Privacy Policy

1. Preamble

This Privacy Policy explains and describes the collection, use, processing, storage, and disclosure of personal information by SQLWATCH LTD (“SQLWATCH”), a company registered in England and Wales with company number 15445323 whose registered office is at Innovation Centre, Innovation Way, Heslington, York, YO10 5DG, United Kingdom.

This Privacy Policy is part of the SQLWATCH Terms of Service (“Terms”).

Our Privacy Policy applies to our processing of personal data (“Personal Data”) collected through all websites on which SQLWATCH operates. This includes: https://sqlwatch.cloud, and all other subdomains (collectively, the “Websites”).

Our Privacy Policy also applies to all Personal Data processing by SQLWATCH for our products, and services provided through the Websites and otherwise, including without limitation the SQLWATCH Open-Source Monitoring Framework, SQLWATCH Data Collector Module (including the SQLWATCH Cloud Agent) and the SQLWATCH Cloud (referred to hereafter as “SQLWATCH Products” or “Products”).

By accessing or using any of the SQLWATCH Products or the Websites, you acknowledge, accept, and agree to the practices described in this SQLWATCH Privacy Policy.

Please note that this Privacy Policy does not apply to any third-party websites, services, products or, applications including where these are integrated into our products and services or accessible through our Websites or SQLWATCH Products and you should familiarize yourself with the privacy policies of each of the vendors in question. See Section 12 below for more information.

2. Our Principles

SQLWATCH has designed this Privacy Policy to be consistent with our core company principles:

We are founded by Database Administrators and understand the risks associated with data collection and privacy. We believe:

privacy policies should be transparent and easy to understand; and
data collection, storage, and processing should be simplified as much as possible to enhance security, ensure consistency, and make data processing and privacy practices easy for users to understand.

We always endeavour to minimise the collection of personal data and information.

We comply with key data protection laws and privacy standards in the United Kingdom, such as GDPR and CCPA.

We do not sell your Personal Data. We designed SQLWATCH products to help you monitor your SQL Servers and not to harvest Personal Data (or business data) for profit.

Any Personal Data we collect is protected using best practice security measures, and we collect only the minimum amount of Personal Data required to provide the service. In most cases, we use trusted partners that deal with authentication and payments.

3. What personal information do we process?

We process Personal Data that you give us.

For example, we collect Personal Data about you when you:

Sign up or register for one of our products or services.
Create an account.
Utilize interactive features of our Website or Products.
Fill out a Website form.
Give us feedback, ideas, or submissions about any of our Products.
Communicate with us through third-party social media sites.
Request technical support.
Register for white papers, web seminars, and other events we host.
Use our online forum or slack channel
Otherwise communicate with us through our Websites, SQLWATCH Products, or any other means.

4. Information we collect and how we use it.

4.1 Personal Data Collection and the lawful basis for processing

SQLWATCH collects and uses Personal Data in the following ways:

Website and Analytics: When you visit our Websites or use our Products, SQLWATCH collects some information about your activities through specific website analytics tools. The type of information that we collect includes general information such as the country or city where you are located and the pages visited, time spent on pages, a heat map of visitors’ activity on the Website, and information about the browser you are using. SQLWATCH collects and uses this information to pursue our legitimate interest in enhancing the security and utility of our Website and Products.

Information from Cookies: We and our service providers may collect information using cookies or similar technologies for any legitimate interests. Cookies are information stored by your browser on the hard drive or memory of your computer or other Internet access devices. Cookies may enable us to personalize your experience on the Website, maintain a persistent session, passively collect demographic information about your computer, and monitor advertisements and other activities. The Websites may use different kinds of cookies and other types of local storage (such as browser-based or plugin-based local storage). For further information about how cookies work, please visit allaboutcookies.org.

