Effective date: 26 October 2026 · Version 1.0
Privacy at a glance
Acurion Hub connects finance, emissions, sustainability and supply-chain evidence. This statement explains the personal information involved in our website, business relationships and services, the choices available to individuals, and the separate responsibilities that apply to customer-controlled workspaces.
- Your organisation controls its workspace. Customer content is processed for the agreed service and documented instructions. It is not made public through the Intelligence Hub.
- Website and enterprise processing are separate. A website visit, an email and a customer document can involve different systems, recipients and locations.
- No external AI document processing. Source-document reading, customised OCR and automated validation operate within the customer's Acurion enterprise environment. Optional customer-selected connections have their own destinations and settings.
- Clear choices and rights. A demonstration request is not a subscription to unrelated marketing. Privacy requests and complaints can be sent to support@acurionhub.com.
1. Who we are and how to contact us
“Acurion Hub”, “we”, “our” and “us” refer to the operator of the Acurion Hub service. For contracted enterprise services, the relevant Acurion contracting entity is identified in the applicable service agreement. The responsibilities described in this statement depend on the service and processing activity concerned.
Our privacy contact is support@acurionhub.com. Use this address for website privacy enquiries, individual-rights requests, complaints and information about the responsible legal entity, postal correspondence or an applicable regional privacy contact.
Tell us which service, customer organisation or website interaction your question concerns. We will provide a suitable secure channel when a request requires sensitive information. Please do not email passwords, complete payment-card details or unnecessary identity documents.
2. What this statement covers
This statement covers the Acurion Hub website, Intelligence Hub, demonstration enquiries, communications, business-account administration and support where the operator decides why and how personal information is used. It includes relevant online and offline business contact with us.
It also explains how to identify the responsible organisation when information is processed in a customer's enterprise workspace. Customer agreements and data-processing terms describe that instructed processing in more detail. They do not remove statutory rights or permit unrelated reuse of customer content.
Separate services, recruitment activities, customer websites, assurance engagements, course enrolments, identity products and third-party services require their own appropriate notices where their processing differs. A link from the Hub does not place those activities within this statement.
3. Our role and the customer's role
| Context | Responsibility |
|---|---|
| Website enquiries, our business contacts and our own administration | We act as controller, data user or the equivalent responsible organisation to the extent we determine the purposes and means. |
| Personal information in customer documents and workspace records | The customer normally determines the purposes. We act as processor or service provider where we process it on documented instructions. |
| An adviser or association managing several businesses | Each business's authority and actual role must be recorded. An intermediary's account or payment of fees does not confer unrestricted access to another business's data. We may be a subprocessor in this arrangement. |
| Customer-selected integrations and independent service providers | The configuration, agreements and actual activities determine each party's role. A label in an agreement cannot override applicable law. |
For customer-controlled information, start with that organisation's privacy contact or administrator. You can also contact us: we will identify the relevant customer and assist or refer the request as appropriate. We do not require you to obtain the customer's permission to ask us a privacy question or exercise a right that applies directly against us.
4. Information we collect and its sources
Information you provide. The demonstration form collects your name, organisation and work email, plus the focus, region and message submitted with the request. Name, organisation and email are required to submit the current form. Message content is optional. Email, support and business correspondence can include contact details, role, correspondence, requested assistance and relationship records. Do not include confidential source documents or sensitive personal information in the public enquiry form.
Website and access information. Hosting, security and access services can process IP addresses, request times, requested URLs, browser or device information, errors and access records. Where sign-in is enabled, the application uses identity information supplied through the access service, including the user identifier and email available to permission checks. It does not require you to give Acurion your identity-provider password.
Administration and audit information. We record relevant actions by authorised administrators, such as the identity associated with approval of a manual Hub update, its date and the retained update history. Demonstration enquiries have a reference identifier and submission timestamp. This audit information is distinct from public news and country datasets.
