UniverseRankTransparency
Data sharing register
Everyone who receives information from this platform, what they receive, why, on what basis, and whether the disclosure counts as a sale or a share. Published rather than kept in a compliance folder, because a register nobody can read proves nothing.
| Recipient | Type | Contains | Sale / share | Transfer | Records · 90d |
|---|---|---|---|---|---|
| Payment provider | processor | personal data | no | US | 0 |
| Transactional email delivery | processor | personal data | no | US | 0 |
| Public rankings API | public api | company only | no | domestic | 0 |
| Search engines and answer engines | third party | company only | no | cross-border | 0 |
| Advertisers receiving enquiries | controller | personal data | no | cross-border | 0 |
| Error monitoring | processor | company only | no | US | 0 |
Advertisers receiving enquiries . Why this is not a sale
Purpose: Pass on an enquiry the customer chose to send to that business
Categories: enquiry_contact, enquiry_detail
Basis: CONSENT · processor_terms
Transfer: under derogation
Safeguards: Only what the customer typed. Recipient named on the form before sending.
Retention: Held by the recipient; we retain the thread for dispute handling.
Reasoning: The customer initiated the contact and knows who receives it. Disclosure at the individual’s direction is not a sale.
Payment provider . Why this is not a sale
Purpose: Take payment for advertising placement and enquiry credit
Categories: billing_contact, transaction
Basis: CONTRACT · DPA
Transfer: US under SCC
Safeguards: Contractual processing terms, no independent use, deletion on termination.
Retention: Kept for the statutory financial-records period.
Reasoning: A processor acting on documented instructions, for a purpose the customer asked for. Not a sale.
Transactional email delivery . Why this is not a sale
Purpose: Send digests, enquiry notifications and privacy-request replies
Categories: business_contact, subscriber_email
Basis: LEGITIMATE_INTEREST · DPA
Transfer: US under SCC
Safeguards: No onward use, no profile building, suppression list honoured.
Retention: Until unsubscribe, then a suppression record only.
Reasoning: Delivery on our instructions only. The provider may not use addresses for its own purposes.
Error monitoring . Why this is not a sale
Purpose: Diagnose failures
Categories: technical_logs
Basis: LEGITIMATE_INTEREST · DPA
Transfer: US under SCC
Safeguards: No raw IP addresses, no request bodies, short retention.
Retention: 30 days.
Reasoning: Technical diagnostics with identifiers stripped before transmission.
Public rankings API . Why this is not a sale
Purpose: Publish company rankings and profiles for anyone to read
Categories: company_profile, business_contact, ranking
Basis: PUBLIC_SOURCE · none
Safeguards: Rate limited. Never returns advertiser spend or personal contacts.
Retention: Live data only; no historical personal snapshots served.
Reasoning: Company-level information published openly. No personal identifiers and no advertising identifiers are exposed.
Search engines and answer engines . Why this is not a sale
Purpose: Index public company and ranking pages so buyers can find suppliers
Categories: company_profile, ranking
Basis: PUBLIC_SOURCE · none
Transfer: under not_personal
Safeguards: robots.txt excludes dashboards, checkout, redirects and the API.
Retention: Not applicable.
Reasoning: Publication of company information, not disclosure of personal data for consideration.
How we behave by jurisdiction
20 configured| Where | Framework | We reply within | Opt-out | GPC |
|---|---|---|---|---|
| United Arab Emirates | PDPL | 30 days | offered anyway | honoured |
| Australia | Privacy Act | 30 days | offered anyway | honoured |
| Brazil | LGPD | 15 days | offered anyway | honoured |
| Canada | PIPEDA | 30 days | offered anyway | honoured |
| Switzerland | revFADP | 30 days | offered anyway | honoured |
| China | PIPL | 15 days | offered anyway | honoured |
| Everywhere else | WorldRank baseline | 15 days | required | honoured |
| European Union / EEA | GDPR | 30 days | offered anyway | honoured |
| United Kingdom | UK GDPR / DPA 2018 | 30 days | offered anyway | honoured |
| India | DPDP Act 2023 | 30 days | offered anyway | honoured |
| Japan | APPI | 30 days | offered anyway | honoured |
| Kenya | Data Protection Act 2019 | 30 days | offered anyway | honoured |
| South Korea | PIPA | 30 days | offered anyway | honoured |
| Nigeria | NDPA 2023 | 30 days | offered anyway | honoured |
| New Zealand | Privacy Act 2020 | 20 days | offered anyway | honoured |
| Singapore | PDPA | 30 days | offered anyway | honoured |
| Türkiye | KVKK | 30 days | offered anyway | honoured |
| United States (other states) | State privacy laws | 45 days | required | honoured |
| California | CCPA / CPRA | 45 days | required | honoured |
| South Africa | POPIA | 30 days | offered anyway | honoured |
These are the rules this platform enforces, not legal advice. The strictest configured rule is applied where a jurisdiction is unknown.