Axxo — Transparency notice for organisations and people in our data

Status: Draft for legal review. Not yet published. Version: 0.1 draft · Date: 7 September 2026 · Next review: within 12 months of publication Controller: Axxo · Contact: privacy@axxointel.com · Post: Data Protection, Axxo (registered office) Public location when published: https://axxointel.com/transparency (non-paywalled, no login, no cookie wall)

This notice exists because we hold information about organisations and, in a minority of cases, about individuals, that we did not get from those organisations or individuals. We got it from information that UK public bodies are required by law to publish. UK GDPR Article 14 gives you the right to be told about that. This page is how we tell you, and it is the "making the information available publicly" measure required by Article 14(7).

If you are a customer of ours, or a visitor to our website, a separate notice covers you: see "Privacy notice for customers and website visitors".

1. Who we are

Axxo builds procurement intelligence for companies that sell to UK local government. We take information that councils and central government publish about what they buy and who they pay, organise it, and present it to subscribing supplier organisations so they can understand a market they already sell into.

We are the controller for the processing described on this page. We decided to collect this information and we decided what to do with it.

2. What we hold, and where it comes from

We collect from sources that public bodies publish under a statutory or policy duty:

Most of what we hold is information about companies, and information about a company is not personal data. Three categories are, or may be, personal data:

Sole traders and individually named payees. Where a council pays a sole trader, a partnership, or an individual, the payee name published in the spending file can be the name of a person. This is the largest category and the reason this notice exists.

Individuals identifiable from a description field. A payment narrative occasionally names or describes a person.

Officers and persons with significant control. Where we match a payee to a registered company, the Companies House record includes named officers and PSCs.

3. What we do not hold

We do not build or sell contact data. Our customer product contains no buyer contact names, no job titles, no work email addresses and no direct telephone numbers, and the technical contract between our systems rejects contact records outright. If you are a public-sector officer, you are not in the product our customers see.

We hold a small number of business contact records for our own sales and research contact, entirely separately from the product. Those records never enter a customer workspace, and section 9 explains them.

We do not collect special category data — nothing about health, race, religion, politics, sex life, sexual orientation, trade union membership, genetics or biometrics — and we do not use the data to make automated decisions that produce legal or similarly significant effects about any individual.

4. What we do with it

We standardise the published records; we classify each payment to a service category; we resolve payee names to the registered legal entity behind them where we can; and we calculate aggregate measures — how much an authority spends in a category, which suppliers hold what proportion of it, where spend is moving, and where a subscribing supplier has no presence.

Our customers are supplier organisations. Each sees a scoped view of the market relevant to their own business. They use it to plan which authorities to approach and to understand their competitive position. They do not receive our raw evidence store; they receive a published, versioned extract.

5. How we protect individuals in the data

Natural-person suppression. Payees that resolve to a natural person rather than a registered entity are suppressed or pseudonymised before anything reaches a customer. This is enforced in the compilation pipeline, is covered by automated tests, and is auditable. It is not a manual habit and it is not left to an operator's judgement at publication time.

Aggregate-first design. Customer-facing measures are aggregates by authority, category and supplier entity. An individual's transaction is not the unit of analysis and is not the unit of sale.

Evidence separation. The store holding raw published evidence is not reachable from the customer product. The only path is a scoped, signed, published extract, and it carries only the records approved for publication.

Publication review. Editions are compiled from reviewed, accepted evidence and require signed human approval before any customer sees them.

No enrichment. We do not append data from data brokers, credit reference agencies, marketing lists, social media or the open electoral register. We do not attempt to identify people who are not identified in the source.

6. Our lawful basis

Our lawful basis is legitimate interests — UK GDPR Article 6(1)(f). Our interest is in providing accurate market intelligence about how public money is spent, and our customers' interest is in understanding a market they operate in. We have assessed that interest against the rights and freedoms of the individuals concerned in a written Legitimate Interests Assessment, which we will provide on request.

Two things we want to state plainly, because they are sometimes glossed over in this industry.

