Privacy

Nick Mudie, based in the United Kingdom, operates BSS/OSS Academy and is the data controller for the personal data described here under both the UK GDPR and, for readers in the European Economic Area, the EU GDPR. Questions, access requests and complaints go to nickymudie@hotmail.com.

No representative in the EU has been appointed under Article 27 GDPR: the processing here is occasional, involves no special-category or criminal-offence data, and is unlikely to result in a risk to anyone’s rights, which is the exemption in Article 27(2)(a). That assessment is reviewed whenever this page is.

Usage analytics

For every page view: the path, the referring site’s hostname, a country code, and a visitor identifier. The identifier is a salted SHA-256 hash of your IP address and browser user-agent, recomputed with a new salt input every day — the IP address itself is never written to storage, and the hash cannot be reversed or matched across days. Views are counted in probabilistic sets, so the platform can say how many different visitors a day had but not list them.

Account details

For reviewer and administrator accounts only: a username, an email address, and a bcrypt hash of the password. Passwords are never stored or logged in readable form. There are no public accounts.

Sign-in records

For each sign-in attempt: the event type, a hash of the identifier used, the originating IP address, and the browser user-agent. Kept for ninety days and capped at the most recent 200 events, whichever cuts first.

Feedback you submit

The name, role and text you type into the feedback form. Name and role are optional, and everything you enter there is intended for publication on this site once approved.

Quiz results

A display name of your choosing, your score, and the difficulty level, on a public leaderboard. The name is free text — you are not asked for, and should not enter, a real one.

The Telco Ecosystem map names the chief executives and technology, digital, commercial and network leaders of some of the organisations it covers: name, title, the organisation, the dates of the role where a public source states them, and a one-line description of the responsibility. This is personal data about people who are not readers of this site, so Article 14 GDPR applies and this is the notice it requires.

Every entry is taken only from the organisation’s own leadership page, appointment announcement or annual report, and each one cites its source. Nothing is inferred, and nothing is taken from social media or a data broker. The basis is legitimate interest (Article 6(1)(f)): an accurate, sourced picture of who leads the industry’s organisations, limited to roles those people hold publicly and to facts their employers have themselves published. A person who moves on is shown with the end date, not removed, so the history stays readable.

If you are named and want an entry corrected, its source questioned, or the entry removed, write to nickymudie@hotmail.com. Objections are honoured unless a compelling reason to keep the entry can be shown, and a correction with a source is made within days.

There are no third-party analytics, advertising, or tag-management scripts on this site. Nothing is shared with an advertising network, a data broker, or a social platform. No cross-site tracking takes place, and no profile is built about you. Fonts, organisation logos and the pictures in Telco Insight are all served from this site’s own domain, so loading a page does not tell any other company that you were here.

One cookie is set, and only after you sign in: bssoss_session, which holds your signed session and expires after eight hours. It is strictly necessary to keep you signed in, so no consent banner is shown for it. Nothing else on the site sets a cookie.

The site keeps a few things in your browser’s own storage. Only the first is ever sent to the server; the rest exist for features you use:

Page-view count

A random per-tab id, sent with each page view so the platform can count pages per visit, and a per-day marker so a page is counted once per visit, not on every refresh. Both live in session storage and die with the tab; the server keeps the id only inside that day’s probabilistic set, from which it cannot be read back.

Your preferences

The Telco Ecosystem map’s layers, style and panel state; which quick-guide variant you saw; whether you have used full screen; the challenge profile you filtered by; which announcements you have dismissed.

Your work

Items you save in Telco Insight, progress through the real-life challenges, the state of the Billing Migration simulator, and any capability-heatmap edits on the eTOM mapping page.

All of it stays in your browser and is cleared when you clear site data. None of it identifies you, and none of it is read by anyone but the page you are looking at.

Videos in Telco Insight are embedded from YouTube’s privacy-enhanced domain and load only when you press play. Until then YouTube is not contacted; when you do, YouTube receives your IP address and applies its own privacy policy.

Analytics are processed on the basis of legitimate interest (Article 6(1)(f)) — understanding which material is used, in a form that cannot identify you. Account and sign-in records are processed to operate the service and to detect credential-guessing, which is both a legitimate interest and a security obligation under Article 32. Feedback and quiz entries are processed on the basis of your consent (Article 6(1)(a)), given by submitting the form and withdrawable by asking for the entry to be removed. Named leadership is explained above.

Analytics

Aggregated daily counters, deleted automatically after 400 days.

Sign-in records

Ninety days, and never more than the most recent 200 events.

Sessions

Eight hours, or until you sign out.

Accounts

Until the account is deleted on request or by an administrator.

Feedback

Until you or an administrator asks for it to be removed.

Quiz results

The most recent 50 attempts only.

Named leadership

While the person holds, or has held, a role the map covers; removed on a well-founded objection.

These companies process data on the operator’s behalf, under their standard data processing terms. Where a transfer leaves the UK or the EEA it rests on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses in those terms.

Vercel

Hosts the site and its serverless functions, and terminates every request — so it sees your IP address in transit, as any host must. Vercel also supplies the country code used in analytics. A United States company with edge locations worldwide.

Vercel KV (Redis)

The managed Redis database that holds every item in the tables above.

Anthropic

Provides the Claude model that drafts Telco Ecosystem signals from public web pages and from sources an editor supplies, and that summarises organisations from their own published reports. It receives the text of those pages and documents — which may include the names of executives named in them — and never anything about readers of this site. API data is not used to train Anthropic’s models. United States.

Resend

Sends the operator a daily email of aggregate usage figures — totals and top pages, nothing about any individual. United States.

YouTube (Google)

Only when you press play on a video, as described above. Not a processor: Google acts on its own account once you start a video.

No other company receives any data from this site.

Under the GDPR you can ask for a copy of the personal data held about you, ask for it to be corrected or erased, ask for processing to be restricted, object to processing based on legitimate interest, and withdraw consent for anything given on that basis. Write to nickymudie@hotmail.com and it will be actioned within one month. There is no charge, and no account is needed to ask.

Note that analytics data is deliberately not linkable to an individual, so it cannot be retrieved or deleted per person — that is a consequence of collecting it in a form that does not identify you.

If you are not satisfied with how a request was handled, you can complain to a supervisory authority: in the UK the Information Commissioner’s Office (ico.org.uk), and in the EEA the authority of the country where you live or work — the European Data Protection Board lists them at edpb.europa.eu.

Material changes will be reflected in the date at the top of this page. See also the terms of use.