Website Privacy Notice

1. Controller, contact and scope

SHIKANOKO NETWORKS LTD, registered in England and Wales under company number 17131877, with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX, is the controller for the shared website and enquiry processing described here. We operate as Shikanoko Networks / SKNK, including SKNK Cloud. Contact [email protected] for privacy questions or rights requests.

This notice covers visits to our public website, product and network information, configuration and sharing tools, contact forms, general and IPv4 service enquiries, support correspondence, complaints, rights requests and necessary delivery and security records. It applies whether or not you place an order.

Additional processing for an actual service follows its service-specific notice. The existing RIPE order notice is reproduced below under “RIPE order privacy notice”, with its original text and version preserved. It explains application, identity, payment, signing, resource-registration and order-recovery processing; those requirements do not automatically apply to an ordinary website visitor. Cloud-specific information is at /cloud/privacy. This notice explains processing and does not seek blanket consent or amend an accepted contract.

2. Information we handle and where it comes from

Website requests: your device sends technical information needed to request and deliver a page, such as IP address, requested URL, request time, headers, browser or device information and, where supplied, a referrer. Delivery and security systems may generate response, error, threat or rate-limit information. A field passing through a system does not mean every layer stores it. We do not represent all website and supplier logs as containing no personal data.

Configuration tools: product selections are held in page state and may be reflected in the URL. Loading or sharing that URL can disclose those selections to the server, recipients of the link, browser history and relevant delivery systems. Copy controls write the selected link or configuration to your clipboard; your device controls how long it remains there. A product choice is not necessarily personal data on its own, but may become personal data when linked to a person or request. Keep personal information and secrets out of links.

Network tools process the ASN, IP prefix and related routing identifiers that you enter. Server-side queries send the relevant resource identifier to RIPEstat, the RIPE Database or PeeringDB as needed for the tool you request. Those providers receive the query and the technical request from our server. A public resource identifier may become personal data when linked to you; do not enter private contact information or secrets. Tool results may be cached according to the tool’s delivery settings.

Enquiries and reports: we receive the name, contact address, category, subject, message, relevant configuration and any material you choose to send. A shared contact form may also accept service, organisation, region and existing-resource information, and processes a security-verification token. Email correspondence can include its sender, recipients, headers, attachments and follow-up history. Delivery records may contain recipient, subject, status, time and provider identifiers; the fact that one application log masks a body does not erase the message in the mailbox or delivery service.

Sources are normally you and your device. We may receive relevant information from your authorised representative, another correspondent, a reporter or a delivery or security provider. We use third-party information only where necessary for the stated purpose and provide additional source and privacy information where the applicable law requires it. Do not send special-category information, identity documents, details about children or third-party personal data unless necessary and lawfully authorised.

3. Purposes and legal bases

We use necessary request and diagnostic information to deliver pages, maintain reliability, investigate faults, protect systems, prevent abuse and handle security incidents. Our legal basis is our legitimate interests in operating a secure and reliable website, subject to necessity, proportionality and your rights. We limit security information to what the risk and task reasonably require.

We process the resource identifiers needed to answer a network-tool query and return public network information. Our basis is our legitimate interests in providing the tool you request, limited to the query and proportionate delivery and security records. This is distinct from an application to RIPE NCC or an instruction to publish your personal data in the RIPE Database.

We use enquiry and correspondence information to answer you, assess a requested service, investigate an issue and manage appropriate follow-up. Where you personally request steps towards a contract, the basis may be those pre-contractual steps. For general questions, organisational contacts and authorised representatives, we normally rely on our legitimate interests in responding and managing the relationship, rather than treating every contact as personally party to a contract.

We handle rights requests, required disclosures and records under the legal duties that actually apply. Necessary complaints, evidence and claims processing may also rely on legitimate interests or a specific legal obligation. We identify the relevant duty rather than treating all records as subject to one unspecified retention law.

Where we rely on consent for an optional purpose, we explain that purpose and obtain the required choice before processing. An enquiry is not a marketing subscription; accepting terms or acknowledging a cookie notice is not general consent. You may withdraw consent without affecting the lawfulness of earlier processing. We do not sell personal data, and we do not use an enquiry as permission for unrelated advertising.

4. What you need to provide

You can read public product information without submitting a contact form. Technical requests are necessary to deliver pages, and blocking necessary request or security functions may prevent some features from working. You decide whether to contact us or share a configuration. A required reply address and enough information to understand a request are needed if you expect a response; without them we may be unable to reply, verify authority or resolve the issue.

Optional form fields and unnecessary attachments are not a condition of merely browsing. We ask for additional verification only when proportionate to a specific request. Do not send credentials or complete payment-card information. If sensitive evidence is necessary, request a suitable protected channel first.

