Privacy Policy

Privacy contact: To be confirmed: privacy email. Responsible legal entity: To be confirmed: legal entity name, To be confirmed: registered address. Effective date: To be confirmed: privacy effective date. Last reviewed: To be confirmed: privacy last reviewed date. Applicable geographic supplement: To be confirmed: privacy applicable jurisdiction supplements.

This Privacy Policy describes how SiteAxis handles personal information in connection with the public website, sales, controlled trials, account creation, application use, support, billing and security. It also explains how the SiteAxis B2B service processes customer-controlled construction project information.

1. Our distinct privacy roles

For marketing enquiries, website visits, sales contacts, account-security and business administration, SiteAxis generally determines the purposes and means of its own processing, subject to applicable law. For information contained in customer-directed project records, forms, photos, schedules, Safety and Incident records and shared documents, SiteAxis generally processes data on behalf of the organization or organizations with legal authority over those records. The applicable controller/business and processor/service-provider relationships depend on the actual processing activities and applicable law and are documented in the service contract and Project Collaboration Schedule; an organization can be a controller for one activity and a processor or joint participant for another.

A subcontractor or project participant who uses SiteAxis is not necessarily a SiteAxis third-party subprocessor. A true SiteAxis subprocessor is an external provider hired by SiteAxis to process covered personal information for its services.

2. Individuals covered

Visitors, prospects, representatives of existing or prospective customers, employee/contractor/subcontractor users, project owners and client representatives, inspectors, incident subjects and witnesses named in project records, suppliers, billing contacts and people communicating with our support/sales teams. This policy is not a substitute for the employing company's notice to its staff or a project's required privacy notices.

3. Data categories

We may receive or generate: (a) business identity, company, roles, work email, phone and invited account membership; (b) authentication, verification, MFA, session and security logs; (c) projects, participating organizations, location/sublocation assignments, contact records and role settings; (d) contractor/subcontractor hierarchy and authorized Site Contacts; (e) uploaded documents, schedules, permits, observations, inspections, incidents, daily reports, corrective actions, risk/quality/commercial records, photos, attachments, comments, signatures if used, workflow history and audit trails; (f) work-related injury or medical-attention descriptors, body-part fields and witness statements when a customer chooses to enter those details in an incident workflow; (g) user-requested approximate or device location used for site/weather functions where enabled; (h) customer-service communications, service notifications and safe support diagnostics; (i) customer invoice, account and subscription metadata with payment methods generally handled by designated billing providers; and (j) browser session, consent preferences, necessary cookies and optional analytics events only to the extent actually enabled.

Government-issued IDs, unrelated medical charts, background checks and biometric identification are outside the ordinary intended scope of the service unless separately agreed and supported by appropriate safeguards. Users must avoid unrelated sensitive disclosures.

4. Sources and purposes

We obtain data directly from account users and public forms; from authorized customer/company/project administrators; from other authorized project collaborators; automatically from essential technical service operation; and where configured from identity, payment or customer-directed integration providers. Purposes include account/provisioning, project collaboration, role enforcement, record storage, import/export subject to authorization, safety and quality workflows, notification delivery, payments, support, abuse prevention, audits and compliance, service reliability and lawful business communication. Optional AI features process submitted materials only when enabled and approved under the applicable order, DPA and AI Addendum. Optional marketing/analytics processing requires separately applicable controls and a lawful basis.

5. Legal bases / consent

Where legal-basis terminology applies, processing may rely on performance of contracts, compliance with law, consent and appropriately assessed legitimate interests, depending on role and jurisdiction. Canadian consent, Québec requirements, EU/UK legal bases and U.S. rights must be assessed rather than assumed identical. We do not treat required service-notification consent as consent to commercial marketing. Consent can be withdrawn where withdrawal rights apply, though that may limit optional functionality or communication.

6. Project content and independent participant visibility

Customer-selected administrators and users may access information according to validated company/project/role/module permissions. An invited general contractor, owner representative or subcontractor may have authorized access to shared project evidence. The platform's default role checks do not establish which construction participant owns or controls particular underlying records. Customer contracts, record origins, legal obligations, participation agreements and configured permissions inform decisions about sharing, retention, requests and disputes. SiteAxis does not sell personal information, including project records, or disclose project records for another customer's unrelated project use. This proposed commitment must remain consistent with all enabled processing and provider arrangements.

