PRIVACY POLICY

Sovereign Limits — International Mapping

Effective 27 July 2026

This Privacy Policy explains what personal information International Mapping Associates ("International Mapping", "we", "us") collects when you visit sovereignlimits.com or use the Sovereign Limits web portal (together, the "Site"), how we use it, who we share it with, and the choices you have.

International Mapping Associates has a place of business at 5300 Dorsey Hall Drive, Suite 201, Ellicott City, Maryland 21042, U.S.A. We are the controller of the personal information described in this Policy.

Your use of the Sovereign Limits web portal is also governed by the Tier 1 Annual Web Portal License Agreement.

§ 1 The short version

• We collect the minimum we need to give you an account, take payment, answer your questions, and keep the Site working.
• We do not use advertising trackers, third-party analytics, or social media pixels, and we do not track you across other websites.
• We do not sell or rent your personal information, and we do not share it for cross-context behavioural advertising.
• We never see or store your full payment card details — our payment processor handles those directly.

§ 2 Information we collect

2.1 Account information. To create an account you give us an email address. We sign you in with a one-time "magic link" sent to that address rather than a password, so we do not hold account passwords. We store your email address, the date your email was verified, your access tier, and the date you accepted our marketing disclosure at sign-up. If you tell us your name, we store that too.

2.2 Billing information. When you purchase a license, a Boundary Brief, or other item, our payment processor collects your payment card or other payment details, the billing name and address required to complete the transaction, and any tax identifiers. That information goes to the processor directly — it does not pass through our servers, and we do not store it. What we keep is the customer and transaction identifiers the processor gives us, and a record of what was purchased and when, so we can provide access, support the purchase, and meet our accounting and tax obligations.

2.3 Contact form and correspondence. If you use a contact form, we collect the name, company, country, telephone number, and email address you enter, along with your message. Contact form submissions are delivered to our staff inbox as email; they are not stored in the Site's database. If you email or call us directly, we keep that correspondence.

2.4 Newsletter sign-up. Our newsletter sign-up form is hosted by a third-party marketing platform. The email address and any other details you enter go to that platform under its own privacy notice, and we use them to send you the newsletter until you unsubscribe.

2.5 Technical information. Our servers and our network provider keep ordinary logs of requests to the Site: IP address, date and time, the page or file requested, HTTP status, referring page, and browser user-agent string. We use these to operate and secure the Site — to diagnose faults, block abuse, and investigate suspected unauthorised access or use of the Data.

2.6 Portal usage. Where you have a licensed portal account, we may keep records of access to and use of the Web Portal and of the documents and reports generated from it, to administer your license, enforce the license terms (including the single-workstation and no-third-party-access requirements), and protect the Sovereign Limits Database.

2.7 What we do not collect. We do not ask for and do not want special category information — such as health, biometric, genetic, racial or ethnic, political, religious, or trade union information, or information about your sex life or sexual orientation. We do not knowingly collect information from children (see § 10).

§ 3 Cookies and local storage

We use only what the Site needs to function. We do not use advertising or analytics cookies, and there is no third-party tracking on our own pages.

• Session and sign-in cookies. Set when you sign in, so the Site knows who you are on each request, and to protect sign-in forms against cross-site request forgery. Strictly necessary; the Site cannot keep you signed in without them.
• Local storage. Your light/dark theme preference and the contents of your shop cart are stored in your browser's local storage. They stay on your device and are not sent to us as identifiers.
• Third-party pages and embeds. Pages hosted by our payment processor and our newsletter platform, and any embedded third-party content, may set their own cookies under their own policies.

You can block or delete cookies in your browser settings, but if you block our session cookies you will not be able to sign in.

§ 4 How we use your information

We use personal information to:

1. create and administer your account and sign you in;
2. provide access to the Web Portal, the Sovereign Limits Database, and items you have purchased;
3. take payment, issue invoices and receipts, and keep accounting records;
4. respond to your enquiries and provide customer and technical support;
5. send you service messages about your account, your license, and its renewal;
6. send you product updates, news, and marketing where you have signed up or agreed to receive them at sign-up — you can unsubscribe at any time;
7. operate, secure, monitor, and improve the Site;
8. enforce our license terms and protect our rights in the Data, including investigating suspected unauthorised access, copying, publication, or use; and
9. comply with law and respond to lawful requests.

