Terms of Use & Information Notice

Terms of Use · Version 1.2

Version 1.2. Effective 24 September 2026. Replaces the version of 21 September 2026.

1. Definitions and Interpretation

1.1 In these Terms:

Authorised User means a natural person to whom the Operator has granted access to the Portal and whose name and email address are recorded in the Operator's authorised access register.
Information means any data, content, file, document, status indicator, date, narrative or communication made available through or displayed on the Portal.
JV Agreement means the joint venture, partnership, co-ownership or other agreement or instrument constituting the joint enterprise of the parties in respect of the Property.
Operator means the project director acting on behalf of the joint venture in respect of the Property.
Portal means the password-protected web interface accessible at the URL notified to the Authorised User from time to time, together with all underlying software and infrastructure.
Property means 575–597 Pacific Highway, New South Wales, Australia.
Reporting Channels means the formal reporting, notification and communication channels established under the JV Agreement.
Terms means these Terms of Use, as amended from time to time.

1.2 Headings are for convenience only and do not affect interpretation. References to legislation include any subordinate instrument and any successor legislation.

2. Acceptance and Scope

2.1 By accessing or using the Portal the Authorised User agrees to be bound by these Terms.

2.2 These Terms govern access to and use of the Portal only. They do not vary, supplement, supersede, derogate from, novate or otherwise affect the JV Agreement or any other agreement, duty, right or obligation between the parties at law or in equity.

2.3 To the extent of any inconsistency between these Terms and the JV Agreement, the JV Agreement prevails.

3. Authorised Access; Non-Transferability

3.1 Access to the Portal is personal to each Authorised User. Credentials, login links, one-time sign-in codes, session tokens and any other means of access ("Credentials") must not be:

(a) shared with, transferred to, or made available to any other person, including any legal, accounting, financial, technical, consulting or other advisor of the Authorised User or its principal;
(b) deliberately recorded or stored in a way that makes them available to another person; or
(c) used to procure or facilitate access by any other person.

3.2 The Authorised User must immediately notify the Operator if the Authorised User becomes aware of any actual, suspected or threatened unauthorised access using their Credentials, or any compromise of the email account to which Credentials are sent.

3.3 The Operator may revoke, suspend or restrict Portal access where credential sharing or unauthorised access is reasonably suspected, or for the security or integrity of the Portal. Any such revocation, suspension or restriction affects access to the Portal only. It does not affect, and is not intended to affect, any right or entitlement of any person to the records, books or information of the joint venture arising under the JV Agreement, at law or in equity; and where Portal access is revoked, suspended or restricted, the Operator will continue to make available, by other reasonable means, any Information to which the person is otherwise entitled.

3.4 For security, a sign-in ends after 30 minutes without activity, and in any event 45 minutes after signing in. An Authorised User may hold at most two sign-in sessions at once — two sessions, which may both be in the same browser on the same device, rather than two devices — and a third sign-in ends the oldest of them. Repeated incorrect codes suspend sign-in for a period. Longer sessions apply to the Operator's own administrator accounts, which are not subject to the 45-minute limit.

4. Permitted Use

4.1 The Portal is provided as an indicative, view-only reference of general project status information. The Authorised User may use the Portal solely to view Information for the purpose of being kept generally informed of project status (the "Permitted Use").

5. Prohibited Conduct

5.1 Subject to clause 5.2, the Authorised User must not:

(a) copy, reproduce, screenshot for further distribution, scrape, mirror, harvest, index, extract or systematically retrieve Information except as strictly necessary for the Permitted Use;
(b) publish, redistribute, transmit, communicate or disclose Information to any third party;
(c) attempt to bypass, defeat or circumvent any access control, authentication mechanism, rate-limit, security measure or audit function of the Portal;
(d) use automated means to attempt to reconstruct data the Portal does not display;
(e) use the Portal in any manner inconsistent with the Authorised User's obligations or its principal's obligations under the JV Agreement, at law or in equity; or
(f) use the Portal to interfere with its operation or with another Authorised User's access.