5. Cookies, browser storage and measurement

NEXT_LOCALE is a first-party session cookie for language routing. The current website sets it for the site path with SameSite=Lax and Secure in production; it has no fixed application expiry beyond the session, although browser session-restoration behaviour can differ. The theme localStorage entry remembers appearance, and cookie_consent remembers acknowledgement of the notice. Those localStorage entries have no application expiry and remain until changed or removed in the browser. The acknowledgement entry is not an analytics or marketing opt-in.

Configuration state, configuration URLs, browser history and clipboard contents are separate from those preferences. You can clear site cookies and localStorage, remove history and replace or clear the clipboard through your browser or device. Clearing preferences may reset language or appearance. The Cookie notice control in the footer reopens the acknowledgement by clearing its stored flag; it does not by itself switch analytics on or off.

The public website uses Cloudflare delivery and security services, and Cloudflare performance measurement may be supplied through a beacon. Measurement remains a separate activity even where it uses no cookie. A script appearing in a page does not establish that every browser successfully ran it. We distinguish delivery and security processing from optional analytics. Where consent is required, optional browser analytics or marketing must not be activated until the required opt-in has been obtained; where an applicable law permits a specific exception, its transparency, purpose and objection conditions must be met. We do not treat continued browsing, closing a notice or an acknowledgement flag as that consent.

Necessary anti-bot verification may process browser and security signals under the applicable Cloudflare terms. Cookies for a separate payment, private order or admin workflow are explained in the notice for that workflow; browsing a public page is not a request to start one. If a new optional tool is introduced, its purpose, provider, information and controls must be explained before activation. You may ask about measurement or object to discretionary processing through [email protected], without losing the right to a more immediate choice required by law.

6. Who receives information

Access is limited to authorised company personnel and providers for their assigned tasks. The current website hosting provider is IONOS SE, a German service provider. It supplies the infrastructure on which website requests and necessary operational records are processed. Cloudflare supplies delivery, network security, anti-bot verification and relevant performance functions. Those functions process technical request or security information; our anti-bot verification request does not send the enquiry message fields merely to validate the token.

Brevo delivers shared contact-form notifications and transactional correspondence and receives the sender or reply-to details, recipients, subject, message and necessary delivery metadata for that task. The current email integration disables open and click tracking by default. Microsoft 365 receives and holds company correspondence in the company mailbox environment. Authorised personnel handling the relevant request can see the necessary message and attachments. Sending an email also involves the mail services selected by you and other correspondents.

DataRep receives information when a privacy or representative matter is sent or referred to it within its appointment. Where necessary, a limited disclosure may be made to professional legal or accounting advisers, insurers, competent authorities or a lawful successor for the particular purpose and subject to confidentiality and legal safeguards. We do not make all records available to every provider or disclose private enquiries publicly by default.

Providers may act as processors for assigned tasks and may act as separate controllers for specific activities under their own terms. A software product name does not make its author a recipient. Stripe, DocuSeal, RIPE NCC or a VM-management platform is not made a recipient of a public website visit merely because it supports another service. Company-controlled mail archives and protected recovery copies remain subject to the purpose, access and retention limits in this notice.

7. International processing and safeguards

The controller is a UK company. Hosting is supplied by IONOS SE, a German provider; company mail uses Microsoft 365, transactional delivery uses Brevo, and delivery and security use Cloudflare’s international infrastructure. Authorised company personnel handle support and administration from China and Switzerland. A supplier’s registered country or a proposed VPS location is not a statement that every record, backup, network request or remote access stays there. Provider support and subprocessors may operate in further countries, including the United States, as described in the applicable provider processing and subprocessor terms.

Each disclosure or access arrangement must be assessed to determine whether it is a restricted transfer under the law that applies, including whether the recipient is a separate organisation. Work by personnel of the same legal controller is assessed separately from disclosure to an overseas contractor or other entity; confidentiality, necessity and security duties continue in either case. We do not treat access from China as covered by a European adequacy decision, or assume that a server location alone resolves transfer duties.

Where a restricted transfer requires protection, it must use an applicable adequacy arrangement or appropriate safeguards, such as the relevant EU Standard Contractual Clauses and UK transfer addendum or agreement, with the required assessment and supplementary measures. We do not rely on browsing the website as consent to routine restricted transfers. The safeguard must match the actual recipient, role and destination; there is no claim that one contract or certification covers every provider and access path.

Cloudflare’s published customer DPA describes its EU SCC and UK-addendum arrangements for applicable restricted transfers. Microsoft publishes the Products and Services DPA for Microsoft 365; Brevo and IONOS publish their applicable processing and subprocessor information. The relevant arrangement must cover the actual service, role and destination we use. You can request information about the arrangement that applies to your records and a copy of relevant safeguards at [email protected]. We provide it subject only to proportionate redaction for other people’s rights, security or protected commercial information; this request route does not replace the disclosures above.