When you use and access the Website or the SQLWATCH Cloud Product, we ask you to accept our cookie policy. You may be asked to accept our Cookie Policy on our Website and the Cloud Product. Most often, once we identify your use of either the Website or SQLWATCH Cloud Product, your acceptance of the Cookie policy will apply to your use of both of these two SQLWATCH systems. When you accept our Cookie Policy, you also consent to SQLWATCH’s collection of relevant information and data about your computer or device, which may be considered “personal data”. You can set your browser not to accept cookies, and the allaboutcookies.org website tells you how to remove cookies from your browser. However, in a few cases, the SQLWATCH Products may not work. In addition, Websites’ features may not function efficiently or correctly.

SQLWATCH Cloud: When you sign up to any of our services, e.g. User Forum, Cloud, SQLWATCH is granted access to Personal Data in the user profile of the authentication provider you choose (e.g. Microsoft Entra, GitHub) in order to authenticate you. SQLWATCH collects and uses this Personal Data pursuant to a contract for services. We may use your email address to contact you regarding changes to this Privacy Policy or to our Terms of Use. The profile login name or email address may be used to connect and associate you with any Content you submit to our Websites, or to your use of our Websites or products.

By using the SQLWATCH Cloud Products, you are agreeing to allow SQLWATCH to send you communications about our Products, but you will have the ability to opt-out of receiving marketing emails.

Emails and Newsletters: When you sign up to receive Product updates from SQLWATCH, sign up for the SQLWATCH Cloud Product, or otherwise voluntarily subscribe to one of our mailing lists, you will be asked to provide some very limited Personal Data. SQLWATCH collects and uses this Personal Data for the sole purpose of providing you with relevant Product news and updates and pursuant to our legitimate interest to promote our business. All bulk email communications from SQLWATCH include links to unsubscribe from our mailing lists. If you opt out and continue to use SQLWATCH Products, we may still send you non-promotional communications, including those relating to your current SQLWATCH accounts or your use of the SQLWATCH Products.

Email Analytics: When you receive communications from SQLWATCH after signing up for and consenting to receive the SQLWATCH newsletter, campaign updates, or other ongoing email communications from SQLWATCH, we may use analytics to track whether you open the mail, click on the links, and otherwise interact with the materials we send you. You may opt out of this tracking by indicating that you no longer wish to receive the newsletter, campaign updates, or other ongoing email communications from SQLWATCH and using this link: Unsubscribe. SQLWATCH collects and uses this Personal Data pursuant to its legitimate interest to understand the interests of its users, supporters, and volunteer community in order to provide more relevant news and updates.

Opting out of SQLWATCH marketing communications does not mean we will discontinue sending you SQLWATCH service-related emails, which include information about updates, new releases, support, and other relevant information for SQLWATCH Product users.

Other Voluntarily Provided Information: When you provide feedback to SQLWATCH or otherwise submit Personal Data to SQLWATCH, SQLWATCH collects and uses this Personal Data pursuant to its legitimate interest to better understand our user community and in furtherance of the particular program or activity to which you provided your feedback or other input.

Third-Party Sources: We may obtain Personal Data about you from other sources and combine that with information we collect through your access and use of our Websites and Products. For example, if you create or log into your account through a site like Google.com or GitHub.com, we may have access to certain information about you from those sites, such as your name, log-in credentials, account information, and other information in accordance with the authorization procedures and privacy policies determined by those third-party websites. We may add this information to the information we have already collected from you by way of our Website in order to improve the products and services we provide you and our user community. Through GitHub in particular, we may collect information provided by the GitHub API about people who have starred, follow, or comment on our open-source products.

4.2. Service Data Collection

Server Monitoring Data Collection and Processing

Our Role in Data Processing:

Account Information: SQLWATCH acts as a data controller for your registration details, billing information, and account preferences
Monitoring Data: SQLWATCH acts as a data processor when collecting and processing data from your SQL Server instances on your behalf

What Monitoring Data We Collect:

Server names, database names, and SQL Server system object names
Performance metrics from SQL Server Dynamic Management Views (DMVs)
System events from SQL Server event logs
Error logs and diagnostic information
Table names (for index analysis and overall monitoring)
Health check outcomes that may include information about accounts and security recommendations.

