guidance: System-specific next-step recommendations based on your configured business systems (e.g., “Search Zendesk for this email”)
  • PDF Text Extraction: Automated text extraction from PDF documents using Azure Document Intelligence
  • Configurable PII Detection: Automated detection of personal data in documents based on your tenant-specific configuration (standard PII types, custom patterns, keyword lists) to assist with GDPR Article 15(4) compliance

10.1 Systems Configuration Data

You can configure which business systems your organization uses (e.g., CRM, email platforms, support systems). This configuration data is used solely to provide system-specific AI guidance tailored to your environment. This data includes:

  • System types and names (e.g., “Salesforce CRM”, “Zendesk Support”)
  • Optional system notes and data types stored
  • Business context description

This configuration data is stored securely in your tenant’s isolated database partition and is never shared with other tenants or used for any purpose other than generating contextual guidance for your organization.

10.2 PII Detection Configuration

You can customize PII detection settings including which data types to detect (names, emails, IBAN, etc.), custom regex patterns for business-specific identifiers, and keyword allow/deny lists. These settings control how AI analyzes documents but do not affect the underlying AI models.

Important: All AI-generated outputs are advisory only. AI suggests what to redact. In the upload flow you review the suggestions and choose what to redact before anything is applied. AI can miss personal data or redact too much, so always check the result before you release it. Detected items start selected, including the requester’s own details: use “Deselect Subject Data” to keep the requester’s own information in their copy. In bulk archive processing (Enterprise), suggested redactions are applied automatically and you review the results. Nothing reaches a data subject unless one of your users releases it. No solely automated decision with legal effect is made.

Data Processing: When you upload files, Azure Document Intelligence extracts the text (including scanned pages), and Azure AI Language and Azure OpenAI find personal data in it. All three run in Microsoft’s Sweden Central region, under Microsoft’s Data Processing Agreement. Your files are not used to train any AI model. Document Intelligence deletes the document and results automatically 24 hours after analysis, and Azure AI Language does not store the text. Microsoft’s abuse monitoring for Azure OpenAI may store prompts and responses that its systems flag, in the EU, for review by authorised Microsoft staff in the EEA.

11. Cookies and Tracking

We use cookies and similar technologies to operate our service. For full details, see our Cookie Policy.

11.1 Types of Cookies

Cookie Type Purpose Consent Required
Essential Cookies Authentication, security, session management No (strictly necessary)
Functional Storage Remember your cookie choices and light/dark theme (browser local storage) No (strictly necessary)
Analytics Cookies Understand usage patterns via Google Analytics Yes
Advertising Cookies Measure which Google Ads lead to demo requests or sign-ups Yes

When you first visit our website, you will see a cookie consent banner. You can:

  • Accept All: Enable analytics and advertising cookies
  • Essential Only: Only strictly necessary cookies (no analytics, no advertising)
  • Manage Preferences: Turn analytics and advertising on or off separately

You can change your cookie preferences at any time via the cookie settings link in the footer.

11.3 Google Analytics

We use Google Analytics 4 to understand how visitors use our website. Google Analytics collects:

  • Pages visited and time spent
  • Device and browser information
  • Geographic region (country/city level)
  • Referral sources

Google Analytics uses cookies that expire after 2 years. Data is processed in accordance with Google’s privacy policy. IP addresses are anonymized before storage. You can opt out using the Google Analytics Opt-out Browser Add-on.

11.4 Google Ads

If you switch on advertising cookies, we use Google Ads conversion tracking to see whether a visit from one of our ads led to a demo request or a free-trial sign-up. If you leave advertising cookies off, the Google Ads tag does not load. See our Cookie Policy for the cookies it sets.

12. Children’s Privacy

SAR Portal is not intended for individuals under 16 years of age. We do not knowingly collect data from children.

13. Changes to This Privacy Policy

We may update this policy from time to time. We will notify you of material changes via email or in-app notification. Continued use after changes constitutes acceptance.

14. Contact Us

For privacy-related questions or to exercise your rights:

15. Supervisory Authority

You have the right to lodge a complaint with your local EU Data Protection Authority. A list of EU supervisory authorities is available at edpb.europa.eu.