Acceptable Use Policy

This policy applies to everyone with an account on a Neturon portal:

• employees, contractors and temporary staff using the employee portal
• people at client organisations using the client portal
• anyone else Neturon gives an account to, for example an auditor or adviser

Client administrators are responsible for the accounts they create for their colleagues, and must tell Neturon promptly when someone no longer needs access.

• Your username, password, authenticator app and recovery codes are for you alone. Never share them, write them where others can see them, or let anyone else use your session.
• Choose a password you do not use anywhere else. A password manager is the easiest way to do this.
• Two-step verification is required for every account. Keep your recovery codes somewhere safe and offline.
• Sign out when you finish, especially on a shared or public device.
• Neturon staff will never ask for your password or a two-step code. Anyone who does is not genuine: report it.
• If you think someone else has used, or knows how to use, your account, change your password and report it straight away (section 9).

• Staff: your work for Neturon, such as your own profile, leave, projects, tasks, support tickets, client work and the records your role needs.
• Clients: your organisation's dealings with Neturon, such as projects, documents, support requests and messages with your Neturon team.
• Only look at, change or download information you need for that purpose. Being able to open something does not mean you should: access is for a business need, not curiosity.

You must not:

• use or try to use another person's account, or access information you are not authorised to see
• test, scan, probe or try to get round the portals' security, including two-step verification and permissions, unless Neturon has authorised it in writing as security testing
• upload anything containing viruses or other harmful code, or anything you do not have the right to share
• post or send anything unlawful, defamatory, harassing, discriminatory or obscene, or anything that breaches someone's confidence
• copy, export or forward personal or confidential information for any purpose other than your work, including to a personal email address, personal cloud storage or personal device, unless Neturon has approved it
• put personal or client confidential information into public or unapproved online services, including AI chat tools, translation sites and file converters
• use automated tools, scripts or scrapers against the portals, other than the approved API with your own account
• pretend to be someone else, or alter, forge or copy an identity card, visiting card, document or record
• use the portals for personal business, political campaigning or anything else unrelated to Neturon

Accessing a computer system without authorisation, or beyond the access you were given, can be a criminal offence under the Computer Misuse Act 1990 and equivalent laws in other countries.

• The portals hold personal data about staff, clients and other people. You must handle it in line with UK data protection law (the UK GDPR and the Data Protection Act 2018) and only for the purpose it was collected for.
• Client information is confidential to that client. Do not share it with another client or outside Neturon.
• If you download a report, card file or document, keep it secure, do not share it further than necessary, and delete it when you no longer need it.
• Records marked HR-confidential, and notes from one-to-ones and reviews, are seen only by the people the portal allows. Do not copy them anywhere else.

• Keep messages and comments professional. They are business records of Neturon, or of your organisation for client users, and may be read by colleagues with a business reason, disclosed in a legal claim, or provided in response to a data protection request.
• Do not use portal messages for anything you would not be comfortable seeing in a business record.
• Neturon does not routinely read individual messages. A specific person's messages or account activity are reviewed only when there is a clear and proportionate reason, such as investigating a security incident, suspected misuse or a legal requirement. The review must be authorised by a director and recorded, as described in section 8.

• Identity cards and visiting cards remain Neturon's property. Only use them for Neturon business.
• Do not lend, copy or alter a card, or share its print file.
• Report a lost or stolen card within 24 hours so it can be revoked. A revoked card shows as invalid when anyone checks it.
• Return your identity card when asked, or when you leave.
• An identity card shows that you work for Neturon. It does not give access to any building or system.

To keep the portals secure, and to meet our legal duties, the portals automatically record:

• sign-ins, failed sign-ins, sign-outs and two-step verification changes, with the date, time, IP address and browser
• important actions, such as changes to records, roles and permissions, documents uploaded or downloaded, reports exported, and cards issued, downloaded or revoked

We rely on our legitimate interests in keeping systems and information secure and preventing misuse, and on our legal obligations, not on your consent. Only a small number of authorised staff can see these records. They are kept only as long as the Privacy Notice says.

We do not use these records to watch how individuals work day to day. Records about a particular person are reviewed only for a specific, proportionate reason (section 6). Neturon may share them with the police or other authorities where the law requires or allows it.

Report straight away if:

• you think your account, or someone else's, has been used by the wrong person
• personal or confidential information may have been lost, sent to the wrong person or seen by someone who should not have seen it
• you see something in the portals that looks wrong, such as access you should not have
• a card has been lost, stolen or misused

Staff should tell their manager or a portal administrator. Clients should tell their Neturon account manager. You can also email services@neturon.com.

Report quickly, even if you are not sure. Some data breaches must be reported to the Information Commissioner’s Office within 72 hours. Nobody will be criticised for reporting a genuine concern in good faith.

• Neturon may suspend or remove access while a concern is looked into.
• For staff, breaking this policy may lead to action under the disciplinary procedure. A serious breach may be gross misconduct.
• For client users, Neturon may suspend the account and will raise the matter with the client organisation under its agreement with Neturon.
• Where the law may have been broken, Neturon may report it to the police or other authorities.

• Your access ends on your last day, or when your organisation tells Neturon you no longer need it.
• Return your identity card, and delete any portal information you downloaded to your own devices.
• The duty to keep personal and confidential information confidential continues after you leave.

Neturon may update this policy, for example when the portals change or the law changes. We will tell you about important changes before they take effect, and the current version is always on this page.

Questions about this policy can be sent to services@neturon.com.