1. Who we are and what this policy covers
Zektrx is a business software platform for trade, fabrication, contractor and operational teams. The platform is designed to help customers manage compliance workflows (RAMS, risk, COSHH, permits), documentation, planning, stock/materials, commercial workflows, people records and audit-ready evidence. This policy covers information collected through the Zektrx website, demo and sales enquiries, account creation, customer onboarding, use of the Zektrx application, customer support, billing and service administration.
2. Our role: controller and processor
For website visitors, demo requests, account administration, billing, customer support and our own business operations, Zektrx acts as a data controller because we decide why and how that information is used. For information a customer uploads, creates or manages inside their own Zektrx workspace, the customer is normally the data controller and Zektrx acts as a data processor, handling that data only to provide, secure, support and improve the service in line with the customer agreement and applicable law.
3. Information we collect from website visitors and enquiries
We may collect information submitted through the website or contact forms, including name, company name, email address, phone number, job role, business type, company size, industry, message content, demo requirements and any files or notes voluntarily provided. We may also collect basic technical information such as IP address, browser type, device type, pages visited, referral source and approximate location derived from technical data where analytics, security or hosting tools provide it.
4. Account, workspace and user information
When users create or access an account, the platform may process account identifiers, email addresses, names, company details, workspace membership, user roles, permissions, subscription status, plan type, login activity, invitation status, profile settings and audit information. This information is needed so the platform can authenticate users, show the correct company workspace, apply role-based permissions, support team management and keep records of important actions.
5. Customer content stored in the platform
Customers may choose to store business and compliance content in Zektrx, including RAMS, risk assessments, method statements, O&M manual records, evidence checklists, drawings, certificates, photos, manuals, project files, client site information, asset registers, stock records, purchase and job planning records, training records, toolbox talks, incident records, permits, audit findings, actions, approval records, templates, quotations, invoices and other documents. The customer controls what is uploaded and who is permitted to access it inside their workspace.
6. Employee, worker and subcontractor records
Where a customer uses Zektrx to manage staff, operatives, subcontractors, training, inductions, PPE, health and safety actions or job assignments, the platform may process worker names, contact details, role information, employment or subcontractor status, training records, competency records, certificates, PPE records, site attendance information, task allocations, incident involvement and related notes entered by authorised customer users. Customers are responsible for making sure they have a lawful basis for entering this information and for telling their workers how their data is used.
7. Sensitive, health and safety-related information
Some customer records may include sensitive or higher-risk information, such as accident details, health surveillance notes, first-aid records, medical fitness information, disability adjustments, disciplinary notes or identity documents, if a customer chooses to upload or record them. Zektrx is intended to store this information only where the customer has a valid legal reason, limits access to authorised users, and uses the platform controls appropriately. Customers should not upload unnecessary sensitive information and should apply strict permissions where such records are required.
8. Billing and payment information
If paid plans, subscriptions or pay-as-you-go services are enabled, we may process billing contact details, plan type, purchase history, payment status, invoice references, tax information, renewal status and payment provider identifiers. Card and bank payment details should be handled by our payment processor and are not intended to be stored directly in the Zektrx application database. We use billing information to manage subscriptions, confirm access rights, process payments, prevent fraud and maintain financial records.
9. How we use information
We use information to provide and operate the website and platform, create and manage user accounts, authenticate users, apply permissions, provide demos, respond to enquiries, deliver customer support, process billing, generate documents requested by users, maintain audit trails, improve reliability, diagnose errors, protect the service, prevent misuse, comply with legal obligations and communicate important service or account updates.
10. Lawful bases for our controller activities
Where Zektrx acts as controller, we rely on appropriate lawful bases depending on the activity. These may include contract where we provide services or respond to requested demos, legitimate interests where we improve and secure the service or communicate with business contacts, legal obligation where we keep accounting or compliance records, and consent where required for optional marketing cookies or certain marketing communications. Customers remain responsible for identifying their own lawful basis for personal data they place in their workspace.
11. Customer instructions and workspace control
For customer workspace data, Zektrx processes information to provide the functionality selected by the customer and authorised users. Customers control user invitations, roles, permissions, what records are created, what files are uploaded, what data is exported and what records are deleted, subject to technical limits, backup retention and legal obligations. Zektrx should not use customer workspace data for unrelated advertising or sell customer data.
12. AI-assisted and automation features
Zektrx may include AI-assisted drafting, document generation, summaries, risk prompts, action suggestions, template improvement and workflow automation. These features are intended to assist authorised users, not replace professional judgement. Customer users should check outputs before relying on them, remove unnecessary personal information from prompts where possible, and avoid entering special category or confidential personal data into AI tools unless it is needed and authorised by the customer. Where external AI providers are used, they should be assessed and configured in line with customer agreements and data protection requirements.