§ 5 Legal bases for processing

Where the UK GDPR or EU GDPR applies to you, we rely on the following legal bases:

• Performance of a contract — to create your account, provide portal access and purchased items, take payment, and provide support.
• Legitimate interests — to secure and operate the Site, to prevent and investigate misuse of the Site and of the Data, to keep business records, and to send business-to-business marketing about products related to what you already use. We balance these against your interests and rights.
• Consent — for newsletter and marketing email where consent is the basis, which you may withdraw at any time by unsubscribing.
• Legal obligation — to meet tax, accounting, and other legal requirements, and to respond to lawful requests.

§ 6 Who we share information with

We do not sell your personal information. We share it only as follows.

6.1 Service providers. We use a small number of providers who process personal information on our behalf, under contract and only on our instructions:

• Payment processing — to take payment, manage subscriptions and renewals, and prevent fraud.
• Email delivery — to send sign-in links, service email, and replies to your enquiries.
• Newsletter and marketing platform — to send the newsletter you signed up for.
• Hosting, content delivery, and network security — to serve the Site and protect it from attack.

6.2 Within International Mapping. Staff and contractors who need the information to do their jobs, subject to confidentiality obligations.

6.3 Legal and protective disclosures. Where we are required to by law, court order, or a valid request from a public authority; and where we reasonably need to in order to establish, exercise, or defend legal claims, including enforcing the license terms and protecting our rights in the Data.

6.4 Business transfers. If International Mapping is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. It would remain subject to this Policy or a notice at least as protective, and we would tell you if the transfer materially changed how your information is handled.

§ 7 International transfers

We are based in the United States and our servers and providers are located in the United States. If you are outside the United States, using the Site means your personal information will be transferred to and processed there, under laws that may differ from those in your own country. Where we transfer personal information out of the UK, the European Economic Area, or Switzerland, we rely on appropriate safeguards for that transfer, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

§ 8 How long we keep it

We keep personal information only as long as we need it for the purposes in § 4:

• Account information — for as long as your account exists, and then for a reasonable period afterwards to handle renewals, disputes, and license enforcement.
• Sign-in links and session records — sign-in links expire within 24 hours of being issued; session records expire and are removed when a session ends or lapses.
• Transaction and accounting records — for as long as tax and accounting law requires, typically at least seven years.
• Contact correspondence — for as long as we need it to deal with your enquiry and keep a record of our dealings with you.
• Server and security logs — for a short retention period appropriate to operating and securing the Site, longer where a log is relevant to an active security or license investigation.
• Marketing lists — until you unsubscribe, plus a suppression record so we do not email you again.

§ 9 Your rights and choices

9.1 Everyone. You can ask us to correct information that is wrong, ask us to delete your account, and unsubscribe from marketing at any time using the link in any marketing email or by writing to us. Unsubscribing from marketing does not stop service email about your account or license.

9.2 UK, EEA, and Switzerland. Subject to the conditions in applicable law, you have the right to request access to your personal information; to have it corrected or erased; to restrict or object to processing, including objecting to processing based on legitimate interests and to direct marketing; to receive a copy in a portable form; and to withdraw consent where processing is based on consent. You also have the right to complain to your data protection authority — in the UK, the Information Commissioner's Office — although we would like the chance to address your concern first.

9.3 California. Subject to the conditions in the CCPA/CPRA, you have the right to know what personal information we collect, use, and disclose about you and to receive a copy of it; to have it corrected; to have it deleted; to limit our use of sensitive personal information; and not to be discriminated against for exercising these rights. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of on those counts. You may use an authorised agent, and we will verify the request before acting on it.

9.4 Other jurisdictions. If the law where you live gives you similar rights, contact us and we will honour them so far as that law requires.

9.5 How to exercise your rights. Email us at the address in § 12. We will respond within the time the applicable law allows. We may need to verify your identity before acting on a request, and there are requests we may have to decline — for example where the information is our licensed Data or a trade secret rather than your personal information, or where we must keep a record by law.

§ 10 Children

The Site is intended for professional and institutional use and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

§ 11 Security

We use reasonable technical and organisational measures appropriate to the risk to protect personal information: encryption in transit, passwordless sign-in so there are no account passwords to steal, encryption of stored credentials for the services we integrate with, access controls limiting staff access to what they need, and network-level protection against attack and abuse. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information and the law requires us to tell you, we will.

§ 12 Contact us

Questions, requests, and complaints about this Policy or your personal information:

International Mapping Associates
5300 Dorsey Hall Drive, Suite 201
Ellicott City, Maryland 21042
U.S.A.

Email: limits@internationalmapping.com

§ 13 Changes to this Policy

We may update this Policy as the Site and the law change. The effective date at the top shows when the current version took effect. If a change materially affects how we handle your personal information, we will give notice on the Site and, where the law requires it, contact you directly. Continuing to use the Site after a change takes effect means you accept the updated Policy.