This privacy notice explains how the Spam & Unwanted Virus Analysis Team (SUVAT) collects, uses, and protects your personal data when you use our website and services.
Data controller
The data controller for this website and for the personal data processed in the course of SUVAT's functions is:
Spam & Unwanted Virus Analysis Team (SUVAT)
PO Box 1204
London SW1A 2HB
Email: dpo@suvat.uk
Data Protection Officer
SUVAT has appointed a Data Protection Officer (DPO) in accordance with Article 37 of the UK General Data Protection Regulation (UK GDPR). You may contact the DPO at any time regarding questions about data protection or to exercise your rights:
- Email: dpo@suvat.uk
- Post: Data Protection Officer, Spam & Unwanted Virus Analysis Team, PO Box 1204, London SW1A 2HB
Lawful basis for processing
SUVAT processes personal data under the following lawful bases as set out in Article 6(1) of the UK GDPR:
- Article 6(1)(f) — Legitimate interests. The majority of personal data processed by SUVAT is necessary for the purposes of our legitimate interests in analysing cyber threats, reviewing suspicious emails and URLs reported to SUVAT, and providing cyber security guidance. We balance these interests against your rights and freedoms.
- Article 6(1)(a) — Consent. Where you subscribe to SUVAT's alert service or mailing list, we process your email address on the basis of your consent. You may withdraw your consent at any time.
- Article 6(1)(c) — Legal obligation. SUVAT processes certain personal data to comply with its legal obligations, including responding to Freedom of Information requests and maintaining employment records.
What personal data we collect
SUVAT may collect and process the following categories of personal data:
- Website usage data: IP addresses, browser type, operating system, pages visited, referring URL, and access times. This data is collected through essential cookies and server logs.
- Report submissions: When you report a suspicious email or URL through our reporting service, we may collect the content of the email (which may include sender and recipient addresses, subject lines, and message bodies), the URL submitted, and any information you provide in the report form.
- Alert service subscribers: Email addresses and communication preferences provided when subscribing to SUVAT's alert and update service.
- Correspondence: Name, email address, postal address, and the content of communications when you contact SUVAT (including FOI requests, complaints, and general enquiries).
- Job applicants: Personal data provided in job applications, including name, contact details, employment history, qualifications, and information required for security vetting.
How we use your personal data
SUVAT uses personal data for the following purposes:
- To analyse and respond to reports of suspicious emails, URLs, and cyber threats
- To produce aggregate threat research and statistical analysis (individual personal data is not included in published reports)
- To provide cyber security alerts and updates to subscribers
- To respond to correspondence, FOI requests, and complaints
- To recruit staff and manage the employment relationship
- To monitor and improve the performance and security of our website
Data sharing
SUVAT may share personal data with the following categories of recipients where necessary and proportionate:
- Relevant cyber security organisations and industry partners, where necessary for the purpose of analysing and countering cyber threats (limited to technical indicators, not personal data of reporters)
- Internet service providers and domain registrars, for the purpose of facilitating the removal of malicious infrastructure (limited to technical indicators, not personal data of reporters)
- International research partners, subject to appropriate safeguards
SUVAT will not sell your personal data or share it for direct marketing purposes.
Data retention
SUVAT retains personal data only for as long as necessary to fulfil the purposes for which it was collected:
- Website usage data: Retained for 13 months
- Report submissions: Retained for 3 years from the date of submission, after which they are anonymised and retained for statistical purposes
- Alert service subscriptions: Retained until you unsubscribe
- General correspondence: Retained for 3 years from the date of the last communication
- FOI requests: Retained for 5 years
- Job applications (unsuccessful): Retained for 12 months after the recruitment exercise concludes
Your rights
Under the UK GDPR, you have the following rights in relation to your personal data:
- Right of access — You have the right to request a copy of the personal data SUVAT holds about you.
- Right to rectification — You have the right to request that inaccurate personal data be corrected.
- Right to erasure — You have the right to request that your personal data be deleted, subject to certain conditions.
- Right to restriction of processing — You have the right to request that processing of your personal data be restricted in certain circumstances.
- Right to data portability — Where processing is based on consent, you have the right to receive your personal data in a structured, commonly used, and machine-readable format.
- Right to object — You have the right to object to processing based on the public task lawful basis, on grounds relating to your particular situation.
To exercise any of these rights, please contact the Data Protection Officer at dpo@suvat.uk. We will respond to your request within one calendar month.
Complaints
If you are dissatisfied with how SUVAT has handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Changes to this privacy notice
This privacy notice was last updated on 10 January 2026. We may update this notice from time to time to reflect changes in our processing activities or legal requirements. Any significant changes will be communicated through our website.