1. Introduction
This Privacy Policy explains how Antelope Data Campus, LLC handles personal data in the course of running a prairie data camp in Salt Lake City, Utah. The policy describes the categories of information we collect, the reasons we collect it, the people and organisations with whom we share it, the length of time we keep it and the choices available to any person whose data passes through our campus. Antelope Data, the developer name used for the software and systems work behind the campus platform, maintains the technical controls described in this policy, and this document is meant to be read as a single statement covering both the commercial campus operation and the engineering practice that supports it.
We believe a privacy policy should be readable rather than mysterious. A reader should be able to finish this page and understand what happens to a name, an email address, a phone number or a request that arrives at our desk. Where a practice is unusual, we explain it in ordinary language. Where a practice is routine, we say so plainly rather than hiding it behind broad language. If anything here is unclear, the contact details at the end of the policy reach a person who can answer questions directly.
The campus serves clients who operate sensor fleets, telemetry networks, research stations, industrial monitoring and edge hardware. Much of our work involves technical data rather than personal data. We nonetheless take seriously the fact that some of that technical data can identify a person, for example when a site operator logs a calibration visit or when a message from a client contains a name and an email address. This policy covers that personal layer thoroughly and separates it from the client data we hold under contract.
This policy applies to visitors of our website, prospective clients who contact the campus, client personnel who work with our crew, suppliers and partners who provide goods or services, and other individuals who interact with us in the course of a season of work. It does not apply to third party websites that we link to, because those organisations publish their own privacy notices and we cannot speak for them.
2. Scope of This Policy
This policy covers personal data processed through our website, our email correspondence, our telephone line, our contact form and the administrative systems used by the campus desk. It also covers personal data that appears inside client engagements, such as the name of a technician who performed a calibration, the signature of a person who approved a scope, or the contact details of a client employee who receives certification records.
The policy does not govern the raw sensor readings, machine telemetry, dataset slices or node environment logs that we handle on behalf of a client. Those materials are processed under a written service agreement that sets out the roles of the parties, the permitted purposes and the security commitments that apply. Client data remains under the direction of the client, and questions about that data should be directed first to the client and then to our desk if a technical clarification is needed.
This policy also does not cover employment records, contractor tax records or payroll data, which are handled under separate internal notices provided to the individuals concerned. Candidates who apply for a role at the campus receive a recruitment notice at the point of application, and this general policy should not be read as a replacement for that notice.
3. Who We Are
The entity responsible for the processing described in this policy is Antelope Data Campus, LLC, a limited liability company registered in the United States. The company operates a computer systems design and integrated systems campus in Salt Lake City and provides telemetry audits, dataset certification, edge node housing, sensor calibration, data lineage reviews and campus tours to clients across several sectors.
The campus desk is the normal point of contact for privacy questions. The desk is staffed by people who work alongside the engineering crew, which means a question about a record or a request is handled by someone who understands the underlying workflow rather than a detached call centre.
201 S Main St Ste 2025
Salt Lake City - 84111-2268
United States (US)
Email messages on privacy matters should be sent to certify@antelopedata.buzz. Telephone inquiries can be made on +19862880713 during the business hours published on our contact page. Written correspondence is welcome at the postal address above, and we recommend a trackable method when a request has a deadline attached.
4. Information We Collect
We collect information in three broad groups: contact information, engagement information and technical information. Each group is limited to what a campus needs in order to reply to a person, deliver a service and keep an accurate record of the work.
Contact information
Contact information includes a name, an email address, a telephone number, a job title, an organisation name and a postal address where a client asks us to send printed certificates or node histories. A prospective client who writes through the contact form will normally provide a name, an email address, a subject selection and a message, and those four fields form the core of the contact record.
Engagement information
Engagement information includes the scope of a project, the names of client personnel involved, the dates of audit sprints, calibration days and certification runs, the names of signers on certification records and the correspondence that accompanies those records. This group also includes billing details such as an invoice reference and a billing contact, though full payment card numbers are handled by a payment processor and are not stored in our systems.
Technical information
Technical information includes the internet protocol address from which a website visitor connects, the browser type and version, the operating system, the referring page and the time of a visit. Where a visitor sends a message through the contact form, the technical record may include the time the form was submitted and the mail client that opened the draft. We do not build advertising profiles and we do not combine website technical data with engagement records for marketing purposes.
5. How We Collect Information
We collect information directly from individuals, from client organisations acting on behalf of their personnel, and automatically through ordinary website operation.
