Privacy policy

1. Who is responsible for your data

Agent Verdict is the data controller for personal data processed through www.agent-verdict.com. That means we decide what is collected and why, and we are the party you hold responsible. There is no separate operator, parent company or affiliate acting as controller for this site.

For anything in this policy, including any request to exercise your rights, write to hello@agent-verdict.com or use the contact form and pick the data protection topic. We answer data protection requests within one month, and will tell you if we need to extend that, which we may do by up to two further months for complex requests.

2. What we collect and why

The site is designed so that reading and voting require no account and no identifying information. There are four categories of processing.

2.1 Votes

When you vote on a tool or an axis we store the tool, the axis, the direction of the vote, a timestamp, and a random identifier held in a first party cookie called av_voter. That identifier is generated in your browser session, is not derived from anything about you, and is used for one purpose: stopping the same browser voting twice on the same axis. We do not attempt to link it to a person, and we cannot.

• Data: tool, axis, direction, timestamp, random voter identifier.
• Legal basis: legitimate interests, Article 6(1)(f), in operating an accurate community scoreboard and preventing duplicate voting.
• Retention: for as long as the board is published, because the vote is part of the published score.

2.2 Written opinions

If you submit an opinion on a tool we store the name or handle you chose, any role or bio you typed, your score, your text and a timestamp. All of that is intended for publication next to the tool, so please do not put anything in those fields you would not want published. We do not require or request an email address for an opinion.

• Legal basis: consent, Article 6(1)(a), given by submitting the form for publication. You can withdraw it at any time and we will unpublish and delete the entry.
• Retention: until you ask us to remove it, or until we unpublish it during review.

2.3 Contact messages

The contact form collects your name, email address, chosen topic and message. We use them to reply and to keep a record of corrections made to board data, which matters because we publish a correction history.

• Legal basis: legitimate interests, Article 6(1)(f), in responding to enquiries and maintaining an auditable correction record. Where your message is a data protection request, the basis is compliance with a legal obligation, Article 6(1)(c).
• Retention: 24 months from the last message in the thread, then deleted. Records of a published correction are kept in the correction history, but without your contact details.

2.4 Server logs and consent record

Our hosting provider records standard request logs, including IP address, user agent, requested URL and timestamp, for security and abuse prevention. If you make a choice in the cookie banner we store it in a cookie called av_consent plus a matching entry in your browser local storage, so that we do not ask again.

• Legal basis: legitimate interests, Article 6(1)(f), in keeping the service available and secure. The consent record itself is strictly necessary and is set regardless of your choice, because it is how your choice is remembered.
• Retention: logs are kept for up to 30 days. The consent cookie lasts 12 months.

3. What we do not do

• We do not run advertising and we do not sell or rent personal data to anyone.
• We do not load third party advertising or social tracking scripts, so there are no third party tracking cookies on this site.
• We do not build profiles of visitors and we do not carry out automated decision making about you.
• We do not require an account, so we hold no passwords and no authentication data.
• We do not knowingly collect data from children, and the site is not directed at them.

4. Who else processes your data

We use a small number of processors to run the site. Each acts on our instructions under a data processing agreement, and each is used for a single purpose.

• Hosting and content delivery. Serves the pages and produces the request logs described above.
• Database and storage. Holds the board records, votes, opinions and contact messages.
• Email. Delivers replies to contact messages.

Some of these providers operate infrastructure outside the UK and the European Economic Area. Where personal data is transferred internationally we rely on UK and EU adequacy decisions where they exist, and otherwise on the International Data Transfer Agreement or Standard Contractual Clauses together with a transfer risk assessment. You can ask us which provider handles which category and what safeguard applies.

5. Your rights

Under the UK GDPR and the EU GDPR you have the right to be informed, and the rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where we rely on consent you can withdraw it at any time, which does not affect processing already carried out.

To exercise any of these, email hello@agent-verdict.com. Tell us which right you are exercising and enough detail to find the record, for example the email address you used or the name on a published opinion. We do not charge for a request unless it is manifestly unfounded or excessive, and we will explain if we ever refuse one.

One practical limitation: an anonymous vote cannot be traced back to you, because we deliberately hold nothing that links the random voter identifier to a person. If you clear the av_voter cookie we have no way to identify your past votes, and no way to delete them individually.

6. Complaints

If you think we have handled your data badly, tell us first and we will try to fix it. You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office at ico.org.uk. In the EU it is the data protection authority in the country where you live, work, or where you believe the problem occurred.

7. Security

The site is served over HTTPS only. The voter identifier cookie is HTTP only, so page scripts cannot read it. Administrative endpoints are protected by a bearer token, excluded from search indexing and not linked from anywhere in the interface. Access to the database is limited to the people who need it to run the board.

8. Changes to this policy

When this policy changes we update the date at the top and, for anything material, note the change in a dated report on the Pulse page so it is visible rather than silent. The cookies we set are listed separately and kept current on the cookies page.