Acceptable Use Policy

1. Where this policy applies

These requirements apply to the website’s public facilities. They apply to a paid system or service only where incorporated into its terms. Use a facility only for a lawful purpose and within the access granted to you.

2. Prohibited activity

• Fraud, impersonation, misleading payment instructions or knowingly false submissions.
• Accessing another person’s account, records or request thread without authority; guessing, stealing or sharing credentials.
• Malware, disruptive automation, denial of service, security bypasses or deliberate interference with records.
• Spam, harassment, threats, unlawful discrimination, sexual exploitation or other unlawful content.
• Infringing another person’s privacy, confidentiality, intellectual property or contractual rights.
• Using a service to conceal unlawful financial activity, fabricate evidence or evade a legal obligation.
• Scraping protected information or circumventing access controls, rate limits or contractual restrictions.

Ordinary lawful linking, permitted search indexing and rights allowed by law are not prohibited simply because they use technology.

3. Information and access

Submit only information needed for the task and which you are authorised to share. Keep access keys and account credentials private. Do not submit sensitive records through a public form when an agreed secure route is needed. Tell us if a person should no longer have project access.

A business using a commissioned system remains responsible for assigning its users appropriately, supervising the work and entering accurate information, alongside any agreed supplier duties.

4. Security reports and testing

If you encounter a suspected security issue, stop testing when you have enough information to describe it. Do not access unrelated records, copy a dataset, change information, disrupt a service or publish another person’s details. Use the Policy Request Centre with the “Security report” category and provide a minimal description.

This policy does not authorise penetration testing, grant access to third-party systems, promise a bounty or provide immunity from the law. Testing beyond ordinary authorised use requires written, scoped permission. We assess good-faith reports proportionately and according to the facts.

5. Our response to misuse

We may investigate, restrict affected activity, preserve necessary evidence or suspend access where reasonably necessary to protect people or comply with law. Where appropriate, we provide notice and a chance to remedy; urgent risks may need immediate action.

We do not apply penalties or confiscate client data merely because a report or complaint is inconvenient. Any account or service action remains subject to the contract and applicable law. A decision can be raised through the complaints process.