5.2 Nothing in these Terms prevents, and the Operator does not by these Terms seek to prevent, the copying, reproduction, retention, disclosure or use of Information:

(a) to the Authorised User's principal and to that principal's officers, employees and other authorised representatives, and to any other participant in the joint venture;
(b) to a legal practitioner, accountant, auditor, valuer, financial adviser or expert engaged by the Authorised User or its principal for the purpose of obtaining advice, where that person is told the Information is confidential;
(c) where required by law or by order, subpoena or other compulsory process of a court, tribunal or regulator;
(d) to a law enforcement agency or regulator;
(e) for the purpose of protecting or enforcing the legal rights of the Authorised User or its principal, including in any pleading, affidavit, witness statement or other document filed in a proceeding; or
(f) the retention of a copy of Information for any purpose in (a) to (e) above.

5.3 Where the Authorised User proposes to disclose Information in a proceeding in reliance on clause 5.2(e), the Authorised User is asked to give the Operator not less than five (5) business days' written notice beforehand, unless giving that notice would be impracticable or would prejudice the Authorised User's position. The sole purpose of that notice is to allow the Operator to apply to the court for such confidentiality, suppression or non-publication orders as the court thinks fit. Failure to give that notice does not render the disclosure a breach of these Terms where the disclosure was otherwise permitted by clause 5.2. The Operator will not revoke, suspend, restrict or terminate access under clause 3.3 or clause 15.1 by reason of a disclosure permitted by clause 5.2, or of a failure to give notice under this clause.

6. Information is Indicative and Subject to Change

6.1 All Information made available on the Portal is:

(a) indicative only and prepared in good faith from the project record at the time of refresh;
(b) capable of being incomplete, superseded, inaccurate or out of date, including by reason of subsequent events, revised assessments or correction of error; and
(c) subject to update, correction, withdrawal, redaction or revision at any time without notice.

6.2 Forward-looking statements (including target dates, sequenced milestones, estimated completion dates, and indicative timelines) are estimates only. They are not commitments, undertakings or warranties. Actual outcomes may differ materially.

6.3 The "Snapshot" indicator displayed on the Portal records the time at which the Information then displayed was retrieved from the project record. The Information may not reflect events occurring after that time.

6.4 Some of the text displayed on the Portal — the short “In short” summary and the one-line headline shown on an update card — is generated automatically by a language model from the underlying project record. It is not written by the Operator and no person checks it before it is shown; it is checked automatically against the update it was made from, and is not shown at all if that check fails. Text produced this way is marked “AI” wherever it appears. On a card the summary is shown instead of the opening of the update, not above it; the full update text is always available by opening the update, and it prevails over the summary and the heading in every case. The Operator may change or withdraw this feature at any time.

6.5 The Portal displays a selected part of the project record. The Operator determines which items, updates and documents are published to it, and some file types cannot be displayed in the Portal at all. Nothing on the Portal is, or is intended to be, a complete account of the project. This clause does not affect any right to the records of the joint venture under the JV Agreement, at law or in equity.

7. No Representation, Warranty or Undertaking

7.1 Subject only to clause 7.2, no Information made available on the Portal constitutes a representation, warranty, undertaking, assurance or promise (whether express or implied, oral or written) by the Operator, the joint venture, or any participant in or related body corporate of the joint venture, in relation to:

(a) the accuracy, completeness, currency, reliability, suitability or fitness for any purpose of any Information;
(b) the achievement, non-achievement or timing of any forward-looking matter; or
(c) any other matter touching the Property, the joint venture, or the project.

7.2 Nothing in these Terms is intended to exclude, restrict or modify any guarantee, right, remedy or liability that cannot be excluded, restricted or modified by law, including the non-excludable provisions of the Australian Consumer Law (Schedule 2 to the Competition and Consumer Act 2010 (Cth)) or any State or Territory equivalent.