Information from organisations and other sources. Your employer, an authorised customer administrator, a business counterparty or an integration you or your organisation enables can provide business contact, access or support information. If we obtain personal information from a public professional source or a referring partner, we identify the source and provide the additional information required by law. We do not treat public availability as permission for unrestricted reuse.
Customer content. Depending on the contracted deployment, uploaded invoices, activity records, supplier records, evidence and reports can contain names, business contact details, transaction references, financial-account information or information relating to sole traders and workers. The customer determines the authorised content and purpose. Some otherwise ordinary business records can contain personal information treated as sensitive under local law.
5. Why we use information and our lawful grounds
The table describes our own controller activities. It does not supply a customer's lawful basis for uploading employee, supplier or other third-party information. GDPR terminology applies where that framework governs the activity; other jurisdictions require their own legal justification and notices.
| Purpose | Information involved | Lawful ground where GDPR terminology applies |
|---|---|---|
| Answer a requested demonstration or business enquiry | Contact and organisation details, submitted requirements and correspondence | Necessary steps towards a contract when the individual is a prospective contracting party; otherwise legitimate interests in responding to an expected business enquiry. |
| Maintain a business relationship and provide account administration or support | Business contact, access, support and relationship records | Contract where the individual is a party; legitimate interests in administering an organisation's relationship and assisting its representatives. |
| Deliver and protect the website, prevent abuse and check permissions | Technical, access, request and security records | Legitimate interests in a reliable, secure service, subject to the relevant balancing assessment; a specific legal obligation where applicable. |
| Maintain approvals, investigate incidents and address claims | Relevant administration, incident, correspondence and audit records | Legitimate interests in accountability and legal protection; applicable legal obligations where relevant. |
| Meet tax, accounting, sanctions or other binding requirements that actually apply | Necessary business, billing or compliance records | The particular applicable legal obligation, not a general reference to “compliance”. Additional sensitive-data conditions apply where required. |
| Send optional promotional communications or use optional tracking | Contact details, preferences, consent and relevant interaction data | Consent where required; any permitted alternative is assessed under the applicable local marketing rules before use. The current website application has no advertising or third-party analytics scripts. |
| Handle privacy requests, complaints and preferences | Relevant request, verification, correspondence and response records | Applicable legal obligations and, where appropriate, legitimate interests in administering and evidencing the response. |
We consider the necessity of legitimate-interest processing, individuals' reasonable expectations and the effect on their rights. You can ask for information about the relevant assessment and object where the law provides that right. Consent is requested separately where needed and can be withdrawn. Reading this notice or simply using a website does not provide blanket consent.
6. Customer documents, OCR and automated processing
Enterprise source-document processing and automated validation take place in the customer's Acurion enterprise cloud environment, governed by its access permissions and agreed deployment. Documents are not sent to external AI models or agents for document processing. Native reading and customised OCR produce fields and records for review; this statement does not describe those automated functions as an absence of all automated technology.
We use customer content to provide, secure and support the agreed service and carry out documented instructions. We do not sell that content, use identifiable customer documents to train general-purpose models, or turn it into unrelated advertising profiles. Anonymisation must prevent reasonable re-identification. Removing a name, hashing an identifier or pseudonymising a record does not by itself remove privacy obligations.
The customer's deployment documentation must identify primary processing, backups, disaster recovery, support access, authorised subprocessors and any agreed transfer safeguards. A chosen hosting region does not by itself establish that every support or backup activity stays there.
Connections to Xero, SAP or other services are optional and selected by the customer. The organisation controls which connection to enable and what to share. Relevant notices, access permissions and transfer requirements apply to those destinations as well.
7. Sharing, service providers and independent recipients
Access is limited to the purpose of the relevant activity. Recipients can include authorised personnel, hosting and access services, communications and support providers, professional advisers and providers used under the applicable customer-processing terms. They receive only the information needed for their function and the protections appropriate to their role.
The website uses managed hosting, access, database and storage services. Information about the relevant providers, their roles and processing locations can be requested through our privacy contact. Customer-specific providers and access arrangements are addressed in the applicable service and deployment documentation.