We do NOT collect: user data from your database tables, customer records, business data, passwords or any sensitive security information. As such our processing of Personal Data as data processor is highly limited.

Special Considerations for Potentially Personal Data: While we design our monitoring to avoid collecting Personal Data, some information may inadvertently contain Personal Data in the following scenarios:

Error Logs: SQL Server may include query fragments in error messages
Event Logs: System crashes may dump memory contents including running queries
Deadlock Information: Deadlock graphs may contain query details with potential Personal Data
Execution Plans: Cached or captured execution plans may include query literals and parameter values that can contain Personal Data.

When such Personal Data is collected, it is processed solely for technical monitoring and troubleshooting purposes and is subject to the same security protections as all other Personal Data.

Your Responsibilities as Data Controller: When we process your monitoring data, you remain the data controller and must:

Ensure you have lawful basis for collecting and sharing the monitoring data
Inform your data subjects (where applicable) about the monitoring
Only provide us with data necessary for monitoring purposes
Comply with data subject requests related to monitoring data

5. How do we store your information?

We collect, process, and store Personal Data (including user email addresses provided when you access the SQLWATCH Cloud Product or when you provide us Personal Data on our Website) in secure systems hosted by reputable third parties that provide cloud services to SQLWATCH, subject to specific written data processing obligations that are consistent with applicable regulations and English law. These data processing obligations expressly prevent these third parties from using Personal Data we share with them except to provide SQLWATCH services we have requested, and for no other purpose.

SQLWATCH stores Personal Data in secure third-party cloud environments pursuant to its legitimate interest in being able to identify you when we provide you access to our Products and Website, and to enhance the security of the Personal Data we collect. This is detailed in our Data Processing Agreement which can be provided upon request.

Data Retention Periods:

Account Information: Retained during active subscription plus 7 years for tax/legal compliance
Monitoring Data: Retained according to your configured settings (typically 30 days default)
Marketing Communications: Until you unsubscribe or 3 years of inactivity
Post-Termination: Workspace deleted within 30 days (as per Terms of Service Section 8.3)

6. Access to Your Personal Data

You are entitled to a copy of Personal Data that SQLWATCH holds and to have inaccurate data corrected or removed to the extent SQLWATCH still maintains it. In certain circumstances, you also may have the right to object to the processing or transfer of Personal Data. If you wish to exercise any of these rights, please write to [email protected] explaining your request.

See Sections 14 and 15 below entitled “CCPA Practices” and “GDPR Practices” respectively for additional information about exercising your rights to control your Personal Data and data.

7. Disclosure of Your Personal Data

SQLWATCH does not disclose Personal Data to third parties except as such disclosure is reasonably necessary to (a) provide you the full functionality of SQLWATCH Products; (b) secure Personal Data we collect; (c) take action regarding suspected illegal activities; (d) enforce or apply our terms of business and this Privacy Policy; (e) enforce our Acceptable Use Policy, including our Code of Conduct, or (f) comply with legal processes, such as a search warrant, subpoena, statute, or court order (including Compelled Disclosure, see below).

Compelled Disclosures: Subject to applicable law, we may disclose your Personal Data to government or law enforcement officials or to private parties to:

Respond to claims and/or legal process (including subpoenas).
Protect the property and/or rights of SQLWATCH or any third party.
Protect the safety of the public or any person.
Prevent or stop any illegal, unethical, or legally actionable activity.
Comply with applicable law or regulation.
Respond to any lawful request by public authorities, including, without limitation, to meet national security or law enforcement requirements.

Finally, we may share Personal Data with your consent or at your direction, including if we notify you through any of our Website or Products that the information you provide will be shared in a particular manner, and you consent to such processing.