Direct collection happens when a person writes to the campus desk, calls the telephone line, submits the contact form, visits for a tour session or signs a scope of work. In those moments the person chooses what to share, and the desk records only what is needed to respond or to open a file. Direct collection also happens during a calibration day when a technician is named on a score sheet, and during a certification run when a signer is recorded on the certificate.
Collection through a client organisation happens when a client provides a list of people who should receive certification records, a roster of technicians who will attend a calibration, or a billing contact for an invoice. In those cases the client is responsible for having a lawful basis to share the information with us, and we use it only for the purpose it was shared.
Automatic collection happens when a browser requests a page from our website. The web server records the request in a routine log that supports security monitoring and fault diagnosis. These logs are short lived and are not used to identify visitors for commercial purposes. If a visitor uses an email link on the website, the visitor is transferred to the email program on the visitor device, and that program follows its own privacy settings.
6. Why We Process Personal Data
We process personal data for a small number of connected reasons, and each reason maps to a task that a reader would recognise.
We process contact information to reply to inquiries, to prepare a scope of work and to schedule a run window on the cohort calendar. We process engagement information to deliver the service that has been agreed, to record who did what on which day, and to produce a certification record that can be defended in front of an outside reviewer. We process billing details to issue invoices and to keep accounting records as required by law. We process technical information to keep the website available, to detect abusive traffic and to diagnose a fault when a page fails to load.
We also process information to meet legal and regulatory obligations, for example tax and accounting requirements and obligations that arise when a party requests a record under a valid legal process. We process information to protect the campus, its crew and its clients, for example by investigating a security incident or by responding to a credible threat. Finally, we process a limited amount of information to improve our services, such as reviewing a support conversation to see where a written scope could be clearer, but we do so in a way that respects the expectations set in this policy.
7. Legal Bases for Processing
Where data protection law requires a legal basis for processing, we rely on one or more of the following bases, depending on the context.
Contractual necessity applies when processing is needed to enter into or perform an agreement, for example scheduling an audit sprint or issuing a certification record under a signed scope. Legitimate interests apply when processing supports a reasonable business purpose that does not override the rights of the individual, for example replying to a business inquiry, keeping the website secure or protecting the campus from fraud. Compliance with a legal obligation applies when we must keep records for tax, accounting or regulatory reasons, or when we must respond to a lawful request.
Consent applies where we ask for it specifically, such as when a person opts in to receive occasional campus notes about cohort dates. Consent can be withdrawn at any time, and withdrawal does not affect processing that happened before the withdrawal. Where a person has not given consent and no other basis applies, we will not send marketing messages.
Vital interests and public interest may apply in rare circumstances, for example where a safety incident requires immediate action. We treat those bases as exceptional and document the reasoning whenever they are used.
9. Client Telemetry and Sensor Data
The campus handles large volumes of client data, most of which is not personal. Sensor readings, node temperature logs, dataset slices and certification panel results are technical materials that a client entrusts to us under a service agreement. We process those materials only to perform the agreed work: auditing a stream, certifying a dataset, housing a node, calibrating a probe, reviewing a lineage or preparing a tour walkthrough.
Some client materials contain a personal element, for example the name of a technician on a calibration score sheet or the signature of an approver on a certification record. We treat that element with the same care as the rest of the record. We do not sell client data, we do not use it to train models for another client and we do not disclose it to a third party except as described in the sharing section of this policy or as the service agreement directs.
Where a client is the controller of personal data inside its own dataset, we act as a processor and follow the client directions set out in the agreement. A person who wants access to, or correction of, data held inside a client dataset should contact that client first. If a request reaches us directly, we will forward it to the client and support the client response with the technical information we hold.
11. Data Retention
We keep personal data only for as long as a reason exists to keep it, and we review retention on a regular cycle rather than leaving files to accumulate indefinitely.
Contact inquiries that do not become an engagement are retained for a modest period so that the desk can follow up and so that a reader can find a prior conversation when writing again. Records that become part of an engagement are retained for the life of the client relationship and for a further period that allows us to answer a question about a certification record, defend a decision or meet a contractual obligation. Accounting and tax records are retained for the period required by applicable law.
Website server logs are retained for a short period and are then deleted or aggregated. Certification records are kept for the length of the retention period agreed in the service contract, because a certificate is meant to travel with a dataset for the life of the dataset. When a retention period ends, we delete the information or render it permanently unreadable, and we ask service providers to do the same for copies they hold on our behalf.