We may disclose information to meet a binding legal requirement, respond to a lawful request, investigate serious misuse or establish or defend legal rights. We assess the requirement, limit the disclosure and notify affected parties where lawful and appropriate. We cannot promise notice when a law prohibits it.
If the relevant business is reorganised or transferred, necessary information may be disclosed under confidentiality and due-diligence safeguards. The receiving organisation must address applicable notice, purpose and lawful-processing requirements. A transaction is not unrestricted permission to repurpose personal information.
Listing Bureau Veritas, SGS, ESCP, COA or another partner or reference does not give that organisation access to your enquiries or workspace. Any introduction, course registration, assurance engagement or authorised sharing is a separate interaction with the relevant information and choices.
8. International processing and transfers
Website delivery, email, administration, customer hosting and remote support can involve different countries. Information about the relevant recipients, processing locations and arrangements can be requested through our privacy contact or your organisation’s administrator. Customer-specific hosting and access arrangements are governed by the applicable deployment documentation.
Where a transfer is restricted, we use a lawful mechanism appropriate to the particular route and role. This can involve an applicable adequacy decision or completed contractual safeguards with the necessary assessments and supplementary protections. EEA standard contractual clauses, UK transfer instruments and Swiss adaptations have different requirements. Their mere mention in this notice does not complete an agreement, establish a certification or authorise a transfer.
Other jurisdictions can require additional conditions, recipient-specific notices, separate consent, local storage, approval or an applicable documented exemption. The mainland China section below is particularly relevant to instructed processing and overseas access. Agreement to this notice is not blanket consent to worldwide processing, and hosting data locally is not a substitute for assessing remote access.
Where legally required, we provide information about the countries, recipients and safeguards and explain how to obtain a copy, with necessary protection for confidential material. Contact support@acurionhub.com for the information relevant to your interaction or deployment.
10. Marketing and communications choices
A demonstration request authorises follow-up about that request; it does not subscribe you to unrelated newsletters or advertising. We obtain any separate marketing permission required for the communication and country involved. An introduction by another business is not automatic consent to marketing.
You can stop optional marketing through an available unsubscribe mechanism or by emailing support@acurionhub.com. Service, security, contract and privacy messages can still be necessary. We retain only the information reasonably needed to honour an opt-out and meet related legal obligations. Choosing not to receive marketing does not prevent a privacy request or access to a contracted service.
11. Retention, return and deletion
We retain identifiable information only for a justified purpose and period, then delete it or genuinely anonymise it. The criteria below guide retention, including the relevant purpose, relationship, applicable legal obligations, necessary evidence and the agreed backup lifecycle.
| Information | Retention criteria |
|---|---|
| Demonstration enquiries and prospect correspondence | For the time needed to answer the enquiry, complete proportionate follow-up and address a related complaint or claim, subject to any applicable legal retention requirement. |
| Account and support records | For the business relationship and the period needed to address relevant support, contractual, dispute or legal requirements. |
| Security and website access records | For the relevant operational or security purpose, including investigation and a justified incident or legal hold. |
| Hub approval and administrative audit history | For accountability, security and the relevant reporting or legal purpose, with access limited to the appropriate role. |
| Customer workspace content | The customer’s documented instructions and agreed service/exit terms; statutory retention applies only to the records actually required. This notice does not impose a universal seven-year archive. |
| Backups and recovery copies | Under the relevant backup rotation and recovery arrangements, with protection against ordinary new uses. Applicable deletion restrictions are restored if a backup is recovered. |
| Rights requests, complaints and consent/opt-out records | For the period needed to fulfil the request, evidence the response or choice, honour an opt-out and meet an applicable legal requirement. |
Legal holds are limited to the necessary information and reason. Deletion can be restricted by a binding obligation or a valid exception; we explain relevant restrictions where required. A customer's own obligation to retain invoices does not automatically require Acurion to retain every source document after the contracted service ends.
