Privacy Policy

1. Who we are

This Privacy Policy explains how Cradle Labs Limited ("Cradle Labs", "we", "us", "our") collects and uses personal information when you visit the Overwatch waitlist and marketing website (the "Site") or join our waitlist.

Cradle Labs is the controller responsible for your personal information.

Email: hello@dterminal.net

2. Scope

This Policy applies to the marketing Site and the waitlist signup only. Overwatch is not yet generally available, and the Site does not provide the product or a user account. Separate privacy terms will apply to the Overwatch product if and when it launches.

The two intended Overwatch deployment models are described in Section 3 for transparency. Those models, including any processing of camera or video data, are not provided through this Site and will be governed by separate binding Product Terms, an Order and a Data Processing Agreement, which must be accepted before any hosted processing of a Customer's video occurs.

3. The Overwatch service — deployment models and video data

This section describes how the Overwatch service (as defined in our Terms of Service) is intended to handle camera and video data once it becomes available. It is provided for transparency so you can understand the data-protection implications of each model. The terms "Overwatch Service", "Customer", "Product Terms", "Order" and "DPA" have the meanings given in our Terms of Service (Section 4).

Overwatch is not yet generally available. This Site is a waitlist and marketing site only. Nothing on this Site, and nothing about joining the waitlist, results in Cradle Labs capturing, ingesting, receiving, processing or storing any camera footage or video. The arrangements described below apply only under the Overwatch Service and are governed by separate, binding Product Terms, an Order and a Data Processing Agreement (DPA), which will be provided to, and must be accepted by, a Customer beforeany hosted processing of that Customer's video takes place. This summary does not create any contractual obligation and may change before launch; the Product Terms, Order and DPA will prevail in the event of any inconsistency.

Overwatch is intended to be offered in two deployment models.

3.1 Self-hosted / on-premises

In this model, Cradle Labs sets up the Overwatch system and connects the Customer's cameras to it. There may be installation costs and costs for any required equipment. All video ingestion, processing, incident detection, clip generation and storage take place entirely on the Customer's own hardwareand within the Customer's own environment.

In the ordinary course, Cradle Labs does not ingest, receive, store or process the Customer's video in this model. Cradle Labs' involvement is limited to initial setup and to any maintenance or support that is separately agreed. The Customer is the data controllerfor the footage and is responsible for its lawful use (including any required signage, notices, lawful basis and data-subject rights relating to people captured on camera). Where the Customer's use involves biometric or special-category data (for example, facial recognition), the Customer is responsible for identifying a valid condition under Article 9 of the UK/EU GDPR and for any required appropriate-policy document or data protection impact assessment.

Any access by Cradle Labs to a Customer's system or footage (for example, during installation, configuration, troubleshooting or agreed support) is limited, occasional, purpose-bound, and carried out only as necessary for that task, under appropriate confidentiality and contractual terms. Where such access involves Cradle Labs processing personal data on the Customer's behalf, it is governed by the applicable Product Terms and DPA.

3.2 Hosted / managed

In this model, video ingestion and processing take place on Cradle Labs' servers. The Customer must provide explicit, informed consent and authorisationfor Cradle Labs to capture, ingest, process, analyse and forward the Customer's camera video for the purpose of providing the Overwatch Service (including incident detection and notifications).

Providing the service includes forwarding relevant video, frames or derived data to carefully selected third-party artificial-intelligence providers, acting as sub-processors, so that detection and scene understanding can be performed. These AI providers are contractually restricted from using the data to train, develop or improve their own models or services and may process the data onlyto provide the detection/understanding functionality back to Cradle Labs, in accordance with Cradle Labs' instructions, and for no other purpose. Overwatch's AI generates probabilistic detections to assist the Customer; it does not make decisions producing legal or similarly significant effects on individuals, and any such use would be the Customer's responsibility under its own lawful basis and Article 22 obligations.

In the hosted model:

• the Customer is the data controller for its camera footage and the people captured in it;
• Cradle Labs acts as a processoracting on the Customer's documented instructions in respect of that footage, and processes that footage only on those documented instructions except where required by law (Cradle Labs may act as a controller only for limited, ancillary purposes such as security, service integrity, billing and legal compliance);
• processing is governed by a Data Processing Agreement (DPA) entered into at onboarding, which sets out the subject-matter and duration of processing, the documented list of sub-processors (including AI providers), the applicable technical and organisational security measures, confidentiality obligations, assistance with data-subject rights, limited retention, deletion or return of footage on termination, and appropriate safeguards for any international transfers;
• we maintain a list of sub-processors and will give the Customer prior notice of any intended addition or replacement, with the opportunity to object, as set out in the DPA;
• data-subject requests relating to footage are directed to the Customer as controller; we will assist the Customer in responding as required by the DPA and Articles 28 and 12–23 of the UK/EU GDPR; and
• we will notify the Customer of personal data breaches affecting footage without undue delay, as set out in the DPA.

3.3 Lawful bases (intended, hosted model)

When the hosted product is offered, Cradle Labs anticipates relying on the following lawful bases under UK and EU GDPR for its own processing, while the Customer remains responsible for identifying and maintaining a lawful basis for the underlying camera surveillance as controller:

• Consent / authorisation— for capturing, ingesting and forwarding a Customer's camera video for hosted processing, which requires the Customer's explicit, informed authorisation before any such processing begins;
• Performance of a contract — to provide, operate, maintain and support the Overwatch Service the Customer has signed up for;
• Legitimate interests — for ancillary purposes such as securing the service, preventing misuse and fraud, ensuring service integrity, and defending legal claims, where these are not overridden by the rights and interests of the individuals concerned;
• Legal obligation — where Cradle Labs must process or disclose data to comply with applicable law.