8. How we secure your Personal Data.

SQLWATCH has implemented reasonable physical, technical, and organizational security measures to protect and safeguard information that SQLWATCH processes against accidental or unlawful destruction, or accidental loss, alteration, unauthorized disclosure, or access, in compliance with applicable law. However, no product or service can fully eliminate security risks. If any data breach occurs, we will post a reasonably prominent notice to the Websites and comply with all other applicable data protection requirements including, when required, personal notice to you if you have provided and we have maintained an email address for you.

Data Breach Notification:

In the event of a data breach that poses risks to individuals’ rights and freedoms, we will:

Notify Regulators: Report to the ICO (and other relevant supervisory authorities) within 72 hours where feasible
Notify You: Inform affected customers without undue delay when the breach is likely to result in high risk to individuals
Document Breaches: Maintain records of all personal data breaches as required by law

How We’ll Notify You:

Email notification to your registered account email address
Notice posted on our website and/or service dashboard
Direct communication for high-severity incidents

What We’ll Tell You:

Nature of the breach and data types affected
Likely consequences of the breach
Measures we’ve taken to address the breach
Recommended actions you should take

Our Security Practices: SQLWATCH maintains information security policies, procedures, and controls governing the processing, storage, transmission, and security of Personal Data processed by our Website and SQLWATCH Products. SQLWATCH has also implemented and will maintain appropriate technical security measures, internal controls, and information security routines designed to protect Personal Data processed by our Website and SQLWATCH Products against unauthorized access, acquisition, use, disclosure, or destruction. SQLWATCH has further implemented and will maintain appropriate physical security measures designed to protect the tangible items that comprise physical computer systems and networks that store and process Personal Data through our Website and SQLWATCH Products, including servers and devices. SQLWATCH has additionally implemented and will maintain appropriate organizational security measures designed to protect Personal Data processed by our Website and SQLWATCH Products against unauthorized access, acquisition, use, disclosure, or destruction.

SQLWATCH informs its employees about relevant security procedures and their respective roles, including an annual mandatory security awareness training that addresses such employees’ rights to access Personal Data (if any), and informing such employees of their obligations and the consequences of violating such obligations.

9. Children

Our Websites and SQLWATCH Products are not designed for use by or directed at children under the age of 13. Consistent with the U.S. Children’s Online Privacy Protection Act of 1998 (“COPPA”), we will never knowingly request Personal Data from anyone under the age of 13 without requiring parental consent. Our Terms specifically prohibit anyone using the SQLWATCH Products or Websites from submitting any personally identifiable information about persons under 13 years of age.

Any person who provides their Personal Data to SQLWATCH through the SQLWATCH Products and Services represents that they are 13 years of age or older.

If you are under 13, please do not attempt to use the SQLWATCH Products or Websites or send any Personal Data about yourself to us. If we learn that we have collected Personal Data from a child under age 13, we will delete that information as quickly as possible.

10. Third-Party Service Providers

SQLWATCH uses a number of third-party service providers in connection with our Website and Products, including website cloud hosting services, database management, payments and others. Some of these service providers may place session cookies on your computer, and they may collect and store your Personal Data on our behalf in accordance with the data practices and purposes explained in this Privacy Policy.

11. Third-Party Sites

Our Websites and our Products may provide links to a wide variety of third-party websites. You should consult and review the respective privacy policies of these third-party websites. This Privacy Policy does not apply to, and we cannot control the activities of, such other websites. This Privacy Policy does not apply to the privacy practices of any companies we don’t own or control, any persons we don’t manage, or any third-party website, software, or service that we don’t control (including, with respect to our extensions and integrations, the underlying third-party software).

If you choose to visit another website by clicking on a hyperlink or otherwise, you will be directed to that third party’s website. The fact that we link to a website is not an endorsement, authorization, or representation of our affiliation with that third party. We do not exercise control over third-party websites. These other websites may place their cookies or other files on your computer, collect your data, or solicit Personal Data from you. This Privacy Policy only addresses the use and disclosure of information that we collect from you through our Websites and Products only. Other websites may follow different rules regarding the use or disclosure of your Personal Data. We encourage you to read the privacy policies or statements of other websites you visit before providing your information to them.