8. No Reliance

8.1 The Authorised User acknowledges that:

(a) the Portal is not a substitute for the Reporting Channels, and the Authorised User and its principal will not treat Information on the Portal as the formal record of any matter;
(b) any decision requiring formal, accurate or current information will be made only on the basis of records and communications provided through the Reporting Channels;
(c) the Portal is not, and is not intended to operate as, the means by which any joint venture participant discharges any reporting, disclosure, notification, consultation or accountability obligation owed under the JV Agreement, at law or in equity; and
(d) the Authorised User has and will continue to make its own independent inquiries, take its own advice, and form its own views in respect of all matters relevant to the joint venture.

9. Limitation of Liability

9.1 To the maximum extent permitted by law, the Operator excludes liability to the Authorised User and its principal for loss arising out of the Portal being unavailable or delayed, or displaying Information that is incomplete or out of date. This clause does not limit any duty owed under the JV Agreement, at law or in equity.

9.2 Without limiting clause 9.1, the Operator is not liable for any consequential, indirect, special or punitive loss, or any loss of profit, revenue, opportunity, goodwill, anticipated savings or business interruption.

9.3 Nothing in this clause 9 excludes or limits liability for:

(a) fraud or wilful misconduct;
(b) breach of confidentiality;
(c) infringement of intellectual property rights;
(d) any liability that cannot be excluded or limited by law;
(e) misleading or deceptive conduct; or
(f) the Operator's own breach of these Terms.

10. Intellectual Property

10.1 All Information, software, design, structure, layout, code and other content forming part of the Portal is and remains the property of the Operator or its licensors. Nothing in these Terms operates to assign, transfer or licence any intellectual property right except as expressly stated.

10.2 The Operator grants the Authorised User a limited, non-exclusive, non-transferable, non-sublicensable, revocable licence to access and view the Portal solely for the Permitted Use, for as long as access remains in force.

11. Confidentiality

11.1 All Information is provided to the Authorised User in confidence. The Authorised User must:

(a) treat all Information as confidential to the joint venture;
(b) take all reasonable steps (including any steps required by the JV Agreement) to prevent unauthorised access, use, copying, disclosure or distribution; and
(c) comply with any further or more specific confidentiality obligation contained in the JV Agreement.

11.2 The obligations in this clause 11 survive termination of these Terms and termination of access to the Portal.

11.3 Clause 11 is subject to clause 5.2, and does not apply to Information that is or becomes public otherwise than through a breach of these Terms, or that the Authorised User already knew or independently obtains.

12. Access Records

12.1 The Authorised User acknowledges and agrees that the Portal automatically creates a record of certain requests made to it (the “Access Record”), and consents to that recording. Paragraph 2 of the Information Notice below sets out what the Access Record contains and which requests are not recorded.

12.2 Retention. The Access Record is retained for twenty-four (24) months from the date of the access to which it relates, after which it is automatically deleted. The Operator may suspend that automatic deletion, and retain the Access Record for longer, where the Operator is required by law or by an order of a court or tribunal to retain it, or where the Operator reasonably anticipates that it may be required as evidence in a proceeding.

12.3 Purposes. The Access Record is created and used only for the purposes set out in paragraph 3 of the Information Notice below.

12.4 The Access Record, and the record of Information made available at any given time, may be relied on as evidence in any proceeding, mediation, arbitration or other forum, and may be examined, analysed, disclosed to the Operator's professional advisors, or produced in legal proceedings. The Authorised User may obtain a copy of their own Access Record at any time under paragraph 8 of the Information Notice, and may rely on it in the same way.

13. Preservation of Joint Venture Relationship

13.1 The Portal is provided as a courtesy and supplement to the Reporting Channels. Provision of the Portal, any Information through it, or any access by the Authorised User does not:

(a) modify, vary, suspend, replace, release or waive any obligation, right, remedy or entitlement of any joint venture participant under the JV Agreement, at law or in equity;
(b) constitute consent, ratification, election, acquiescence or approval in respect of any matter; or
(c) create any new contractual obligation, fiduciary duty or duty of care between the parties beyond what is expressly stated in these Terms.

