Privacy
Privacy notice
Action360 is an operational governance workspace used by organisations to track actions, risks, changes and readiness. We act as a processor, handling data on the documented instructions of the client that engaged us.
What we collect
| Category | Fields | Purpose |
|---|---|---|
| Account records | Account name, industry, logo | Identify the client workspace |
| User profiles | Name, work email, job title, department, active status | Authenticate users and attribute records |
| Roles and groups | Role per account, group membership | Decide what each user may see and do |
| Governance records | Actions, risks, changes, sub-tasks, comments, readiness scores | Deliver the service the client engaged us for |
| Attachments | Files uploaded against a record | Evidence attached to governance items |
| Notifications | Title, body, severity, delivery status | Alert owners and approvers |
| Activity and audit logs | Actor, event, target, timestamp | Traceability and security monitoring |
We collect work-context data only. The platform is not designed for payment data, government identifiers, health data or other special category data, and clients are asked not to upload such data as attachments.
Retention
Client data — including governance records, attachments, notifications and audit logs — is retained for 13 months. User profiles are kept for the life of the engagement and deactivated immediately on a leaver notification.
Deletion
- Verified deletion requests are completed within 30 days.
- Backups are not edited; deleted data ages out of the backup retention window, after which no copy remains.
- At contract end we provide a full export on request, then delete the client's data. Written confirmation of deletion is available.
Your rights
Individuals may request access, rectification, erasure, restriction or objection. Because we act as a processor, requests are usually raised through the client organisation that provided your account. Your Action360 administrator will route the request to us, and we respond within 30 days.
Security
Encryption, access control, tenant isolation, logging and recovery arrangements are described on the security page. Third parties involved in processing are listed on the subprocessors page.
Questions about this notice: contact your Action360 administrator, who will route it to our privacy contact.