Privacy notice — customers and website visitors
Status: Draft for legal review. Not yet published. Version: 0.1 draft · Date: 7 September 2026 · Next review: within 12 months of publication Controller: Axxo · Contact: privacy@axxointel.com Public location when published: https://axxointel.com/privacy
This notice covers people who visit our website, subscribe to our service, or use a workspace we host. If you appear in our procurement data rather than being a customer of ours, the Transparency Notice at axxointel.com/transparency covers you instead — that is a different notice because it is a genuinely different situation, and folding the two together would obscure the one that matters more.
What we collect, and why
| What | Why | Lawful basis | How long |
|---|---|---|---|
| Name, work email, organisation, role of workspace users | Creating and running your account; authentication; support | Performance of a contract | For the life of the account, then deleted on the schedule in your agreement |
| Workspace membership, seats, roles and invitations | Access control and tenancy | Performance of a contract | As above |
| Saved views, lists, annotations, notification and report preferences | Delivering the features you use | Performance of a contract | As above |
| Sign-in events, IP address, session and audit records | Security, fraud prevention and accountability | Legitimate interests — securing the service | Security and audit retention period, defined in our security policy |
| Report generation and download records | Entitlement enforcement and audit | Legitimate interests, and legal obligation where retention is required | With the audit record |
| Billing contact and invoice records | Invoicing and statutory accounting | Contract, and legal obligation | Six years from the end of the financial year, per accounting requirements |
| Support correspondence | Answering you | Contract, and legitimate interests | While needed for the issue, then on the support retention schedule |
| Error diagnostics | Keeping the service working | Legitimate interests | Short-term, scrubbed |
| Enquiry form and email correspondence | Responding to you | Legitimate interests | 24 months from last contact |
What we do not do
We do not sell your data. We do not share it with advertisers. We run no advertising network, no session-replay tool and no third-party analytics in the product. We do not use your workspace activity to train an AI model, and there is no AI provider in the product's data path.
Your workspace content — your saved lists, annotations and preferences — stays in your workspace. It never becomes part of the market data we publish to anyone else.
Automated decisions
We do not make decisions about you by automated means that produce legal or similarly significant effects.
Support access to your workspace
Sometimes we need to look at your workspace to help you. That access is time-limited, purpose-bound and audited, and it is never a standing privilege.
For most support actions we ask your permission first and act only once you have given it. For a narrow set of account-recovery actions — resetting multi-factor authentication for a locked-out user — we act on the request and notify you rather than waiting, because requiring consent from someone who cannot sign in does not work. Every access is recorded in an audit trail you can ask to see.
Cookies
We use cookies that are strictly necessary to sign you in and keep your session secure, and we ask your consent before setting any that are not. Our cookie notice lists them.
Who processes data for us
Our sub-processors are listed at axxointel.com/sub-processors, with what each one handles, where, and the transfer mechanism where processing happens outside the UK. That page is versioned, and your agreement sets out the notice we give before a material change.
Where your data is held
Customer identities, workspace data and reports are held in the United Kingdom. Application compute runs in the European Economic Area. Some providers process limited data — such as sending authentication email — outside the UK, under an approved transfer mechanism. The sub-processor register gives the detail for each.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, ask us to restrict or stop processing it, object to processing based on legitimate interests, and ask for your data in a portable form. To exercise any of these, email privacy@axxointel.com, use the form at axxointel.com/transparency/request, or write to us.
We acknowledge within 5 working days and respond within one month, extendable by up to two further months for complex requests, in which case we tell you within the first month.
If you are unhappy with how we have handled your data, tell us and we will investigate. You can also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113. You do not have to come to us first.
Marketing
We send service messages — invitations, security notices, things about your subscription — because they are part of the service, and you cannot opt out of those while you hold an account.
Marketing is separate. We send it only where we have your consent or a valid soft opt-in, every message carries an unsubscribe link, and an objection to marketing is absolute: we stop immediately and suppress your address so it is not re-added.
Ending your subscription
What happens to your data when a subscription ends is set out in your agreement, including the period in which you can export it and the point at which we delete it. Ask us and we will tell you exactly what would be deleted and when.
Changes
We will update this notice when our processing changes, showing the version and date at the top, and will tell account holders of material changes.