8. Retention and deletion

We decide retention by record type and purpose, rather than applying one period to all website data. Browser preferences, configuration links, history and clipboard information follow the behaviour in section 5. Provider delivery, security and diagnostic records follow their assigned purpose and applicable service controls; we distinguish transient checks, operational metadata and copies kept as evidence.

Enquiry correspondence is retained while the matter is open and for a justified follow-up period. At closure we assess whether further correspondence, an unresolved complaint, a specific security investigation, a legal duty or an actual or reasonably anticipated claim requires particular records. We remove information that no longer has such a purpose, minimise unnecessary attachments and duplicates, and retain only the material needed for a separately justified duty or claim. A possible unspecified future use is not a reason for indefinite retention.

Security and delivery records are retained only for the period needed to investigate failures, enforce the relevant security window and resolve identified incidents, with longer evidence retention justified separately. A provider’s maximum available history does not by itself justify keeping all records for that long. Closing an enquiry, cancelling renewal or expiring a token does not automatically erase every independent record, nor does it justify keeping it without review.

Specific legal holds restrict deletion only for their documented scope and duration. Protected backup or mailbox-recovery copies follow their applicable lifecycle and access restrictions; valid deletion decisions are carried forward if records are restored. A provider’s deletion delay does not remove our duty to handle the request and explain any lawful limitation. We do not promise an unverified automatic deletion day or apply RIPE contract, tax, signing or recovery periods to every website record. If an enquiry becomes an actual service or accounting record, its applicable notice and documented legal basis determine the additional retention.

9. Security and automated checks

We use proportionate organisational and technical measures, including restricted access, authentication, protected communications, minimisation and appropriate recovery controls. The measures must reflect the data, purpose and risk; no system can promise absolute security. Report suspected exposure to [email protected] without sending additional secrets. Where a breach requires notification to an authority or affected people, we follow the applicable duties and deadlines.

Automated anti-bot checks, rate limits and security rules can reject or delay a request to protect the website. A failed check may prevent form submission; you can contact us by email for human assistance. We distinguish those controls from a solely automated decision producing legal or similarly significant effects. If such significant decision-making is introduced, we must first provide the required information about its use, relevant logic, consequences and available human intervention or challenge under the applicable law. Ordinary website use is not consent to such a decision.

10. Your rights and how to exercise them

Subject to the law that applies, you may request access and a copy, correction, erasure, restriction and, where the conditions are met, data portability. You may withdraw consent for processing based on consent.

Your right to object: You may object to processing based on legitimate interests for reasons relating to your situation. We then stop that processing unless the law permits us to continue on demonstrated overriding grounds or for legal claims. You may object to direct marketing at any time; that objection is not subject to an overriding-interest test.

Send a request to [email protected], identifying the issue and enough information to locate your records. We ask only for proportionate additional identity or authority evidence where needed. You do not need to buy a service, use a particular form or contact a representative first. Requests are normally free; a fee or refusal is used only where law permits it and is explained.

We respond without undue delay and within the applicable legal period, normally one calendar month for GDPR rights requests. Any lawful extension and its reason are communicated within the required initial period. A restriction, refusal or need to retain particular records is assessed individually and explained, with complaint or remedy information. A general retention schedule is not a reason to refuse every request.

11. Representatives and complaints

You may contact the company directly. DataRep is the appointed data-protection representative for SHIKANOKO NETWORKS LTD, trading as SKNK / SKNK Cloud / IPIP.one, within the EU/EEA, UK and Swiss written appointments. Privacy requests may be sent to [email protected] or https://www.datarep.com/data-request, identifying the company and relevant service.

Representative postal addresses and the separate DSA channel are listed in the contact sections below. Address correspondence to DataRep and identify SHIKANOKO NETWORKS LTD and the relevant service.

DataRep is a representative, not a statement that we have appointed a DPO or received a general compliance certificate. Its DSA address, [email protected], is a separate channel and is not the privacy-request mailbox. DSA representative details are at /privacy#dsa-representative.

You may complain to the UK Information Commissioner through https://ico.org.uk/make-a-complaint/ or to another competent supervisory authority, including the authority for your habitual residence, workplace or alleged infringement where applicable. Swiss matters may also be raised with the Federal Data Protection and Information Commissioner at https://www.edoeb.admin.ch/. You retain applicable court and other remedies and do not have to contact us or DataRep before a regulator.

