Privacy notice
This is a starter privacy notice provided by Net Intellect for Net Intellect's guest WiFi captive portal. Before a live customer service collects guest data, the controller must complete and approve its legal identity, lawful bases, suppliers, locations, transfer details and retention periods.
Who is responsible
Data controller: Net Intellect
Privacy contact: info@netintellect.co.uk
What we capture
For every submission we record a limited connection entry:
- The date and time you connected
- The hardware identifier of the access point you connected through
- An event tag, where the venue uses one
If, and only if, you tick the consent box and provide a valid email address, we also record:
- Your email address
- Your consent flag and the time of your latest matching submission
- Your device's MAC address and IP address
- The WiFi network name and your browser's full user-agent string
- A technical verification status and reason, where the network controller can verify your device
A repeat sign-up with the same device MAC and email updates the existing row and its timestamp. This is a record of the latest matching submission, not an append-only history of every consent event.
If you choose "Just connect — skip the email", or enter an email but do not tick the consent box, the connection entry does not retain your email, client-device MAC, IP address, WiFi network name or full user-agent. The short-lived security records below are created for every route because they protect the service and let the sign-in window close correctly.
Short-lived technical records: we use your device MAC, IP address and a broad device family derived from the user-agent for authorisation, captive-window dismissal, and to limit repeated sign-in attempts so the network cannot be abused. The service stops using a record after its short technical window. Rows older than one hour become eligible for deletion and are removed by the next successful hourly retention job, normally within two hours of creation. They are not guaranteed to disappear at exactly 60 minutes. A health alert is raised if the hourly job has not succeeded for more than three hours. These records are not used for marketing or profiling.
Connectivity check: after the network approves your device, this page makes credential-free HTTPS GET requests to www.wikipedia.org, duckduckgo.com and www.mozilla.org. It may retry briefly while access reaches the WiFi equipment. These requests do not send saved website credentials or a referrer, and the page cannot read their response content. Each provider still receives the connecting IP address and ordinary request metadata. The checks are used only to confirm that internet access is working before the captive page closes.
Operational logs: Cloudflare records request, error and application logs for the portal and keeps Workers Logs for up to 7 days.
Coming back
If you have signed up here before on the same device, we may recognise it when you return and connect you straight away without showing the form again. That recognition uses your device's MAC address, the same identifier described above. It is not a cookie, and it tells us only that this device signed up before.
How long it lasts depends on your device, not just on us. Our own limit for recognising your device is 7 days from your last sign-up. In practice it can be shorter: most modern phones change the MAC address they show to a network from time to time as a privacy feature, and as soon as yours does, we stop recognising it and you will simply see the sign-in form again. You can also make it stop immediately by telling your phone to forget this network, or by asking us to delete your record using the contact in "Your rights" below.
What we don't capture
- Your name, phone number, or postal address
- The websites or pages you visit, or the content you send or receive after connection
- The guest sign-in page does not set an application cookie or tracking pixel
Cloudflare still processes portal requests and operational logs as the hosting provider. The standard portal does not send guest data to an email platform.
How we use your email
If you tick the consent box, Net Intellect may use your email to send news about upcoming events. The standard portal stores the address in its consented-guest list but does not itself send marketing email or automatically sync to an email platform. Net Intellect may download the protected CSV and import it into its approved marketing service. You can withdraw from marketing using the instructions in an email or by contacting Net Intellect.
How long we keep it
The portal database keeps your email, consent flag and related sign-up fields for 24 months after the latest submission for that device and email, then deletes them automatically, unless an administrator erases the row or the Service ends first. This starter notice does not yet record the controller's consent-record review interval. An unsubscribe in a separate email platform does not automatically erase the portal record. To have the portal record erased, use the contact in "Your rights" below.
The client-device MAC, IP address and full user-agent recorded when you sign up are cleared 12 months after the latest matching submission for that device and email. The access-point MAC, WiFi network name, optional event tag, verification fields, email, consent flag and latest timestamp remain with the sign-up row until it is deleted as described above.
If the venue's network cannot confirm that your sign-up came from a device connected to its WiFi, or a later address from the same device replaces it, the sign-up is left out of the venue's guest-list export and deleted automatically 30 days after the latest submission for that device and email.
The skipped/non-consenting connection records (which hold no email, client-device MAC, IP address, WiFi network name or full user-agent) are kept for up to 24 months for visitor-number reporting, then automatically deleted.
This starter notice does not yet record the customer's Cloudflare plan or D1 Time Travel recovery period.
Your rights
Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase, restrict, object to processing, or receive a copy of your data. Email info@netintellect.co.uk. Net Intellect is responsible for the request and will normally respond within one month, subject to any lawful extension.
Your right to object to direct marketing
You can object to direct marketing at any time. Use the unsubscribe link in any marketing email or email info@netintellect.co.uk. This will not affect your access to the WiFi.
Complaints
To complain about how your personal data is used, email info@netintellect.co.uk.
You also have the right to complain to the Information Commissioner's Office through its data-protection complaints service.
Who operates the portal
This starter notice does not yet record whether Net Intellect acts as the controller or as a data processor for this service.
The Service is not UK-only. A new paying customer's D1 database has its primary placed in London, which applies to the database only and is not a UK residency guarantee. Worker processing, operational logs and any other approved suppliers have their own locations and transfer terms. Net Intellect's final notice must name the suppliers, locations and safeguards that apply to this venue.