The definitive lawful bases, roles, sub-processor list and safeguards for the hosted product will be set out in the Product Terms and DPA provided at onboarding.

4. What we collect

• Waitlist information: the email address you submit to join the waitlist, and your name if you choose to provide it.
• Communications: the content of any messages, feedback or enquiries you send to us, and our correspondence with you.
• Technical and usage data: information collected automatically when you visit the Site, such as IP address, device and browser type, operating system, referring pages, and pages viewed, gathered through server logs and privacy-respecting analytics.

We do not intentionally collect special category (sensitive) personal data through the Site, and ask that you do not send it to us.

Camera and video data is not collected through this Site. Any capture, ingestion or processing of camera footage or video applies only under the Overwatch Service and only in the hosted deployment model described in Section 3, governed by separate Product Terms, an Order and a Data Processing Agreement. Joining the waitlist does not involve any camera or video data.

5. How and why we use your information

Where we rely on consent (for example, waitlist and marketing emails), you can withdraw it at any time — every marketing email includes an unsubscribe link, and you can also contact us. Withdrawing consent does not affect processing carried out before withdrawal.

Where we rely on legitimate interests, we have considered these against your rights and interests (for example, our interest in running a secure, functioning website and gauging interest in Overwatch).

We do not sell your personal information, and we do not use it for invasive cross-site advertising or ad-tracking.

6. Cookies and analytics

The Site uses a limited number of cookies and similar technologies:

• Essential cookies/technologies needed for the Site to function and to keep it secure.
• Analytics in a privacy-respecting manner to understand aggregate usage (for example, how many people visit and which pages are popular), so we can improve the Site.

We do not use invasive advertising or cross-site tracking cookies. Where required by law, we will request your consent for non-essential cookies, and you can control cookies through your browser settings.

7. Sharing and disclosure

We share personal information only as needed and with appropriate safeguards:

• Service providers / processors acting on our behalf, including hosting and website deployment providers and email delivery / CRM providers used to operate the Site and manage the waitlist. These providers process data on our instructions under appropriate contractual terms.
• Third-party AI providers (sub-processors) — Overwatch hosted product only. If and when a Customer uses the hosted Overwatch product, relevant video, frames or derived data may be forwarded to third-party artificial-intelligence providers acting as sub-processors to perform incident detection and scene understanding. These providers are contractually restricted from using the data to train or improve their own models and may process it only to provide the service back to Cradle Labs under its instructions. This does not apply to this Site or to waitlist data, and is governed by the Product Terms, Order and Data Processing Agreement described in Section 3.
• Legal and regulatory disclosures, where required by law, court order, or to establish, exercise or defend legal claims, or to protect the rights, safety and security of Cradle Labs, our users or the public.
• Business transfers, if Cradle Labs is involved in a merger, acquisition, financing or sale of assets, in which case personal information may be transferred subject to this Policy.

We do not sell your personal information and we do not share it with third parties for their own independent marketing.

8. International transfers

Our service providers may process personal information in countries outside your own, including outside the UK/EEA. Where personal information is transferred internationally, we take steps to ensure an appropriate level of protection through recognised safeguards, such as adequacy decisions or standard contractual clauses (or equivalent mechanisms).

For the Overwatch hosted product (see Section 3), where camera or video data or related personal data is transferred outside the UK or EEA — including to third-party AI sub-processors — Cradle Labs will put in place appropriate transfer safeguards, such as an adequacy decision, the UK International Data Transfer Agreement (IDTA) or UK Addendum, or EU Standard Contractual Clauses (or equivalent mechanisms), as set out in the applicable Data Processing Agreement. No such transfers arise from this Site or from joining the waitlist.

9. Data retention

We keep waitlist information for as long as needed for the waitlist and related communications, and then delete or anonymise it, unless we are required to keep it longer to comply with legal obligations or to resolve disputes. Technical and analytics data is retained only for as long as reasonably necessary for the purposes described above.

Retention of camera footage, clips and related data under the Overwatch hosted product (see Section 3) is governed by the applicable Product Terms and Data Processing Agreement, which provide for limited retention and for the deletion or return of Customer footage on termination of the service. No such footage is held by Cradle Labs as a result of this Site or the waitlist.

10. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse or alteration. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to address any incident appropriately.

For the Overwatch hosted product, the technical and organisational measures applicable to footage are specified in the Data Processing Agreement, and we will notify the Customer of personal data breaches affecting footage without undue delay, as set out in that agreement.

11. Your rights

Subject to applicable law, you may have the right to:

• access the personal information we hold about you;
• request rectification of inaccurate or incomplete information;
• request erasure of your personal information;
• object to or request restriction of our processing;
• request data portability (receive certain data in a portable format);
• withdraw consent at any time where processing is based on consent; and
• unsubscribe from marketing communications at any time.

To exercise any of these rights, contact us using the details below. We may need to verify your identity. We will respond within the timeframes required by applicable law.

You also have the right to lodge a complaint with a supervisory authority— in the UK, the Information Commissioner's Office (ICO) at ico.org.uk — or your local data protection authority. We would, however, appreciate the chance to address your concerns first.

12. Children

The Site is not directed to children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will take reasonable steps to delete it.

13. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, take reasonable steps to notify you. Please review this Policy periodically.

14. Contact us

For any questions, requests, or to exercise your rights, please contact Cradle Labs Limited at:

Email: hello@dterminal.net

This Policy, and any dispute or claim arising out of or in connection with it or its subject matter, shall be governed by and construed in accordance with the laws of the jurisdiction in which Cradle Labs Limited is incorporated, without prejudice to any mandatory data protection rights available to you under the law of your country of residence.