First, the fact that information is already public does not by itself make our use of it lawful. The public body publishes under its own legal duty. Our republication is a separate act needing its own basis, and the basis we rely on is the one above.

Second, the Open Government Licence, under which most of this material is released, expressly does not cover personal data in the information. Where a published file contains personal data, that data is not licensed to us by the OGL, and our handling of it rests on Article 6(1)(f), the safeguards in section 5, and the rights in section 8 — not on the licence.

7. Why we did not contact you individually

Article 14 normally requires us to tell each person directly. We rely on the exception for disproportionate effort in Article 14(5)(e), and we have carried out the assessment that Article 14(6) requires, weighing the number of people involved, the age of the data and the safeguards we apply.

In summary: the published files identify people only by a payee name, usually without an address and never with an email address, so contacting each one would require us to research contact details for a large number of people who have not given them to us — a more intrusive act than the processing itself. Instead, as Article 14(7) requires, we publish this notice openly and permanently, we suppress natural-person payees from what customers see, and we operate the routes in section 8. Our full assessment is available on request.

8. Your rights, and how to use them

You can ask us to:

• tell you what we hold about you — a subject access request;
• correct it if it is wrong, including where a payment has been attributed to the wrong entity;
• erase it;
• restrict what we do with it while a dispute is resolved;
• stop processing it — an objection under Article 21(1);
• give it to you in a portable form, where that right applies.

How to reach us. By web form at https://axxointel.com/transparency/request, by email to privacy@axxointel.com, or by post to the address at the top of this page. You may use whichever you prefer; we do not require you to use the form.

What happens then. We acknowledge within 5 working days and in any event within 30 days. We respond to subject access requests within one month, which we may extend by up to two further months for complex requests — if we extend, we will tell you within the first month and explain why. For an objection, we decide case by case, we record our reasoning, and we tell you the outcome. Where we cannot identify you in our data from what you have given us, we will say so and tell you what would help.

Objections. An objection under Article 21(1) is a balancing test in law rather than an absolute right, and we will not pretend otherwise. In practice, we do not expect to have a compelling reason to keep publishing an individual's own transactions to that individual's competitors against their objection, and our normal outcome will be to suppress. We assess each objection on its own facts, we record the decision, and we tell you the result and your right to complain if you disagree.

Complaints. If you are unhappy with how we have handled your information, tell us using any of the routes above and we will investigate, keep you informed of progress, and give you an outcome. You can also complain to the Information Commissioner's Office at ico.org.uk, 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. You do not have to complain to us first.

Correcting a business record. If you are a supplier and a payment or contract has been attributed to the wrong company, use the same routes. We will investigate, correct the attribution where we agree, and record the correction so it survives future recompilation.

9. Business contacts held for our own outreach

Separately from the product, we hold limited business contact records — name, role, organisation and a business contact route — for people at organisations we may approach about our services. We rely on legitimate interests, we take these from sources the person or their organisation has made public in a business context, and we keep them for 24 months from the last meaningful interaction and then delete them.

These records are never included in a customer workspace, never form part of a published extract, and are never sold. You can object at any time using the routes in section 8, and for marketing that objection is absolute — we will stop and suppress.

10. How long we keep things

Full transaction-level rows are held for the current and one immediately preceding published version of a dataset. Older versions are retained as manifests and aggregate figures rather than as full rows. Published extracts are retained in an immutable archive so that a figure a customer saw can be reproduced and audited. Our analysis window is 36 months.

Where we suppress an individual following an objection, the suppression is applied at compilation so that it persists into every subsequent version, rather than being a one-off edit that later recompilation could undo.

11. Where your information is held

Our systems run on infrastructure in the United Kingdom and the European Economic Area. Some service providers process limited data outside the UK, and where they do we put an approved transfer mechanism in place. Our sub-processor and transfer register lists every provider, what it handles and where, and is published at https://axxointel.com/sub-processors.

12. Changes

We will update this notice when our processing changes and will show the version and date at the top. Material changes will be summarised here for at least 12 months.