Legal

Cookie policy

Cookies are small files stored on your device. Alongside similar technologies, they can help services work properly, maintain secure sessions and understand how services are used.

We do not use advertising cookies or behavioural advertising, and we do not use cookies to sell data.

The public website

The main website is intended to work for general browsing without non-essential cookies. You do not need to log in to browse it.

Understanding directory use

Our service directory uses Microsoft Application Insights to understand searches, filters, services clicked and searches with no results. This helps us improve the directory. Its current configuration disables analytics cookies and browser storage, but still sends usage information, including search terms that pass automated checks.

Please do not enter names, contact details or other personal information into directory searches. Automated checks cannot guarantee that all personal information will be detected. We do not use searches to try to identify you.

The signed-in application

The application at prevent.askenact.com may use essential cookies or similar technologies to sign you in, keep your session secure, prevent unauthorised access and remember essential application state.

Your choices

You can block or delete cookies through your browser settings. Blocking essential cookies may prevent you from signing in or staying signed in to the application. Basic browsing of the public website should normally still work.

Where non-essential cookies or similar technologies require consent, our policy is to provide a way to manage preferences and withdraw consent. For details of cookie names, providers, purposes and lifetimes, or questions about directory analytics, contact legal@askenact.com.

Privacy policy

Who is responsible for your information?

Ask:Enact Ltd is registered in Scotland, company number SC843788. We are the data controller for our website, directory, enquiries, account administration and our own security and service monitoring.

For application content entered by professional users, the organisation providing access will usually be the controller. We process that content on its instructions. If you are described in a scenario, contact that organisation first about how your information is used.

What we collect and why

• Website and directory: technical information such as IP address, browser, device and time of use, plus page views, searches, filters and service clicks, to operate, secure and improve the service.
• Enquiries: your name, email, organisation and message, along with information you choose to provide, so we can respond.
• Professional application: account details, access and audit logs, usage data, chat content, generated responses and feedback, to provide the application, manage access and support security and improvement.

The application is for authorised professional users, not direct public use or use by children. Users should describe situations without names, addresses, dates of birth, reference numbers or other identifying details. Personal data entered into a chat may still be stored in its transcript.

Our reasons for using personal data

We rely on legitimate interests to operate and secure our services, respond to enquiries, understand use and improve quality. We also rely on contract where relevant to providing a requested service, and legal obligation where required. When we process application content for another organisation, it is responsible for identifying the lawful basis.

We do not sell personal data or use it for advertising.

AI and professional judgement

Application text may be sent to Microsoft Azure OpenAI to generate a response. Ask:Enact supports professional judgement; it does not make decisions about individuals solely by automated means. Users must review the output and decide what action is appropriate.

We do not use user chat logs to train or fine-tune AI models. Prompts and responses may be retained for service operation, audit, monitoring or troubleshooting, with restricted access.

Sharing, storage and security

We use providers including Microsoft Azure, Azure OpenAI and Application Insights for hosting, response generation, analytics and monitoring. Information may also be shared with authorised personnel, the organisation providing your access, and advisers or authorities where needed or required by law.

Funders receive aggregated, non-identifying reports, not raw chat transcripts. Only selected authorised personnel may access transcripts for a valid support, security, quality or governance reason.

The application is hosted in Microsoft Azure UK South. Where limited access from outside the UK is needed for supplier support or service operation, we use appropriate safeguards. Protection includes encryption, restricted access, monitoring and retention controls.

How long we keep information

Our standard retention periods are:

Enquiries

Up to 24 months after the last meaningful contact.

Raw directory analytics

Up to 12 months.

Aggregated directory statistics

Up to 5 years, or longer where individuals are not identifiable.

Application technical logs

Up to 90 days.

Authentication and access logs

Up to 12 months.

User accounts

While active, then up to 12 months after closure.

Chat transcripts

Up to 12 months by default.

These periods may vary for customer agreements, legal duties, investigations, regulatory requirements or technical limitations. Backup copies may remain for a limited period before being overwritten or securely deleted.

Contact & your rights

Depending on the circumstances, you can ask to access, correct, delete or restrict use of your personal data, object to processing based on legitimate interests, or request a portable copy of certain data. Where processing relies on consent, you can withdraw it.

Email legal@askenact.com to ask a question or exercise your rights. We normally respond within one month and may need to confirm your identity. If a request is complex and needs more time, we will explain why. Requests about application content may need to go to the organisation that provided access.

You also have the right to complain to the Information Commissioner's Office (ICO), or call 0303 123 1113.