12. Security and personal information incidents
Safeguards are appropriate to the risk, the data, the agreed service and applicable law. Relevant measures include access permissions, separation of customer workspaces, controlled administrative access, confidential handling, secure communications, logging and incident procedures. Deployment-specific measures and responsibilities are addressed in the applicable service documentation. Contact our privacy team for information relevant to your service.
No system is completely risk-free. If a personal information incident occurs, we investigate, contain and address it and provide the notifications required for our role and the applicable jurisdiction. For customer content, we notify and assist the customer under its processing agreement without waiting for every investigative detail to be final. Different legal notification clocks can apply; there is no single worldwide “72-hour rule”.
Report a suspected incident to support@acurionhub.com with “Security incident” in the subject. Share a description and a safe contact method rather than passwords or exposed records. A partner relationship or a hosting provider's certification is not an Acurion certification or assurance opinion.
13. Automation and decisions about people
The website validates form submissions, limits abusive requests and checks permissions. It does not make employment, credit, insurance or similar eligibility decisions about visitors. The public walkthrough uses demonstration material and does not access a client's live accounting documents.
Enterprise extraction, classification, calculations and confidence checks assist the customer's workflow. Errors and exceptions require appropriate review. If a deployment uses personal information to make or materially support a significant decision about an individual, the responsible organisation must identify the information and logic involved, explain the likely effect, establish the required legal basis and safeguards, and provide applicable rights to explanation, challenge and human involvement. That assessment is deployment-specific; it cannot be excluded by describing a tool as “support”.
14. Sensitive information and children
The website is intended for business audiences and does not request health records, biometrics, identity-document copies, payment-card authentication data or children's information through its enquiry form. Contact us if such information has been submitted inadvertently so it can be handled appropriately.
Customer invoices or records can contain financial-account, employment or other information protected more strictly in some countries. Customers must minimise unnecessary information and agree any sensitive or children's-data processing with the required legal conditions, notices, permissions and protections. A general business-services agreement is not sufficient authority for every category. Minimum ages and guardian-consent requirements depend on the applicable law.
15. Your rights and how to exercise them
Depending on the law and our role, you can have rights to obtain information about processing; request access or a copy; correct information; request deletion or restriction; object to certain uses; withdraw consent; receive portable information; challenge relevant automated decisions; and complain to a regulator. Some jurisdictions also provide rights to opt out of sale, sharing, targeted advertising or certain profiling, and to appeal a refusal.
Objecting to marketing: you can object to direct marketing at any time. Where processing relies on legitimate interests, you can object on grounds relating to your situation; we assess any lawful reason for continuing the processing.
Send requests to support@acurionhub.com, identifying the service, organisation and right you want to exercise. We accept a clear request without requiring particular legal wording. We ask only for proportionate information needed to verify identity, authority and scope. An authorised agent or representative can act where permitted, subject to appropriate verification. Do not send a government identity document unless requested through a suitable secure process.
We respond within the applicable legal period, explain any lawful refusal, extension or fee, and provide the relevant complaint or appeal route. A fee or refusal is used only where the particular law permits it. We do not discriminate or retaliate against you for exercising applicable privacy rights. We do not require you to accept new marketing or waive rights to obtain a response.
If you disagree with our response, reply to the privacy contact with “Privacy appeal” and the request reference. We arrange review by an appropriate person, where practicable someone not responsible for the initial decision, and explain the next available route.
16. Complaints and regulator access
You can raise a complaint through support@acurionhub.com with “Privacy complaint” in the subject. Include the concern, relevant service, a safe reply address and any prior request reference. We acknowledge the complaint, investigate appropriately, keep you informed and explain the outcome and escalation options. A complaint and a rights request are handled under their respective requirements even if they arrive together.
You can contact the relevant regulator where the law permits. Our internal process does not waive that right, require binding arbitration of statutory privacy rights or replace a legally available judicial remedy. The regional provisions below identify principal regulator routes; local jurisdiction can depend on residence, establishment and the processing concerned.