12. Security of Personal Data
We protect personal data with a combination of technical controls, organisational practices and physical measures suited to a working campus.
Technical controls include encryption of data in transit, access control that limits each system to the people who need it, and logging that records access to sensitive records. Administrative systems are separated from client processing systems so that a routine office task cannot reach a dataset slice. Credentials are managed individually, and administrative access is reviewed when a person joins or leaves the crew.
Organisational practices include written procedures for handling a request, a documented process for signing a certification record and periodic review of who holds access to which system. The crew is small by design, and each member understands the part of the workflow that they touch. Physical measures include controlled entry to the node rooms and calibration bench, visitor logging and a policy that printed records are stored in a locked cabinet when not in use.
No system is perfectly secure. If we become aware of a breach that affects personal data, we will act promptly to contain it, assess the risk and notify affected individuals and authorities where the law requires. The breach response section of this policy describes the process in more detail.
13. International Data Transfers
Our campus is in the United States, and much of our processing happens there. Some service providers operate infrastructure in the United States or in the European Economic Area, the United Kingdom or another jurisdiction, depending on the provider and the service.
Where personal data moves from a jurisdiction with transfer restrictions to another jurisdiction, we use an appropriate transfer mechanism. Examples include standard contractual clauses approved by the relevant authority, an adequacy decision that covers the destination, or a specific derogation that applies to the situation. We take reasonable steps to confirm that a recipient is bound by confidentiality obligations and by security commitments appropriate to the information transferred.
A client or an individual who wants to know the transfer mechanism that applies to a specific engagement can ask the campus desk, and the desk will describe the mechanism in writing. Where a transfer raises an unusual risk, we will discuss the options before any data moves rather than after.
14. Your Privacy Rights
Depending on where a person lives, privacy law may grant a set of rights over personal data. We honour those rights for every person who asks, regardless of where we are located, because a clear process is better than a geography puzzle.
The right of access allows a person to ask whether we hold personal data about them and to receive a copy of it together with information about how it is used. The right to correction allows a person to ask us to fix an error, such as a misspelled name or an outdated telephone number. The right to deletion allows a person to ask us to remove personal data where no legal reason requires us to keep it. The right to restriction allows a person to ask us to pause processing while a question is resolved.
The right to object allows a person to object to processing based on legitimate interests, and we will stop that processing unless we can show compelling grounds that override the objection. The right to data portability allows a person to receive data they provided to us in a structured and commonly used format. The right to withdraw consent allows a person to withdraw consent for a marketing message at any time without affecting the lawfulness of earlier processing.
The right to non discrimination means that a person who exercises a right will not be denied a service, charged a different price or treated worse by the campus as a result. The right to complain means that a person can raise a concern with us and, if the concern is not resolved, with the privacy regulator in their jurisdiction.
15. How to Exercise Your Rights
A request can be sent by email to certify@antelopedata.buzz or by post to Antelope Data Campus, LLC, 201 S Main St Ste 2025, Salt Lake City - 84111-2268, United States (US). The message should name the right being exercised and should describe the information concerned so that the desk can locate it.
We may ask for information that helps us confirm identity before acting on a request. We will ask for the minimum needed and will not request copies of identity documents unless the law requires it or a serious doubt about identity cannot otherwise be resolved. Once identity is confirmed, we will respond within the period set by applicable law, and we will tell the requester if an extension is needed and why.
If a request concerns data held inside a client dataset, we will forward the request to the client as described in the client telemetry section. We will support the client response with the technical information we hold. Requests that concern a service provider acting for us will be pursued with the provider so that the requester receives one coherent answer.
There is no fee for a request in ordinary circumstances. If a request is manifestly unfounded or excessive, we may explain why and, where the law allows, charge a reasonable fee or decline the request. We will record the reason for any refusal and inform the requester of the avenues available for challenge.
16. Privacy for Children
Our services are designed for organisations and their personnel. The campus is not directed at children, and we do not knowingly collect personal data from a child through the website or through the contact form.
A campus tour session is occasionally attended by a student group as part of an education partnership. In that case the school or the organising group remains responsible for consent from a parent or guardian, and our crew collects only the first name and the group name needed for visitor logging. Those records are deleted at the end of the visit and are not added to any mailing list.
If we learn that we have collected personal data from a child without the required consent, we will delete it promptly. A parent or guardian who believes that a child has provided data to the campus can write to the desk and we will investigate and respond.