14. Variation

14.1 The Operator may amend these Terms from time to time by publishing a revised version on the Portal. The current version number and effective date are shown at the top of these Terms.

14.2 Where these Terms are amended, the Authorised User will be asked to accept the amended Terms at the next sign-in. Continued access after an amendment does not of itself constitute acceptance of it. If the Authorised User does not accept an amendment, clause 3.3 applies to the resulting loss of Portal access.

15. Suspension and Termination

15.1 The Operator may suspend or terminate the Authorised User's access to the Portal in accordance with clause 3.3. Clause 3.3 applies to any such suspension or termination, including the preservation of any entitlement to the records of the joint venture.

15.2 Termination does not affect any accrued right or obligation, including any continuing obligation under clauses 5, 8, 9, 11, 12 and 17, all of which survive termination.

15.3 The Operator may make the Portal temporarily unavailable for maintenance or for technical reasons, by a setting which shows every Authorised User an “offline” notice. The Operator retains access while that setting is in effect. Where unavailability continues for more than two business days, clause 3.3 applies: the Operator will continue to make available, by other reasonable means, any Information to which a person is otherwise entitled.

15.4 The Operator may block a particular device from signing in to the Portal, as described in paragraph 2(g) of the Information Notice. A block is a restriction of Portal access for the purposes of clause 3.3, and clause 3.3 applies to it, including the preservation of any entitlement to the records of the joint venture.

16. Notices

16.1 Notices to the Operator under these Terms must be in writing and given to the email address notified to the Authorised User from time to time. Notices to the Authorised User may be given to the email address recorded in the Operator's authorised access register.

17. Governing Law and Jurisdiction

17.1 These Terms are governed by and construed in accordance with the laws in force in New South Wales, Australia.

17.2 Each party irrevocably submits to the exclusive jurisdiction of the courts of New South Wales and the courts of appeal from them, and waives any objection to the venue or forum.

18. Severability

18.1 If any provision of these Terms is held by a court of competent jurisdiction to be invalid, illegal or unenforceable in any respect, that provision is severed to the minimum extent necessary, and the remaining provisions continue in full force and effect.

19. No Waiver

19.1 No failure or delay by the Operator to exercise any right operates as a waiver of that right. A single or partial exercise of a right does not preclude any further exercise of that right.

20. Entire Agreement

20.1 These Terms constitute the entire agreement between the parties with respect to access to and use of the Portal, and supersede all prior or contemporaneous communications, representations or agreements relating to that subject matter.

Information Notice

This Notice sets out what this portal records about you, why, who else handles it, and how long it is kept. It is provided before you sign in so that you can decide whether to proceed. It follows the standard set by Australian Privacy Principle 5 under the Privacy Act 1988 (Cth). Version 1.2, 24 September 2026.

1. Identity and Contact Details of the Operator

The Portal is operated on behalf of the joint venture in respect of 575–597 Pacific Highway, New South Wales, by the project director ("Operator"). The Operator may be contacted at the email address notified to the Authorised User at the time their access to the Portal was provisioned.

2. What is recorded

(a) What you give us. Your business email address, held in the Operator's authorised access register; and your first and last name, which you are asked for once, the first time you sign in on or after 24 September 2026. Your name is recorded as you enter it. It is kept with your email address, shown to the Operator beside your access records and the devices you use, and used to greet you on the dashboard. You set it once; to have it corrected, ask the Operator, who can clear it so that you are asked for it again at your next sign-in. When you enter your name, the date and time, the name, and the details listed at (c) are added to the Access Record. If the Operator clears it, that is recorded too, without repeating the name.

(b) Signing in. The one-time sign-in code is stored only as a one-way hash and is discarded once used, or after ten minutes if it is not. The session token is discarded when you sign out or after a period of inactivity. A list of your active sessions is kept for up to seven days so that the limit on simultaneous sign-ins can be enforced. When you ask for a code, a short-lived cookie is also placed in your browser so that the code can only be used in the browser that asked for it; it lasts ten minutes.