12. Transferring Data to Other Countries

Data Storage Locations:

Your data is stored within the country or region in which your business is based, or in a location selected by you.
Your billing and payment data is handled and stored by our third-party payment processor in accordance with their own terms and security standards; SQLWATCH does not store cardholder data.

If you are accessing or using the Websites or our Products in regions with laws governing Personal Data collection, processing, transfer, and use, please note that when we use and share your Personal Data, we may transfer your Personal Data to recipients in countries other than the country in which the Personal Data was originally collected. Those countries may not have the same Personal Data protections as the country in which you initially provided the information. Personal Data transferred from the UK and EEA (including the European Union) to the United States or outside the European Union to locations that are not deemed to have maintained adequate levels of data protection, will be made on the grounds of a data processing agreement in the form of the UK International Data Transfer Agreement or the EU Standard Contractual Clauses which are approved by the European Commission, consistent with applicable data privacy requirements.

Data Processing Locations: While your data is stored as described above, it may be accessed for technical support and maintenance purposes by our personnel or service providers in various locations, always subject to appropriate contractual and technical safeguards.

13. Changes to this Privacy Policy

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of this Privacy Policy, adding a statement to our homepage, by sending you an email, and/or by some other means. Please note that if you’ve opted not to receive legal notice emails from us (or you haven’t provided us with your email address), those legal notices will still govern your use of our Website and Products, and you are still responsible for reading and understanding them. If you use our Website and Products after any changes to the Privacy Policy have been posted, that means you agree to all of the changes. We encourage you to review this Privacy Policy periodically to stay informed about our practices.

Under CCPA, we are obligated to review and update our Privacy Policy annually, and we intend to comply with that requirement.

14. CCPA Practices

These additional disclosures for California residents (e.g. “consumers”) apply only to individuals who reside in California. The California Consumer Privacy Act of 2018 (“CCPA”) provides additional rights to know, delete and opt out, and requires businesses collecting or disclosing Personal Data to provide notice of rights California residents have and can exercise.

California Notice of Collection: We have collected Personal Data corresponding to the following categories of information enumerated in the CCPA:

Identifiers, including name, address, email address, account name, IP address, and an ID number assigned to your account.

Analytics and Advertising, including engagements with our Website and Products.

Internet activity, including history of visiting and interacting with our Website and Products, browser type, browser language, and other information collected automatically.

Geolocation data, including location-enabled services such as WiFi and GPS.

For more information on what we collect, please review Section 3 above. We collect and use these categories of Personal Data for the business purposes described in Section 4 above.

We do not sell information as the term “sell” is traditionally understood. However, to the extent “sale” under the CCPA is interpreted to include advertising technology activities such as those disclosed in Section 4 entitled “How do we collect and use your Personal Data?”, we will comply with applicable law as to such activities.

SQLWATCH discloses the following categories of Personal Data for commercial purposes to its service providers and partners:

Commercial Information, User Records, Demographic Data, Location Data, Identifiers, Inferences, Internet activity

We use and partner with different types of entities to assist with our daily operations and manage the SQLWATCH Products and Website. Please review Sections 4, 10, and 11 for more detail about the parties with whom we share information.

Right to Know and Delete: If you are a California resident, you have the right to know certain information about our data practices in the preceding 12 months. In particular, you have the right to request the following from us:

The categories of Personal Data we have collected about you.
The categories of sources from which the Personal Data was collected.
The categories of Personal Data about you that we disclosed for a business purpose or sold.
The categories of third parties to whom the Personal Data was disclosed for a business purpose or sold.
The business or commercial purpose for collecting or selling the Personal Data.
The specific pieces of Personal Data we have collected about you.

In addition, you have the right to delete the Personal Data we have collected from you. However, this is not an absolute right, and we may have legal grounds for keeping such data.

To exercise any of these rights, please submit a request to [email protected].

In the request, please specify which right you are seeking to exercise and the scope of the request. We will confirm receipt of your request within 10 days. We may require specific information from you to help us verify your identity and process your request. If we are unable to verify your identity, we may deny your requests to know or delete.

