Privacy Policy

This policy describes how ScotiTech Solutions Limited ("ScotiTech", "we") processes personal data through the AXOS marketing site at axos.scotitech.com, the AXOS hosted demo environment, and the procurement and support conversations connected to them. For these services ScotiTech is the data controller.

It does not describe the processing performed by an AXOS deployment running inside a customer environment. For self-hosted deployments the customer is the sole data controller for everything they put into AXOS. ScotiTech is not a processor of that data unless the customer separately engages us for hosted demo, managed support, or a hosting service — in which case the terms are set by the Data Processing Agreement at /dpa.

Contact details you submit through the registration or contact forms: name, business email, company, role, country, industry, company size, deployment preference, and the workflows you are interested in.

Email verification metadata: a one-time passcode (stored only as a SHA-256 hash, never in plaintext), its expiry, and the number of attempts. The plaintext code is sent to you by email and is not retained by us.

Operational logs from the marketing site and hosted demo: request URL, response status, timestamp, truncated IP address, and user-agent. Application logs never contain a full email address or passcode; correlation uses a short non-reversible reference.

Cookies and similar storage, controlled by the banner shown on first visit. Necessary cookies are always active. Analytics and marketing cookies are OFF until you switch them on, and you can change your choice at any time from the "Cookie settings" link in the footer.

To respond to enquiries and send the demo credentials you asked for — performance of a contract or steps taken at your request before a contract (UK/EU GDPR Art 6(1)(b)).

To operate, secure, and improve the marketing site and hosted demo, including abuse prevention and rate limiting — our legitimate interests (Art 6(1)(f)), which we have balanced against your rights.

To meet legal and accounting obligations of a UK company (Art 6(1)(c)).

Analytics and marketing cookies only where you have given consent (Art 6(1)(a) and PECR reg 6). You can withdraw consent at any time with the same ease you gave it.

We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We do not use any content you submit — to the site, the demo, or a self-hosted deployment — to train, fine-tune, or evaluate any AI model, ours or a third party’s.

We keep personal data only for as long as the table below states. The same windows are coded into the AXOS API and enforced by a daily automated sweep; a unit test asserts the values so the published schedule and the running system cannot drift apart.

Where you ask us to erase your data earlier, we do so immediately for the registration and verification records. Bounded operational logs and host backups roll off on the schedule above.

We use a small number of third parties to run the AXOS-operated services. Each is bound by a written data-processing agreement and, where data leaves the UK or EEA, by Standard Contractual Clauses or an equivalent transfer mechanism.

Self-hosted AXOS deployments do not use any of these sub-processors unless the customer explicitly configures them. We notify customers with an active engagement before adding a sub-processor, via the support channel agreed in their contract. The canonical list, with change history, is at /subprocessors.

Technical measures include TLS 1.3 in transit, AES-256 at rest on ScotiTech-operated hosts, HTTP security headers (HSTS, nosniff, frame and referrer controls), request rate limiting, and admin routes protected by a rotated shared secret. Our full posture and coordinated vulnerability disclosure policy are at /security.

If we become aware of a personal data breach affecting data we control, we will notify the UK ICO within 72 hours where required by UK GDPR Art 33, and we will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art 34). For data we process on a customer’s behalf under the DPA, we notify the customer without undue delay and in any event within 48 hours of becoming aware, so the customer can meet their own 72-hour clock.

Security concerns can be reported to security@scotitech.com. We acknowledge within two business days.

Depending on where you live, you may have the right to access your personal data, have it corrected or erased, restrict or object to processing, receive it in a portable format, and withdraw consent. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk).

To exercise any right, email privacy@scotitech.com from the address you registered with, or include enough detail for us to verify it is you. We respond within one month (UK/EU GDPR), extendable by two months for complex requests, and we will tell you if we need the extra time. We do not charge a fee unless a request is manifestly unfounded or excessive.

For the registration and verification records specifically, export and erasure are performed by an operator through an authenticated API route; the request is logged without your identity.

The AXOS website and registration flow make no decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (UK/EU GDPR Art 22). Email verification is a one-time passcode check; eligibility for a demo is reviewed by a person.

An AXOS deployment inside a customer environment is configured by that customer. Any automated decision-making within it — and any Art 22 safeguards such as human review, explanation, or contestation — is the customer’s responsibility as controller. AXOS provides logging, human-oversight hooks, and end-user transparency features to support that; see the EU AI Act statement linked from /trust-center.

AXOS is a business-to-business service. The website and hosted demo are intended for adults aged 18 and over acting on behalf of an organisation. We do not knowingly collect personal data from anyone under 18. If you believe a minor has submitted data to us, contact us and we will delete it.

Our primary hosting is in the European Economic Area (Germany). Transactional email is delivered from the United States under Standard Contractual Clauses. Where personal data is processed outside your country we rely on an adequacy decision, the UK International Data Transfer Agreement or Addendum, or Standard Contractual Clauses, as applicable.

If you are in India, the DPDP Act 2023 applies to our processing of your personal data in connection with offering AXOS to you. We act as the Data Fiduciary for the website, hosted demo, and procurement conversations. For a self-hosted AXOS deployment, the customer is the Data Fiduciary and ScotiTech, where engaged for support or hosting, is a Data Processor under a written contract.

We process your personal data only for the specified purposes in section 3, and only with your consent or for a legitimate use recognised by the Act (for example, where you voluntarily provide your details to request a demo). Consent can be withdrawn at any time with the same ease it was given.

You have the right to access a summary of your personal data and the processing activities, to correction and erasure, to grievance redressal, and to nominate another individual to exercise your rights in the event of death or incapacity. Requests and grievances can be sent to our Grievance Officer: Pardeep Kumar, Data Protection Officer, ScotiTech Solutions Limited, privacy@scotitech.com. We aim to respond within 30 days. If you are not satisfied with our response you may approach the Data Protection Board of India.

We do not process the personal data of children under 18 in India and do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. In the event of a personal data breach we notify the Data Protection Board and affected Data Principals in the form and manner the Act and its rules prescribe.

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, or another US state with a comprehensive privacy law, this section applies in addition to the rest of this policy.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the CCPA/CPRA and equivalent state laws. We do not use or disclose sensitive personal information for purposes other than those permitted by law. We do not knowingly collect or sell personal information of consumers under 16.

When we process personal information on behalf of a business customer — for example the hosted demo or managed support under the DPA — we act as a "service provider" (CCPA) or "processor" (other state laws). We process that information only for the business purposes in the contract, do not retain, use, or disclose it outside the direct relationship, and assist the customer with consumer requests.

You have the right to know what personal information we collect, use, and disclose; to delete it; to correct inaccurate information; to obtain a portable copy; and not to be discriminated against for exercising these rights. Because we do not sell or share personal information, no opt-out is required, but we honour Global Privacy Control signals as an opt-out where they are received. Submit requests to the contact in section 7; we verify identity through the email address on record and respond within 45 days, extendable once by 45 days with notice.

AXOS is not designed to receive or process Protected Health Information under HIPAA. We do not enter into Business Associate Agreements for the website, hosted demo, or standard support services. A self-hosted AXOS deployment may be used by a HIPAA-covered entity inside its own environment, in which case HIPAA compliance is the customer’s responsibility as covered entity; ScotiTech will consider a BAA only as part of a specifically scoped engagement where we would handle PHI.

We update this policy when our practices change. The effective date at the top reflects the current version. Material changes are communicated to active customers through their agreed support channel, and by a notice on this page for at least 30 days.