Your details.
A clear explanation.

Last updated: 9 October 2026. This notice covers the marketing website and enquiry correspondence.

Who operates Civion?

Civion Systems is operated by Atlas Construction Projects Limited.

Registered in England and Wales · Company number 13755009
Registered office: 17 Millpond Lane, Faygate, Horsham, England, RH12 0AQ

The operator is responsible for deciding how website enquiry information is used (the data controller).

For website privacy questions, contact hello@civion-systems.com.

When you browse

This version of the website does not add marketing analytics, advertising pixels, embedded social feeds or storage of enquiry fields in your browser. Its fonts and product screenshots are served with the website. The enquiry form uses checks within the website to reduce spam, as explained below. It does not load a third-party CAPTCHA.

Railway hosts this website and processes connection information such as an IP address, requested page, browser information and request time to deliver and protect it. The selected website service is in the United States. Our Data Processing Addendum with Railway governs its processing on our behalf. Railway also handles account and service-usage information for its own purposes under its privacy policy, which describes keeping device/IP information while needed to operate its systems, with longer retention for applicable legal needs. Its published log-access window is not a promise of permanent erasure.

When you send a demo enquiry

When you press Send enquiry, your name, company, work email, chosen topic and optional message are submitted to the website server. The server validates the details, checks for spam and sends them to the Civion enquiry inbox through Google Workspace. Your email address is used as the reply address so we can answer your enquiry and arrange the walkthrough you requested.

The website does not keep a database of enquiry messages or log their contents. Messages are processed temporarily while sending and then held in the email service. Sending from this form does not require your own email application. The direct email link remains an alternative and uses your email provider.

How we reduce spam

The website prepares a short-lived form token and checks it before sending. On the contact page, it sets a first-party security cookie called __Host-civion-enquiry to keep the token with the browser that prepared the form. The cookie contains a random identifier and expires 30 minutes after the most recent preparation. It is used only to protect the enquiry form, contains no enquiry details and is not used for advertising or analytics.

The form also checks submitted fields, uses a hidden bot-trap field and limits repeated attempts. The server temporarily keeps form tokens and security identifiers derived from the cookie and connecting IP address in memory. Tokens expire after 30 minutes and are removed when used or on the next request after expiry. Attempt counters reset on the next request after a 15-minute window. Restarting the server clears these records and invalidates prepared forms. Hosting logs are separate. If cookies are blocked, use the direct email link instead.

Who handles your enquiry

Enquiries are handled by the business owner, who is the only person with routine access to the enquiry inbox. We use Google Workspace Business Starter to deliver and store enquiry emails. Google processes mailbox information under its Cloud Data Processing Addendum. Its subprocessor list describes other organisations involved in providing the service.

The owner also uses classic Outlook for Windows to read this mailbox. Its controlled copies are included in our enquiry retention procedure. Automatic mailbox forwarding is disabled, and no forwarding filters or delegated mailbox access were shown in the account review. This does not prevent the owner replying to or manually forwarding a message when needed for the enquiry.

Why we use your details

We rely on our legitimate interest in answering requested business enquiries and arranging demos. We also rely on our legitimate interest in delivering the website, keeping it available and protecting the enquiry inbox from abuse. We have assessed the purpose, necessity and impact of these uses. These purposes do not authorise unrelated marketing or replace any required cookie consent.

Please provide only the information needed for your enquiry, without passwords, payment details or sensitive information about yourself or other people. The name, company, email and topic fields are required by this form; the message is optional. You can contact us directly by email instead.

Provider locations

Google and its service providers operate internationally, so processing may take place outside the UK. Google’s published contractual safeguards include a UK International Data Transfer Addendum in Annex V of its transfer clauses, where those clauses apply. You can contact us for information about the applicable safeguards. We do not promise UK-only storage.

Our Data Processing Addendum with Railway includes UK transfer provisions, as described in its published terms. We review additional email clients, backups and connected services before using them for enquiry information.

Apart from the enquiry security cookie described above, this version of the marketing website does not set cookies or use local or session storage. Visiting the separate Civion application, your email service or another linked website is subject to that service’s own arrangements.

How long enquiry emails are kept

Our policy is to delete unsuccessful demo enquiries 12 months after the last meaningful contact. The business owner is responsible for reviewing these records monthly, including copies in Sent and Archive, and deleting expired enquiries. The website does not perform mailbox deletion.

The monthly review also covers Outlook and any controlled copies. Moving a message to Archive or removing a label is not deletion. The mailbox is not configured to delete old messages automatically; the business owner applies the enquiry policy.

Deleting an email does not immediately erase all provider copies. Gmail normally keeps deleted messages in Trash for 30 days; Workspace administrators have a further recovery period for recoverable deleted mail. Google Vault retention rules or holds, if used, can retain messages longer. No Vault subscription was displayed in the reviewed subscription list; this is not a guarantee that every recovery or retention mechanism is absent.

Google’s data-processing agreement provides for system deletion as soon as reasonably practicable and within a maximum period of 180 days after a deletion instruction under that agreement, subject to legal storage requirements. For deletion during the service, that instruction takes effect when the data can no longer be recovered by us, rather than when it first enters Trash.

If you become a customer, we keep correspondence only while needed to deliver an active service, manage your account, resolve outstanding matters or meet a specific legal or accounting obligation. The business owner reviews this need at least annually and after the relationship ends, deletes correspondence no longer needed and records the reason for any exception. This review includes controlled Outlook copies. We do not retain every customer email indefinitely or apply one accounting period to all correspondence.

Marketing and automated decisions

The website does not enrol you in a mailing list or submit your enquiry to an AI model. Workspace smart features are off for the enquiry mailbox. Gmail as a Workspace Intelligence source and the separate Gemini app’s Workspace connector are configured off; Google says changes to Intelligence sources can take up to 48 hours to apply. These settings do not erase information previously copied into an AI conversation or prevent someone manually sharing content with another service. We do not use enquiry emails for AI assistance.

Automated spam checks can prevent a form submission; you can use the direct email link if the check fails. An enquiry is not a newsletter subscription. Any future marketing, tracking or AI use needs a separate review and an updated notice.

Your privacy rights

Depending on the circumstances and the lawful basis used, UK data protection law gives you rights to access your personal information, correct it, request deletion, restrict its use and obtain a portable copy.

Your right to object: you can object to direct marketing and, in certain circumstances, processing based on legitimate interests. Where processing relies on consent, you can withdraw that consent.

Contact hello@civion-systems.com to raise a privacy question or request.

You can also raise a concern with the Information Commissioner’s Office (ICO).

The Civion application and other services

This notice covers the marketing website and enquiry correspondence. It does not describe how the authenticated Civion application handles customer projects, workforce records, connected customer mailboxes or billing. Those services require their own relevant privacy information.

Keeping this notice current

We review this notice when the way we handle website information changes. The date above identifies the current wording. Contact us if you have questions about it.