SENTINATE AISENTINATE AIEffective 12 November 2026. This notice applies to the Sentinate agent-licence onboarding form. It is separate from the processing we perform as a processor for a customer's deployed agents.
Sentinate AI Services Ltd (Cyprus registration HE 499373) is the controller of personal data collected through this form. Contact us about privacy at admin@polymorphic.group, the operations mailbox handling this Sentinate service.
We collect the signatory's name, role, business contact address, company and agent details, email-verification events, the agreement version and acceptance evidence, IP address and browser user-agent. We use them to prepare and administer the requested licence, verify control of the supplied email address, prevent abuse, send contract records, and defend or establish legal claims. Email verification does not establish the signatory's identity or authority to bind a company. The legal bases are steps toward and performance of a contract where you are a party (GDPR Article 6(1)(b)); our legitimate interests in business contracting, security and reliable acceptance evidence (Article 6(1)(f)); and applicable record-keeping duties (Article 6(1)(c)). Where the signatory acts for a company, our main basis for their contact and verification data is legitimate interests, not a claim that the individual is personally party to the company's contract. You can ask about our balancing assessment.
The fields marked as required in the form are needed to prepare the licence and verify an acceptance. If they are not supplied, we cannot complete online onboarding. We do not use this form for automated decisions with legal or similarly significant effects, and it does not set tracking cookies.
Authorised Sentinate and Polymorphic operations staff, hosting and backup providers, Microsoft 365 for verification and contract email, and an independent timestamp authority for a cryptographic record hash may receive the minimum data needed for their roles. We may share records with professional advisers, regulators or courts where required. We do not sell onboarding data.
Some providers or support activity may involve processing outside the European Economic Area. Where the GDPR requires a transfer mechanism, we use an applicable adequacy decision or suitable safeguards such as the European Commission's standard contractual clauses, with supplementary measures where needed. Ask us for the relevant safeguards and destination details before submitting if a particular location matters to you.
Incomplete sessions expire after one hour in server memory. Completed agreement and verification evidence is kept for the service term and then for the period needed to meet applicable accounting duties and to establish, exercise or defend legal claims; a legal hold may extend that period. Backups follow their documented retention cycle. We review records against these criteria and erase or anonymise them when the reason for keeping them ends.
Subject to the GDPR's conditions and exceptions, you may request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw any consent where consent is used. Contact the address above. You may also complain to the Cyprus Commissioner for Personal Data Protection or another competent EU/EEA supervisory authority. We will not charge for ordinary requests.