Portal privacy notice

Who is responsible

AXIS Utility Group Ltd is registered in England and Wales under company number 16966025. Registered office: 1 Cold Ashby Road, Guilsborough, Northampton, England, NN6 8QN.

AXIS is a controller for its own account administration, business communications, service security and legal records. For site information processed on a client’s documented instructions, AXIS generally acts as a processor and the commissioning organisation is the controller. The service and data processing agreements must identify the actual roles before project collection starts. Providing management oversight may create additional controller responsibilities for specific activities; these must be identified expressly.

Contact info@axisutility.co.uk for privacy requests, or support@axisutility.co.uk for account and device assistance. Your project administrator can identify the project controller and its privacy notice.

Information handled

Account information includes your name, work contact details, organisation, roles, project membership and authentication/security records. Project information may include attendance, briefings, electronic signature names or strokes, acknowledgements, observations, photographs, documents, tasks, actions, programme updates and audit history. Records can identify the author, reviewer, recipient and time of an action.

Information comes from you, your organisation, authorised project contributors and connected services you or the authorised owner enable. Photographs and uploaded files may contain other people or location/document metadata; check them before uploading. Do not upload unnecessary sensitive information.

Health, injury or other special-category information must only be collected for an authorised project purpose with an appropriate Article 9 condition and restricted access. The controller must identify that condition and any required safeguards before collection. Employment consent is not assumed merely because a worker uses the portal.

Purposes and lawful bases

AXIS uses account and service-security data to administer access, deliver the agreed service, prevent misuse, investigate incidents and maintain evidence. Its legitimate interests are secure operation, account administration and defending its legal rights, balanced against individuals’ rights. Where you contract personally with AXIS, requested contractual steps or performance may apply. Legal obligations are relied on where a specific obligation requires processing.

For client-directed project processing, the controller determines and documents the purposes, lawful bases, any special-category condition and the information workers must provide. AXIS processes that information under the agreed instructions. Contracting with an employer does not automatically make contract the lawful basis for every worker’s data.

Portal terms acceptance is evidence of an individual’s action, not consent to marketing, AI training or general reuse of project information.

Access and service providers

Access is limited by account and project permissions. Authorised AXIS personnel, your project organisation, assigned reviewers and authorised recipients may access relevant records. Where instructed or legally required, records may be shared with clients, asset owners, regulators, professional advisers, insurers or parties dealing with a legal claim.

The current service uses OpenAI Sites and Cloudflare for application hosting and infrastructure, Supabase for the portal database, authentication and file storage, and email-delivery providers supporting account communications. Connected Google Workspace services process imported or synchronised information when those functions are enabled. AXIS keeps a provider register and confirms the applicable subprocessors in the project data processing schedule.

AXIS does not sell portal personal information. Publication of photographs, testimonials or case studies requires a separate authorised decision; granting project access is not permission to use records in advertising.

Locations and international processing

The current primary portal database is configured in London, United Kingdom. Hosting networks, support, email and connected providers can involve processing outside the UK; the database region is not a promise that all processing stays in the UK.

For any restricted transfer AXIS is responsible for, AXIS must identify a valid UK adequacy basis or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum where applicable, and complete the required assessment. The actual provider agreement, locations and safeguards must be recorded in the project data processing schedule before that processing starts. Contact info@axisutility.co.uk for the arrangements and a copy of applicable safeguards, subject to permitted redactions.

Retention and project closure

Active account information is retained while access is needed. When access is withdrawn, login access is disabled; attribution on existing project, security and acceptance records may remain where necessary for accountability, legal obligations or claims. Disabling an account is not the same as deleting its historical records.

Project records are retained for the project duration and the post-completion period specified in the project retention schedule. The controller must set that period by record type and legal/contractual purpose before onboarding. At completion, AXIS and the controller review exports, attachment completeness, continuing access, legal holds and an authorised deletion or anonymisation date. There is no single retention period suitable for every project or every record category.

Security, contract and terms-acceptance records are reviewed when access or the agreement ends and retained only for identified security, accountability or legal-claim purposes. A documented dispute or legal hold can postpone disposal. Backup expiry and offline copies must be considered separately. Current preservation controls do not automatically delete records merely because they reach a certain age; disposal requires an authorised review and the applicable process.

Offline and connected copies

The portal can store prepared project information, drafts and queued photographs in an encrypted device database after you enable offline working. Offline access must be refreshed online after seven days. That access expiry does not delete queued work. Browser data removal, device loss or a lost offline passphrase can make unsynchronised records unrecoverable.

Google imports, notes, tasks and calendar synchronisation create or use copies under the connected account’s arrangements. Disconnecting an integration does not automatically erase copies already held in either system. The cookies and device-storage notice explains local storage and safe removal.

Your rights and complaints

Depending on the purpose and lawful basis, you may request access, correction, erasure, restriction or portability, and object to legitimate-interest processing. Where processing actually relies on consent, you may withdraw it. Rights are subject to applicable conditions; erasure may be limited where records are needed for a legal obligation or legal claim.

Contact AXIS or the relevant project controller. AXIS will help route project requests and assist the controller under its instructions. We normally respond to rights requests within one month; permitted extensions, identity checks or applicable exceptions will be explained. You may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/.

Required information and decisions

Account identification and authentication information are needed to provide controlled access. The project controller explains which site records are required and what happens if they are not provided. Avoid adding optional information that is unnecessary for the task.

AXIS does not use the portal to make solely automated decisions producing legal or similarly significant effects about individuals. Permission rules and workflow statuses support access and human decisions; they do not determine competence or employment eligibility.