17. Regional provisions
These provisions apply when the relevant law covers the activity, organisation or individual. Mandatory local protections prevail over inconsistent general wording. Coverage does not mean every law applies to every website visitor. Service availability, sector requirements, language notices, representatives and transfer arrangements must be checked before a new market or deployment is enabled.
European Economic Area
Where the GDPR applies, the controller details, purpose-specific legal grounds, retention information and recipient/transfer disclosures above form part of the required notice. Rights include access, rectification, erasure, restriction, portability and objection as applicable, with safeguards for significant solely automated decisions. Requests normally receive a response within one month; a lawful extension and its reasons are communicated within that period. You may complain to the competent supervisory authority, including in your habitual residence, workplace or place of the alleged infringement. See the EDPB authority directory. Contact our privacy team for information about the responsible entity and any applicable EEA representative or DPO.
United Kingdom
UK GDPR, the Data Protection Act and applicable electronic-communications rules govern relevant processing, as amended. Rights and international-transfer arrangements must follow the UK regime. We apply the legally required response period and permitted verification or clarification provisions to a rights request. A UK data protection complaint is acknowledged within 30 days and investigated and answered without undue delay; that is a distinct process from an access request. You can contact the ICO. Our privacy contact can assist with identifying the relevant responsible entity and any applicable UK representative.
Switzerland
Where the Swiss FADP applies, you receive the required information about the controller, purposes, recipients and countries of disclosure. Relevant access, correction and other statutory rights remain available. Foreign disclosure is assessed under Swiss requirements, including appropriate safeguards and adaptations where necessary. Contact the FDPIC about relevant concerns. Contact our privacy team for information about relevant representatives, processing countries and safeguards.
United States, including California
Applicable state privacy laws can provide access, deletion, correction, portability, opt-out and appeal rights. For covered California processing, the current website data categories are identifiers, professional/business contact details, internet or network activity and relationship/communication information, from the sources and for the purposes described above. Customer-controlled content is separately addressed under the applicable service-provider or processor terms. The categories and sources described in this statement concern the website and business relationships within its scope.
The website application has no advertising trackers, cross-context advertising feature or personal-information sale feature. If covered activity is introduced, the required notices, opt-outs and preference-signal controls must be available before it begins. No financial-incentive programme is offered through the website application.
California access, deletion and correction requests generally have a 45-calendar-day response period, with a further 45 days only where lawfully extended with notice. Other request types and other states can require different handling. You can use an authorised agent, receive an explanation of permitted limitations, and exercise applicable rights without unlawful discrimination. Submit requests through our privacy contact; we provide the request methods and assistance required by the applicable law. Regulator routes include the California Privacy Protection Agency and California Attorney General.
Mainland China
Where the Personal Information Protection Law applies, processing requires an applicable statutory ground, necessary scope and the relevant individual notices. An EEA legitimate-interest assessment is not a substitute for a PIPL ground. The responsible personal information handler, contact route, purposes, methods, categories and retention must be identified. Sensitive information, children under 14 and relevant separate-consent situations require their additional conditions.
Before a restricted overseas transfer or access, the necessary recipient-specific information, transfer assessment, applicable mechanism or documented exemption, and any legally required separate consent must be in place. Local-storage and security requirements can depend on the organisation and data, including public-sector or regulated deployments. EU contractual clauses alone do not satisfy these requirements. Relevant rights include information, decisions about processing, limitation/refusal, access/copy, correction and deletion as provided by law. Contact our privacy team for information about the responsible handler, relevant local contact, recipient-specific notices and transfer arrangements. See the official PIPL text.
Hong Kong
Where the Personal Data (Privacy) Ordinance applies, the responsible data user provides a collection statement explaining the purposes, required and optional information, relevant recipient classes and how to request access or correction. Direct-marketing use is addressed separately under the applicable requirements. Access requests are generally subject to the statutory 40-day handling period and applicable exceptions; we explain any permitted fee. Further information and complaint routes are available from the PCPD. The demonstration form and this statement explain the information requested, its purposes and the relevant contact route.