12. Changes and future services

This website notice is version 1.1, dated 27 October 2026. We retain relevant prior notices and update this notice when purposes, recipients, tools or arrangements change. Material changes are communicated as required before the relevant new processing, and any required consent or other lawful basis is obtained. A website update does not retrospectively make earlier processing lawful or convert an enquiry into consent to a new purpose.

Existing service notices and accepted orders keep their own versions. Before introducing new processing, we identify the additional data, purposes, roles, recipients, locations, safeguards, retention and exit arrangements. Cloud ordering, payment and service activation remain unavailable. Before hosted workloads begin, the relevant service notice and any required data-processing agreement must cover them; this website notice does not replace that agreement.

The full Chinese translation accompanies the English notice. A translation or contract-language clause does not reduce a person’s mandatory privacy rights. Contact [email protected] if an explanation is unclear or you need an accessible version.

13. Optional Telegram communication

When this optional channel is enabled, you may choose to open SKNK Assistant in Telegram to view explicitly linked order summaries, select updates or leave a text enquiry. Merely reading our website does not create a bot subscription. The website and its ordinary correspondence channels remain available if you do not use Telegram. Using the bot is not a marketing subscription and does not amend an accepted order or agreement.

If you start or interact with the bot, we receive the Telegram numeric user ID and private-chat ID, display name, username where supplied, language information, message or callback identifiers, interaction times and the text you submit. We store the necessary account-to-order permission, notification choices, text-enquiry records and limited processing, security and delivery metadata. We use this information to provide the interaction you request, verify the permitted scope, respond to enquiries and maintain the channel under the purposes and applicable bases in section 3.

Binding or changing the Telegram recipient requires a one-time code sent to the original notification email. You enter the email and code in the official SKNK Assistant conversation; a website cookie, Telegram username, order number or matching email string alone does not prove control of the mailbox. Successful verification associates the currently supported existing orders using that verified notification email; orders created later are not automatically linked. The email address and necessary verification result and security records are used for this authorisation check. Enter a code only in the official bot conversation you started, and do not give it to another bot or person. The bot reads permitted order references, products, progress, next steps and separate payment, signing, archive, refund and renewal states. It does not receive a general website login. This module does not copy identity documents, signed files or payment credentials from the website into Telegram; its first release does not download Telegram attachments. Do not put sensitive evidence or credentials in a bot message. Use a suitable protected website channel if those materials are necessary.

Messages you submit for human assistance may be shared with authorised staff in a private Telegram support group so they can handle and reply to your enquiry. Members of that group can read those messages. Replies to a new general enquiry are sent to your bot conversation by default unless you have paused notifications. For order-specific support, reply alerts follow your selected order settings; you can review or change them before submitting. This does not subscribe you to marketing or order updates. Information you send through Telegram, and the order summaries or replies we send there, passes through Telegram and may remain in your Telegram account and devices. Telegram processes its platform and message data under its own terms and privacy policy at https://telegram.org/privacy. We do not claim a particular country of storage, a verified transfer arrangement or an end-to-end encrypted channel for this bot. This optional channel does not replace the website for payment, signing, formal documents or verified service instructions.

Proactive order and support-reply updates require the choices offered for that order or enquiry. You can pause proactive alerts with /stop, change the offered settings, or disconnect an order through the bot. /start does not restore previously paused alerts. Disconnecting removes future bot access to that order and stops applicable unsent updates; it does not cancel an order, stop renewal by itself or delete formal business records. Messages already accepted by Telegram, in-flight messages, device notifications and copies held by you or Telegram cannot be reliably recalled by disconnecting.

The current retention policy clears processed incoming-message copies and terminal outgoing-message content after seven days through maintenance, while retaining limited deduplication and processing metadata for up to 90 days. An unresolved group delivery with an unknown result and the associated records needed to investigate it may be retained longer until reviewed; it is not automatically resent. Abandoned draft content has a short validity period and is removed by maintenance after expiry. Unprocessed messages awaiting staff review are retained for that review rather than silently cleared after seven days. The body of a completed general enquiry is removed by maintenance 180 days after closure; this does not automatically erase its necessary case metadata. Active account, permission and audit records are reviewed according to the continuing service, security purpose and any rights request rather than being promised one universal automatic deletion date. Protected backups and valid holds follow the retention and restoration rules in section 8.

For access, correction, objection or deletion requests concerning our bot records, contact [email protected] or use the representative channels below. We may need proportionate verification of the Telegram account, website order access or your authority. We assess our copies separately from Telegram-held copies and explain any necessary retention of contracts, invoices, signed files, complaints or evidence. Telegram-side account and message controls are exercised through Telegram. Ordinary channel logs are intended for limited identifiers and error classes, not the text of your enquiry, identity evidence, website session credentials, one-time verification codes, verification secrets or Bot Token. Verification secrets are not written to bot records or ordinary logs.