How Monument handles personal data
Who we are
Monument Data Exchange (“Monument”). Legal entity name, registered address and privacy contact: to be confirmed.
What we hold and where it comes from
- Business contact details — name, job title, business email and company — collected from public business sources so we can contact companies that may want to license their operating records.
- What you send us through forms on this site (valuation estimate, buyer requirements, privacy requests).
- Portal accounts — email, name, sign-in and security records for seller and buyer users.
- Data sellers license through Monument, which may contain information about people (for example a company’s clients or staff). It is held encrypted and is de-identified (pseudonymised) before any buyer sees it. Pseudonymised data can still be personal data; we never describe it as anonymous.
Why we use it
To contact businesses about licensing, to answer enquiries, to run seller and buyer accounts, and to prepare, license and deliver de-identified datasets under signed agreements. The legal basis for each use is to be confirmed by counsel; for business-to-business contact we currently rely on legitimate interests, and we never contact an address that has opted out.
Who receives it
Service providers that host the platform, deliver email and process text on our behalf, and buyers who license de-identified data under a signed licence. Buyers never receive seller identities before a licence or the key that links pseudonyms to people. A list of service providers will be published here: to be confirmed.
How long we keep it
| Raw data a seller connects (before de-identification) | at most 90 days |
| The key linking pseudonyms back to original identifiers | until the dataset is deleted, the seller withdraws it, or you ask us to delete it — a fixed period is to be confirmed |
| De-identified working copies | until the dataset is deleted, the seller withdraws it, or you ask us to delete it — a fixed period is to be confirmed |
| Evaluation samples given to buyers | at most 44 days |
| code_sample_custody | at most 180 days |
| De-identified copies licensed to buyers | until the dataset is deleted, the seller withdraws it, or you ask us to delete it — a fixed period is to be confirmed |
| Business contact details and form submissions | until you ask us to delete them or stop contacting you; after that we keep only a one-way fingerprint of your address so you are never contacted again |
Some records cannot be edited by design — the audit log, access logs and signed agreements — and keep identifiers (email addresses only as fingerprints) so that every action stays traceable.
Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct or delete it, or tell us to stop contacting you. We first ask you to confirm the request from the email address it is about. If it concerns data a seller licensed through us, we pass it to that seller, who decides as the data’s owner, and tell you.
We aim to reply within 30 days (GB), 30 days (EU), 45 days (US-CA); these periods are to be confirmed by counsel.
To stop all contact immediately without a request, use the unsubscribe page. You may also complain to your data protection authority (for the UK, the Information Commissioner’s Office).