(c) Recorded automatically when you sign in, open a page, or open a document:

• the date and time of the request;
• the originating network (IP) address your request came from;
• the city, region and country our hosting provider derives from that IP address, together with the postcode where it has one, and an approximate latitude and longitude — this is an estimate of where the network connection is, not of where you are;
• the name of the network or internet service provider associated with that IP address;
• the browser and operating system your browser reports (the browser user-agent string);
• the time zone your browser reports, and the time zone our hosting provider associates with the connection;
• your language settings, as reported by your browser;
• a random identifier we place in your browser so that we can recognise it on a later visit. It is a random string that says nothing about you in itself, but it is stored with the rest of this record and is handled as described in paragraphs 6 and 7. It is set the first time you load any page of the Portal — including this one — before you sign in, and it stays in your browser for twelve months unless you clear your cookies. The time zone described above is recorded in a second cookie, which also lasts twelve months;
• which page, update or document you opened, and when; and
• the time of each recorded event, from which the length of a sitting can be worked out; and
• the fact, time and version of your acceptance of these Terms, recorded each time you ask for a sign-in code — which is the point at which you accept them, so a record is made even if you then do not complete the sign-in.

Not everything you do creates a record. Opening the Portal and opening a document are each recorded every time. The Portal also refreshes itself in the background while you have it open; those automatic refreshes are recorded at most once every fifteen minutes, and the record of which cards you looked at at most once a minute, with anything beyond that discarded rather than stored. Loading the sign-in page, and loading the images and scripts the Portal is built from, creates no record. Separately, the Portal writes short-lived technical records used only to limit the rate of requests — some of them carrying your email address, none lasting longer than fifteen minutes — which expire on their own.

(d) Your device, when you sign in. Each time you sign in, your browser sends the Operator a description of the device you are using. It sends this whether or not the Operator is keeping it.

The Operator keeps those descriptions as a running record of the devices used to sign in to your account — a “device register”. This is a setting the Operator can switch on and off, and switching it does not change this Notice: while it is off, what your browser sends is discarded on arrival and no device record exists; while it is on, the record holds what this paragraph describes. The Operator does not undertake to tell you which it is at any given moment. You may ask, and the Operator will tell you. If you do not ask, proceed on the basis that it is on.

What your browser sends, and what the record holds when it is on, is: the operating system your browser reports; whether your browser describes itself as a mobile or a desktop browser; your screen's size and pixel density, and whether it is a touchscreen; how many processor cores your device has and roughly how much memory; whether the Portal is running as an installed app; your time zone and language settings; and, from what our servers observe, the items at (c) above other than which page or document you opened and your acceptance of these Terms — together with the number that identifies your network, the encryption settings your browser agreed with our servers (the security protocol version and cipher), and the version of the web protocol it used. Everything your browser sends is your browser's own statement about your device, and can be altered by anyone who chooses to. The Operator records those statements as such, separately from what its servers observe, and does not treat the two as the same thing. From them the Operator also stores a short readable description of the device, such as “iPhone · Safari 17 · iOS 17.4” or “iPad or Mac · Safari 18 · macOS 10.15”.

(e) Documents. Every document, image and PDF you open is stamped, before it is sent to you, with your email address and the date and time you opened it. Audio and video are not stamped in this way — the marking shown over the player is added by your browser.

(f) What the Operator works out from this. The Operator reviews these records to check whether sign-in credentials have been shared, and reviews which documents have been opened and when. Where something looks unusual, it is shown to the Operator as a finding when the Operator opens the review console. Findings are worked out from the records each time and are not themselves stored. The following are inferences about you rather than observations: that two sign-ins are too far apart to have been made by the same person travelling between them; that two sign-ins from different places overlap in time, so that more than one person appears to be using the account; that sign-ins from two of your browsers came from two different states or regions close together in time; that your browser's time zone disagrees with the one your network suggests, which may indicate a VPN; that the name of the network a device connects through looks like a hosting or VPN provider rather than a home or office connection; that a browser's description of itself, such as its operating system, disagrees with what the Portal's servers observed; and that a browser used to sign in to more than one account may be a shared computer, one person with two registered addresses, or shared sign-in details. If the Operator marks a finding as reviewed, then the finding's wording and type, your email address, the date it was marked, which of the Operator's administrator accounts marked it, and any note the Operator adds are stored for two (2) years. You may ask for a copy of anything so stored under paragraph 8.