Australia and New Zealand
Where the Australian Privacy Act applies, the Australian Privacy Principles govern relevant collection, use, security, access, correction and overseas disclosures. Likely overseas recipient countries must be disclosed where practicable, and the applicable accountability requirements must be assessed. Complaints can be raised with the OAIC. From 10 December 2026, additional Australian privacy-policy disclosures apply to qualifying computer-assisted decisions significantly affecting individuals; assess the actual use before that date.
Where New Zealand's Privacy Act applies, relevant access and correction requests normally require a decision as soon as reasonably practicable and within 20 working days, subject to lawful extensions. Overseas processing/disclosure must be assessed under the applicable principles and role. Contact the New Zealand Privacy Commissioner about concerns.
Canada
Applicable federal and provincial rules govern meaningful consent or other permitted grounds, appropriate purposes, access, correction and outsourced processing. Where PIPEDA applies, an access request generally receives a response within 30 calendar days, with only the permitted extensions and notices. Provincial requirements, including Québec's requirements where relevant, require a separate applicability, language, responsibility and transfer assessment. A cross-border processor does not remove the accountable organisation's responsibility. See the Office of the Privacy Commissioner of Canada or the competent provincial regulator. Our privacy contact can assist with the relevant responsible organisation and applicable privacy-officer route.
Singapore
Where the PDPA applies, the relevant organisation must meet applicable purpose-notification, consent or exception, access/correction, protection, retention and overseas-transfer obligations. Contact our privacy mailbox for requests; our privacy contact can assist with the relevant organisation and its applicable DPO contact route. A business-contact-information exception, where available, does not automatically exempt invoice content, tracking or other personal information. See the PDPC.
Brazil
Where the LGPD applies, you have the applicable rights concerning confirmation, access, correction, portability, information about sharing and consent, and deletion, blocking or anonymisation in the circumstances provided by law. The lawful ground and international-transfer route must match the relevant processing. Requests can be sent through our privacy contact, and concerns can be raised with the ANPD. Contact our privacy team for information in an appropriate format and about relevant sharing and transfer arrangements.
India
Indian requirements apply according to their statutory commencement and the particular processing. The November 2025 DPDP commencement notifications phase in different provisions. The relevant notice, processing grounds, grievance, children’s-data, security and transfer requirements apply when in force for the activity concerned. Contact support@acurionhub.com for privacy or grievance enquiries and information in an appropriate format. Official materials are available from MeitY.
Japan and South Africa
For processing covered by Japan's APPI, identify applicable purposes, rights, third-party disclosures and foreign-recipient conditions before enabling the activity. See the Personal Information Protection Commission.
For processing covered by South Africa’s POPIA, collection notices, responsible-party/operator roles, rights, safeguards and transfers are governed by the applicable statutory requirements and the particular processing. Contact our privacy team to identify the relevant responsible organisation and contact route. Applicable rights can be exercised through the appropriate contact and forms. See the Information Regulator.
Other jurisdictions and local-language information
The global provisions above must be supplemented where another applicable law requires additional information, a different legal ground, a local contact, a specific transfer route or an appropriate language. Contact support@acurionhub.com for information in an accessible format or about your deployment. A generic country list does not establish that a service is approved in every jurisdiction.
18. Updates and relationship with other documents
This statement’s effective date and version are shown above. Material changes are communicated through an appropriate channel; new consent is obtained where the law requires it. A later notice does not retrospectively authorise an incompatible use of information.
Customer orders, processing agreements and deployment schedules govern the agreed service and instructed processing, subject to mandatory law. Updating a website notice does not unilaterally amend negotiated data permissions, commercial terms, confidentiality obligations or the rights of individuals. Privacy rights are not waived by a general liability limitation or choice-of-law clause.
Privacy contact: support@acurionhub.com. Effective date: 26 October 2026. Version: 1.0.