13. Communications, messaging and attachments
If internal messaging, notifications, comments, approvals or file attachment features are used, the platform may process message content, recipients, sender details, attachment metadata, uploaded files, read status, delivery status and timestamps. These records are used to deliver communications within the customer workspace, support audit trails, show unread counters, evidence approvals and maintain operational records.
14. Location, attendance and clock-in features
If clock-in, attendance, site visit or GPS-enabled features are enabled, the platform may process time, date, user, device-derived location, site assignment and attendance status to support customer-controlled workforce and site management. Location features should only be used where they are clearly enabled, proportionate, communicated to affected workers and supported by the customer's own lawful basis and workplace policies.
15. Cookies, analytics and tracking
The Zektrx website may use necessary cookies for security, session handling, forms and basic website functionality. With consent, we may also use privacy-reviewed analytics, tag-management or performance tools to understand visits, improve pages and measure interest in Zektrx. Non-essential cookies or marketing tools should only be used where suitable notice and consent controls are in place. If additional analytics, advertising or tracking tools are added, this policy and any cookie notice should be updated to identify them clearly.
16. Service providers and subprocessors
We may use trusted service providers to host the website and application, store data, authenticate users, process payments, send emails, provide analytics, monitor errors, manage customer support, operate infrastructure, protect security and deliver AI-assisted features where enabled. These providers may process information only for agreed service purposes and should be subject to suitable contractual, confidentiality and security obligations. A current subprocessor list should be made available to customers where required by contract.
17. International transfers
Some service providers may process information outside your country, region or the European Economic Area. Where this happens, Zektrx aims to use appropriate safeguards such as adequacy regulations, standard contractual clauses, international data transfer agreements or other lawful transfer mechanisms required by applicable data protection law.
18. Security measures
Zektrx is designed to use technical and organisational safeguards appropriate for a business SaaS platform, including authenticated access, role-based permissions, company workspace separation, secure hosting, encryption in transit, access controls, audit logs where available, backup and recovery processes, monitoring, secure development practices and restrictions on administrative access. No online service can guarantee absolute security, so customers should use strong passwords, manage invitations carefully, remove users who no longer need access and configure permissions appropriately.
19. Data retention and deletion
We keep controller data for as long as needed for enquiries, services, billing, legal compliance, dispute resolution and business records. Customer workspace data is retained according to the customer's use of the platform, subscription status, deletion choices, contract terms and backup cycles. Deleted records may remain in backups for a limited period before permanent removal. Some records may need to be kept longer where required for legal, accounting, security, audit or dispute purposes.
20. Data exports, portability and business continuity
Where technically available, authorised customer users may export or download certain records such as registers, reports, documents, PDFs, CSV files, evidence lists or audit information. Export capability depends on the module and the permissions of the user. Customers are responsible for storing exported files securely and for managing retention outside the Zektrx platform.
21. Data accuracy and customer responsibilities
Customers and authorised users are responsible for keeping workspace data accurate, complete, relevant and up to date. Zektrx provides tools to create, edit, review, export, archive, restore or delete records where features permit, but the customer remains responsible for deciding what information is recorded, whether it is appropriate, who can access it and when it should be removed.
22. Individual rights
Depending on the circumstances and applicable law, individuals may have rights to access, correct, delete, restrict, object to processing, request portability or complain to a data protection authority. Where Zektrx acts as controller, requests can be made directly to us. Where a request relates to customer workspace data, we may direct the individual to the relevant customer or support the customer in responding where required by contract and law.
23. Security incidents and breach support
If we become aware of a personal data breach affecting information for which we are responsible, we will take appropriate steps to investigate, contain and remediate the issue. Where Zektrx acts as processor for customer workspace data, we will aim to notify affected customers without undue delay where required so they can assess their own notification obligations. Customers should also notify Zektrx promptly if they suspect unauthorised access within their workspace.
24. Confidentiality and staff access
Access to customer workspace data by Zektrx personnel or authorised support providers should be limited to people who need it to operate, secure, troubleshoot, support or improve the service. Support access should be proportionate, logged where technically available and handled under confidentiality obligations. Zektrx will not intentionally access customer content except where needed for service delivery, support, security, legal compliance or as instructed by the customer.
25. Children
Zektrx is a business platform and is not intended for children. Customers should not create accounts for children or upload children's personal data unless they have a clear lawful basis and the information is genuinely necessary for their business or legal obligations.
26. Changes to this policy
We may update this Privacy Policy as Zektrx develops, new modules are added, integrations change, service providers change, or legal and operational requirements change. The latest version will be published on this page with an updated date. Material changes may also be communicated to customers through the website, application or email where appropriate.
27. Legal note
This policy is written to describe the intended operation of Zektrx and the types of controls expected by business customers. It should be reviewed by a qualified legal or data protection professional before being relied on for enterprise contracts, regulated customers, public sector work, international rollouts or high-risk processing.