(g) Devices the Operator has blocked. The Operator may block a device from signing in. A blocked device is shown “This device needs approval” instead of the Portal, and any session the Portal can match to it is ended; a session it cannot match ends when it would otherwise expire. The Operator stores which device was blocked, which of its administrator accounts blocked it, when, and any note it adds; that record is kept until the Operator lifts the block, and in any case for no longer than twenty-four (24) months. Each block, each unblock, and each sign-in refused because of a block is added to the Access Record, without the note. A device here is the browser identifier described at (c), so a block applies to that browser, not to a person. Clause 3.3 of the Terms applies to a block.

(h) What is not done. The Portal does not track your activity on any other website, and does not use the hidden identification techniques advertising trackers use (canvas, audio or font fingerprinting). What it does do is set out at (c) and (d): it keeps a record of each device used to sign in, so that devices can be told apart.

3. Why it is collected

The Operator uses this information to:

(a) verify who you are, control access to the Portal, and show the name you give beside your records and in greeting you;
(b) keep an accurate record of who was given access to what project information, and when;
(c) protect the security, integrity and availability of the Portal, and investigate security incidents;
(d) detect and investigate whether sign-in credentials have been shared with, or used by, anyone other than the person to whom they were issued, which clause 3.1 of the Terms prohibits;
(e) where relevant, as evidence in any dispute or proceeding concerning access to or use of the Portal, or an alleged breach of these Terms; and
(f) comply with the Operator's legal obligations.

4. Why the Operator may collect this

No law requires this collection. The Operator collects it to run the Portal as a controlled-access system, and for the purposes in paragraph 3, and the Authorised User is asked to consent to it by accepting these Terms. Consent may be withdrawn by ceasing to use the Portal and notifying the Operator; clause 3.3 then applies.

5. Consequences of Not Providing Personal Information

Provision of personal information is voluntary. However, if the Authorised User does not provide the identity and authentication data described in paragraphs 2(a) and 2(b), the Operator will not be able to verify the Authorised User's identity, and access to the Portal cannot be granted or maintained. Until a first and last name has been entered under paragraph 2(a), the Portal does not show the dashboard; clause 3.3 of the Terms applies while it is withheld, including the preservation of any entitlement to the records of the joint venture.

6. Who else handles it

The Operator uses the following service providers. Where a provider receives information about you, that is stated.

• Cloudflare, Inc. (United States) — receives all of it: hosts the Portal, runs the network it is served from, stores sessions and the Access Record, and derives the location and network information described in paragraph 2(c);
• Resend, Inc. (United States) — receives your email address, in order to send you the sign-in code;
• monday.com Ltd (United States and Israel) — holds the underlying project record and the documents the Portal displays. It does not receive the records described in paragraph 2;
• CloudConvert GmbH (Germany) — converts a document to a readable format where that cannot be done on the Operator's own servers, and applies the stamp described at 2(e) to larger documents and whenever the Operator's own servers cannot apply it. When it applies the stamp, your email address is sent to it with the document — including for documents that needed no conversion. Documents may also be converted in advance of anyone opening them. A converted copy carrying no identifying information is then kept for 30 days so the document need not be converted again — that copy is held by the Operator on Cloudflare, not by CloudConvert;
• Anthropic PBC (United States) — its language model generates the short summary and the headline shown on an update card. It is sent the text of the update it is summarising, and nothing else: it is not sent the records described in paragraph 2, is not told who is reading the Portal, and has no access to the Portal. It is not sent your name or email address as a separate item — but updates are frequently written by forwarding an email, so where an update itself contains a name, an email address or a message header, that text is sent with the rest of the update. The Operator does not strip it out beforehand.

