GDPR
A short companion to the privacy policy for people covered by the EU or UK GDPR: what we rely on to process your data, what you can ask us to do about it, and how long we take to answer.
What this page covers
This page complements the Privacy Policy, which is the full account of what the website collects. Here we set out the parts the EU and UK GDPR specifically require: the lawful basis for each activity, the rights you hold, and how to use them.
It covers personal data Sillion collects through its website — essentially, waitlist sign-ups, demo bookings, email to us, and ordinary server and analytics data. It does not cover student data processed for a school, where the institution is the controller and Sillion is its processor; that is governed by the DPA, and requests go to the institution.
Who is responsible
For personal data collected through this website, Sillion is the controller: we decide why and how it is processed.
Sillion has not appointed a data protection officer. Nothing about our processing meets the Article 37 threshold — we do not carry out large-scale systematic monitoring, and we do not process special category data at scale through this site. Data protection questions go to hello@sillion.app and reach a person, not a queue.
Lawful bases
| What we do | Why | Lawful basis |
|---|---|---|
| Serve the website | A web server needs the request data to return a page | Legitimate interests (Art. 6(1)(f)) — operating the site you asked for |
| Waitlist email | To send the confirmation, then build notes and an invitation | Consent (Art. 6(1)(a)) — given when you submit the form |
| Anti-abuse data | IP address, user agent, and referrer, to spot automated sign-ups | Legitimate interests — keeping the list usable |
| Analytics | Aggregate traffic and page-speed measurement | Legitimate interests — knowing which pages are read and where the site is slow |
| Demo bookings | To schedule and hold a meeting you requested | Steps prior to a contract (Art. 6(1)(b)) or legitimate interests |
| Email you send us | To answer it | Legitimate interests — responding to correspondence |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you can object at any time — see below. Where we rely on consent, you can withdraw it at any time, and doing so does not affect processing that already happened.
Your rights
- Access. A copy of the personal data we hold about you, and information about how it is used.
- Rectification. Correction of data that is inaccurate or incomplete.
- Erasure. Deletion, where we no longer need the data or you withdraw the consent it rests on.
- Restriction. A pause on processing while a dispute about accuracy or legitimate interests is resolved.
- Portability. Data you gave us, in a structured, commonly used, machine-readable form, where processing rests on consent or contract and is automated.
- Objection. An objection to processing based on legitimate interests. Where you object to direct marketing, we stop — there is no balancing test for that one.
- Withdrawing consent. At any time, for anything we do on that basis.
- Complaint. To a supervisory authority, as below.
We do not make decisions about you by automated means that produce legal or similarly significant effects, so the Article 22 right does not arise on this website.
Making a request
Write to hello@sillion.app and say what you want. There is no form, and you do not need to cite an article.
We will ask for enough to be reasonably sure you are who you say you are, which is a safeguard for you rather than an obstacle: handing your data to someone else because they emailed us confidently would be a breach. For a waitlist record, writing from the address you signed up with is usually enough. We do not ask for identity documents.
Exercising a right is free. Where a request is manifestly unfounded or excessive, particularly if repetitive, we may charge a reasonable fee or decline — and if we do, we will explain why and tell you how to challenge it.
For the specific case of getting off the mailing list, the privacy policy explains the difference between unsubscribing and deletion, which are not the same thing.
How long we take
We respond within one month of receiving the request. Where a request is complex, or where you have made several, we may extend by up to two further months — in which case we will tell you within the first month, and say why.
If we decide not to act on a request, we will tell you within a month, with our reasons and with your options: complaining to a supervisory authority, or a judicial remedy.
Data outside the EEA and UK
Sillion's providers operate infrastructure in more than one country, including the United States, so your data may be processed outside the EEA or the UK. The providers are listed on the subprocessors page.
Where a transfer needs a Chapter V safeguard, we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum where the UK GDPR applies, as offered by the provider in question, or on an applicable adequacy decision.
Complaints
Tell us first if you can — most things are quicker to fix directly. Write to hello@sillion.app.
You also have the right to complain to a supervisory authority without coming to us at all. In the EEA that is the authority in the country where you live or work, or where you believe the problem happened; the European Data Protection Board publishes the list. In the UK it is the Information Commissioner's Office. Complaining does not affect any other remedy available to you.