7. Providers and disclosure

We may share necessary information with approved hosting, authentication/database, cloud runtime, payment, transactional email/notification and storage service providers, and approved conditional AI/integration providers, as necessary to operate the product. We may disclose under documented legal process, for fraud/security, to protect rights, to advisers under confidentiality, and during a lawful business transition. The applicable service providers, their functions and processing jurisdictions will be identified in the completed subprocessor schedule and To be confirmed: subprocessor notice url. The provider list remains to be confirmed in this draft.

8. Security and incident response

SiteAxis will maintain administrative, technical and organizational safeguards appropriate to the information and processing risks. The agreed safeguards are described in the completed security schedule. No independent certification, fixed recovery time or data-residency commitment is made by this draft. Notifications concerning personal-data incidents will follow applicable law and the applicable customer agreement.

9. International handling

Data may be handled where SiteAxis and approved active vendors actually operate. Hosting and backup regions, subprocessors and transfer routes are identified in To be confirmed: verified data location and transfers when factually confirmed. This draft makes no Canadian-only hosting commitment. Cross-border transfers are subject to required safeguards and, where applicable, Québec assessments or EU/UK/Swiss transfer instruments. SiteAxis may be subject to lawful access obligations in processing jurisdictions.

10. Retention, cancellation and deletion

We retain personal information only for purposes, periods and lawful grounds applicable to the information and organization. Account events, security records, project evidence, incident/worker records, invoices and customer uploads have different operational and statutory considerations. Suspension, expiry, cancellation and downgrade do not automatically erase project data. Approved export, deletion/anonymization and backup purge processes, including holds and shared-project rights, are governed by To be confirmed: retention schedule version and actual deployed capabilities. Available return/export methods, deletion periods and backup expiry will be specified in the completed retention schedule; account cancellation alone does not initiate deletion. We will handle verified requests within applicable legal requirements and communicated timelines.

11. Privacy rights

Depending on jurisdiction and role, individuals may request access, correction, deletion, information about processing, withdrawal of consent, objection/restriction, portability or information about automated decisions. Submit requests to To be confirmed: privacy email using the process in To be confirmed: privacy rights request guide url. We may verify identity and direct project-content requests to the appropriate customer organization. Any limitation or refusal of a request must be permitted by applicable law. Contractual preferences alone do not override statutory privacy rights. Where permitted or required, we will explain the grounds for a limitation and available complaint or appeal channels. Regulators and appeal channels are identified in To be confirmed: jurisdiction specific rights contacts.

12. Cookies, preferences and analytics

Necessary authentication and security technologies support service operation. Optional analytics, marketing and non-essential preferences are off by default and are subject to applicable user choices. The Cookie Policy describes these categories and how to change a choice. The actual identifiers, providers, purposes and durations remain to be completed in this draft's cookie inventory.

13. Marketing and service communications

Product-security, access verification, contractual, support and workflow messages may be required to operate the service. Optional promotional communications should use separate consent/rights and a functioning unsubscribe method where applicable. Identification and electronic-message requirements, including CASL where applicable, are reviewed before campaigns begin.

14. Children and high-risk use

SiteAxis is intended for professional/organizational project operations, not use by children as consumer subscribers. Worksite records may incidentally identify minors, injured workers or other persons; upload and share only when lawful, necessary and suitably protected. Clinical patient records, special regulated identifiers and unrelated high-risk datasets are outside ordinary scope without written agreement and verified controls.

15. Policy changes and contact

We will review and update this Policy when material processing practices, activated vendors or applicable laws change; where required we will give notice or seek renewed consent. Historical versions and acceptance records will be preserved according to approved policy. Questions or requests: To be confirmed: privacy email, postal address To be confirmed: registered address, privacy officer To be confirmed: privacy officer name or role. Where applicable, local representative To be confirmed: privacy local rep contact and supervisory authority To be confirmed: privacy regulator contacts.