It may also be disclosed to: the Operator's legal, accounting, technical and audit advisers; other participants in the joint venture, in connection with their respective rights and obligations under the JV Agreement; and any court, tribunal, regulator or law enforcement body where required or permitted by law, including under subpoena, discovery order or notice to produce.

7. Overseas handling

As paragraph 6 shows, your information is handled outside Australia — in the United States, Israel and Germany. The Operator has taken reasonable steps to ensure each provider handles it appropriately, but the Operator cannot guarantee that an overseas provider will handle it consistently with Australian law, and you may not be able to enforce Australian privacy protections against a provider located overseas.

8. Access and Correction

The Authorised User may request access to, or correction of, the personal information held by the Operator about the Authorised User. Requests should be made in writing to the Operator at the contact email referred to in paragraph 1. The Operator will respond within 30 days. Where the Operator refuses access or correction, it will give written reasons. You may also ask for a device record described at 2(d) to be deleted. A name described at 2(a) is corrected by the Operator clearing it, after which you are asked for it again at your next sign-in.

9. Complaints

If you are concerned about how the Operator has handled your information, write to the Operator at the address in paragraph 1. The Operator will respond in writing within 30 days. If you are not satisfied with that response, you may take the matter further. Depending on whether the Privacy Act 1988 (Cth) applies to the Operator, that may include a complaint to the Office of the Australian Information Commissioner (oaic.gov.au), or a claim in a court. The Operator does not assert that the Act does or does not apply to it, and nothing in this Notice limits any right you have.

10. How long it is kept

The Access Record described in paragraph 2(c) is kept for twenty-four (24) months from the date of the access it records, and is then automatically deleted.

While the device register described in paragraph 2(d) is switched on, it keeps a single running record for each device. That record is kept while the device continues to be used to sign in, and is deleted twenty-four (24) months after the last sign-in from it. It holds the date the device was first seen; the number of sign-ins; the twenty most recently used email addresses that have signed in from it; the readable description at 2(d); the most recent value of each item listed at 2(d); and the last fifty sign-ins, each with its date, the email address used, the IP address, the location and the network. Because it is a running record, the date a device was first seen is kept for as long as that device stays in use.

That record is matched to your browser by the identifier described at 2(c), which lasts twelve months. A device not used for more than twelve months therefore returns as a new one, and the earlier record sits out the rest of its twenty-four months unmatched. This is a limit of the method, and it is stated so that the record is not taken for more than it is.

A record of when you last visited, used to mark what is new to you, is kept until your next visit replaces it. It is not deleted automatically when your access ends; you may ask for it to be deleted under paragraph 8. Your email address is held in the authorised access register for as long as your access is current, and is removed from it when your access ends; it remains inside the Access Record, which runs out its twenty-four months as described above. The name described at paragraph 2(a) is kept for twenty-four (24) months from when it is entered, or until the Operator clears it, whichever is sooner; the Access Record entry made when it was entered is part of the Access Record and runs its own twenty-four (24) months. A block described at 2(g) is kept as stated there. Findings and notes described in paragraph 2(f) are kept for two (2) years. Sign-in codes and session tokens are dealt with in paragraph 2(b).

Where something goes wrong inside the Portal it also records a short diagnostic note of the failure, which contains no email address, IP address or other item listed at 2(c) and is deleted after thirty (30) days.

Revoking or suspending access does not delete the Access Record, or any device record where one exists; each runs its period out as described above.

The Operator may suspend that automatic deletion, and keep the records for longer, where it is required by law or by an order of a court or tribunal to do so, or where it reasonably anticipates that the records may be required as evidence in a proceeding.

11. If these records are compromised

If the Operator becomes aware that these records have been accessed by someone who should not have them, and that this is likely to cause you serious harm, the Operator will tell you and describe what happened and what you can do about it.

12. Changes to this Notice

This Notice is versioned and dated. Where it changes in a way that materially affects what is recorded about you, how long it is kept, or why, you will be asked to accept the revised Terms and Notice the next time you sign in. Superseded versions are retained and are available from the Operator on request.