17. Marketing and Communications
We send very little marketing. The campus desk may send an occasional note about cohort dates, a new service or a change to the run calendar, and only to people who have asked to receive such notes.
Transactional messages are different. A message that confirms a scheduled sprint, a calibration day or an issued certificate is part of the service rather than marketing, and we will send it to the people a client has nominated for that purpose even if they have not opted in to promotional mail. Those messages contain the information needed to do the work and nothing more.
Every marketing message includes a way to stop receiving further messages, and the stop request is honoured promptly. A person can also write to the desk at any time to ask that the address be removed from all lists. We do not share a mailing list with another organisation and we do not sell an address to a data broker.
18. Third Party Sites and Services
Our website may link to an external site, such as a partner organisation or a standards body. Those links are provided for convenience, and the external site has its own privacy notice that governs what it does with a visitor information. We do not control that site and we cannot describe its practices.
Some pages may embed a map or a document viewer supplied by a third party. Where an embed is used, the provider may receive technical information such as the internet protocol address of the visitor. We choose providers with care and keep embeds to a minimum, and we will replace an embed with a plain link if a provider changes its practices in a way that conflicts with this policy.
A service provider that acts on our behalf is described in the sharing section of this policy rather than treated as an external site, because we remain responsible for the information we entrust to that provider.
19. Automated Decision Making
The campus performs automated checks as part of a certification run. Those checks apply test panels to a dataset, compare values against thresholds and produce a panel result. The checks operate on client data rather than on personal data, and they do not make a decision that produces a legal or similarly significant effect for an individual.
A person is always involved in the decision to sign a certification record. The signer reviews the panel results, considers any annotated exception and decides whether the record can be issued. Automated checks assist the signer but do not replace the judgement of a qualified person.
We do not use personal data to build a profile that makes an automated decision about a person. If that ever changes, we will describe the logic in plain language, explain the significance of the decision and offer a way for a person to request human review. A person can ask the desk whether an automated decision affected them and can ask for an explanation.
20. Data Breach Response
We maintain a documented response for a personal data breach, and the process begins as soon as a crew member becomes aware of a possible incident.
The first step is containment: isolate the affected system, disable a compromised credential and stop further loss of information. The second step is assessment: determine what information was involved, how many people are affected and what harm could follow. The third step is notification: inform the affected individuals and the relevant authority where the law requires, and inform the affected client where the incident touches client data. Notifications describe what happened, what we have done and what the recipient can do to protect themselves.
The final step is review. We examine how the incident happened, strengthen the controls that failed and record the lessons in an internal note that the crew reads at the next operations review. We treat a breach as a failure of process rather than an unlucky event, and we prefer a hard look at our own procedures to a statement that could not be wrong.
21. Changes to This Policy
We review this policy at least once a year and whenever a material change occurs in our services, our systems or the law that applies to us. When a change is minor, such as a clarification of wording, we update the date at the top of the page and publish the revised text.
When a change is material, such as a new category of information, a new sharing arrangement or a new retention period, we will give notice before the change takes effect. Notice may be given by a message to clients with an active engagement and by a prominent statement on the website. Where consent is the legal basis for processing, we will ask for fresh consent rather than assume that an earlier consent covers the new practice.
A copy of a superseded version of this policy can be requested from the campus desk, and the desk will provide it in writing. A person who continues to use the website after a notice of change has taken effect is treated as accepting the revised terms of the policy, but no acceptance is inferred from silence where consent is legally required.
22. How to Contact Us
Questions, requests and concerns about this policy are welcome at any time. A person who believes that a right has not been respected, or who wants to understand a practice in more detail, should write to the desk and will receive a reply from a member of the campus team.
Email messages on privacy matters should be sent to certify@antelopedata.buzz. Telephone inquiries can be made on +19862880713 during the business hours published on our contact page. Written correspondence should be addressed to Antelope Data Campus, LLC, 201 S Main St Ste 2025, Salt Lake City - 84111-2268, United States (US).
If a concern is not resolved after a reply from the desk, the next step is to write again and mark the message as a formal complaint. The campus will review the history of the matter, respond in writing and explain any action taken. A person who remains dissatisfied may also contact the privacy regulator in their jurisdiction, and we will cooperate with a regulator that investigates a complaint about our practices.
We are grateful when a reader takes the time to raise a question. A clear question often shows us where this policy could be written more plainly, and we would rather revise the text than leave a person guessing.