BETAThis website is in beta. Information is preliminary and subject to change.
Investor Relations
08 / 15In Preparation

Privacy Policy

Governs the collection, processing, and storage of personal data and client production data across all AxiForge platforms. Compliant with UK GDPR and EU GDPR. To be finalised before the first commercial deployment.

This Privacy Policy is currently in preparation. The framework below reflects the draft structure that will be reviewed by legal counsel and finalised prior to the first commercial client deployment.

What is it?

A Privacy Policy is the legal document describing how a company collects, processes, stores, and shares personal data. It is required under UK GDPR and EU GDPR for any organisation handling personal data. For AxiForge, this covers client contact data collected through digital forms, telemetry data transmitted by Sensor SA-1 edge nodes, and production metrics flowing through the Autonomous Factory OS.

Why it matters

  • Required by UK GDPR and EU GDPR — mandatory for commercial operations
  • Prerequisite for enterprise procurement and vendor onboarding
  • Builds client trust — confirms their data is not sold or misused
  • Required for GDPR-compliant email marketing and lead capture
  • ICO registration required when processing personal data
  • Demonstrates operational and legal readiness to investors

This Privacy Policy applies to all personal data collected and processed by AxiForge Holdings Ltd and its subsidiaries in connection with the following platforms and services:

  • Autonomous Factory OS — monitoring and management platform for autonomous production lines
  • Sensor Dashboard — telemetry and analytics interface for Sensor SA-1 edge nodes
  • WorkOS Platform — industrial software modules (TenderForge, TechDocForge, QualityForge, and others)
  • axiforge.co.uk and associated web properties — contact forms, waitlist, and investor relations pages
Data ControllerAxiForge Holdings Ltd
Registered addressEngland and Wales
Contact for data mattersceo@axiforge.co.uk
ICO registrationTo be completed prior to first deployment

Personal Data — Contact & Enquiry Forms

  • Name and email address submitted via contact, investment enquiry, or waitlist forms
  • Optional message content submitted by the user
  • IP address and browser metadata collected for spam prevention

Platform Data — Sensor Telemetry

  • Machine operational data: vibration, temperature, cycle counts, anomaly signals from Sensor SA-1 nodes
  • Production throughput metrics transmitted to the Autonomous Factory OS dashboard
  • Alert and incident logs generated by the edge AI layer

Platform Data — User Accounts

  • Name and email address of platform users registered by the client
  • Login timestamps and session activity logs
  • Configuration preferences and dashboard settings

Financial Data

  • Billing name, email, and payment method metadata processed via Stripe
  • AxiForge does not store raw card data — all payment processing is handled by Stripe under their own PCI-DSS certification

All personal data is processed under one of the following legal bases as defined by UK GDPR Article 6:

Contract Performance

Processing necessary to deliver the services the client has contracted for.

  • Activating and managing client platform accounts
  • Processing Sensor telemetry and delivering Autonomous Factory OS functionality
  • Responding to support requests and SLA incidents

Legitimate Interest

Processing necessary for AxiForge's legitimate business interests, where these are not overridden by the rights of the individual.

  • Improving predictive algorithms using anonymised, aggregated telemetry data
  • Fraud detection and platform security monitoring
  • Sending service updates and product announcements to existing clients

Consent

Processing where the individual has freely given, specific, and unambiguous consent.

  • Marketing communications to non-client contacts who have opted in
  • Investor waitlist communications where consent was explicitly given

Legal Obligation

Processing required to comply with applicable law.

  • Retaining financial and transaction records for 7 years per HMRC requirements
  • Responding to lawful requests from regulatory authorities or courts
  • Delivering and supporting contracted platform services (Autonomous Factory OS, Sensor Dashboard, WorkOS)
  • Responding to enquiries, contact form submissions, and support tickets
  • Processing investor waitlist registrations and delivering the information package
  • Sending billing notifications, invoices, and payment receipts
  • Improving the accuracy of predictive maintenance algorithms using anonymised, aggregated telemetry — individual client production data is never used in identifiable form
  • Detecting and preventing fraudulent or unauthorised platform activity

Commitment

AxiForge does not sell, rent, or transfer personal data or client production data to third parties for commercial purposes.

Contact form submissions12 months from submission
Operational / telemetry data24 months from collection
Platform user account dataDuration of contract + 90 days
Financial & transaction records7 years (HMRC requirement)
Post-termination data export window30 days on written request
Backup retention90 days rolling

After the applicable retention period, data is permanently deleted or anonymised. Clients may request early deletion of their data by contacting ceo@axiforge.co.uk, subject to any overriding legal retention obligations.

AxiForge uses the following third-party processors under a Data Processing Agreement (DPA) with each provider:

Resend

USA (EU Standard Contractual Clauses)

Transactional email delivery — contact form responses, waitlist confirmations, notifications

Stripe

USA / Ireland (PCI-DSS certified, SCCs in place)

Payment processing for platform subscriptions and deployment fees

Vercel

USA / Europe (EU SCCs in place)

Web application hosting and serverless function execution

Plausible Analytics

EU (Germany)

Privacy-preserving website analytics — no cookies, no personal data collected

Under UK GDPR, individuals have the following rights regarding their personal data:

Right of AccessRequest a copy of all personal data held by AxiForge relating to you (Subject Access Request)
Right to RectificationRequest correction of inaccurate or incomplete personal data
Right to ErasureRequest deletion of personal data, subject to legal retention requirements
Right to Data PortabilityReceive your personal data in a structured, machine-readable format
Right to ObjectObject to processing based on legitimate interest, including direct marketing
Right to Restrict ProcessingRequest that processing is restricted while a complaint or objection is being resolved

To exercise any of the above rights, contact us at ceo@axiforge.co.uk with the subject line "Data Subject Request". We will respond within 30 days. If you believe your rights have not been respected, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Primary regulationUK GDPR (post-Brexit retained law)
EU clientsEU GDPR applies in parallel
Supervisory authorityInformation Commissioner's Office (ICO), UK
Governing lawEngland and Wales
International transfersCovered by EU Standard Contractual Clauses

Where AxiForge processes data from EU-based clients or individuals, the EU GDPR applies in addition to UK GDPR. All international data transfers to third-country processors are covered by EU Standard Contractual Clauses (SCCs) or an equivalent adequacy mechanism.

Investor Perspective

A Privacy Policy is not optional — it is a legal requirement for any company handling personal data under UK GDPR. For enterprise B2B sales, it is a prerequisite for vendor onboarding: procurement teams verify data handling compliance before signing any contract. The absence of a Privacy Policy at due diligence is a red flag. AxiForge's policy framework is in preparation and will be finalised — alongside ICO registration — before the first commercial client deployment.

07 — Terms of Service09 — Financial Model