Authorized Agent: You can designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent’s permission to do so and verify your identity directly.

Right to Non-Discrimination: You have the right to non-discriminatory treatment by SQLWATCH should you exercise any of your rights.

As a UK-based company, SQLWATCH LTD is primarily governed by UK data protection law, including:

The UK General Data Protection Regulation (UK GDPR) as retained in UK law;
The Data Protection Act 2018; and
The Privacy and Electronic Communications Regulations (PECR)

For our European Union customers, we also comply with the EU General Data Protection Regulation (EU GDPR). While the UK maintains adequacy decisions facilitating data transfers with the EU, we implement appropriate safeguards including Standard Contractual Clauses for international data transfers where required by law.

Location of Processing: SQLWATCH primarily processes and stores your Personal Data on servers located and operated within the United Kingdom. If you reside or are located outside of the UK, we may send and store your personal data in the UK in order to provide and operate the SQLWATCH Cloud platform.

Your Rights Under UK Data Protection Law: Under UK GDPR, you have the following rights regarding your Personal Data:

Right of access - to obtain confirmation that your data is being processed and access to your personal data
Right to rectification - to have inaccurate personal data corrected
Right to erasure - to have your personal data deleted in certain circumstances
Right to restrict processing - to limit how we use your personal data
Right to data portability - to move, copy or transfer your personal data
Right to object - to object to certain types of processing
Rights related to automated decision making - to challenge decisions made without human involvement

Data Controller: In limited circumstances, where SQLWATCH processes your Personal Data as a data controller, you are entitled to exercise the privacy rights outlined above.

Automated Decision-Making: SQLWATCH does not make automated decisions that produce legal or similarly significant effects concerning you based solely on automated processing of your Personal Data.

Complaints: If you’re unhappy with how we process your Personal Data, you may complain to:

UK customers: Information Commissioner’s Office (ICO) - ico.org.uk or 0303 123 1113
EU customers: Your local data protection authority

If you wish to exercise any of your privacy rights under GDPR or UK data protection law, or if you need further information regarding those privacy rights, please contact us at [email protected].

16. Managed Service Providers and Multi-Tenant Usage

For Managed Service Providers (MSPs): If you’re an MSP using our services to monitor client systems:

Your Role: You act as a data processor for your clients’ monitoring data
Client Consent: You must obtain appropriate consent/contracts with your clients to allow us to act as a sub-processors of that monitoring data, including where it arises any Personal Data
Data Segregation: We maintain separate workspaces to prevent data mixing
Client Rights: You’re responsible for handling your clients’ personal data subject access requests
Termination: You must promptly remove any client data when your service relationship ends

Data Processing Roles:

MSP ↔ SQLWATCH: You are data processor, we are data sub-processor
End Client ↔ MSP: Your clients are data controllers, you may be data processor
End Client ↔ SQLWATCH: We process end client data only on your instructions

Cross-Border Considerations: If you’re monitoring clients in different countries:

Ensure compliance with all applicable data protection laws
Consider data residency requirements of your clients
Implement appropriate transfer mechanisms for international data flows.

17. Notices

Exercising Your Privacy Rights:

Data Protection Officer Contact:

Email: [email protected]
Response Time: We will respond to all privacy requests within 30 days (or 1 month under GDPR)
Verification: We may require identity verification before processing certain requests

What to Include in Your Request:

Clear description of your request (access, deletion, correction, etc.)
Sufficient information to identify your account
Specific data or processing activities you’re concerned about
Your preferred method of response

Escalation: If you’re not satisfied with our response, you may:

Contact our Data Protection Officer for review
Lodge a complaint with the relevant data protection authority
Seek legal advice regarding your rights

General Contact Information:

Address: SQLWATCH, Innovation Centre Innovation Way, Heslington, York, North Yorkshire, YO10 5DG, United Kingdom.

For general support inquiries, please use: [email protected]