Acceptable Use Policy

Last updated: 8 September 2026

This policy sets out how the OZ Project Portal must be used. It forms part of the Terms of Use and applies to everyone with an account. It is written to be practical rather than exhaustive: if something is not listed but is obviously wrong, it is still not allowed.

1. What the Portal is for

The Portal exists to hold and exchange drawings, documents and project information for live construction and engineering projects. Use it for that. Do not use it as general file storage, as a personal backup, or to hold material unrelated to the projects it serves.

2. Your account

You must:

• Keep your password to yourself. Never share it, never write it down where others can see it, and never reuse it on another service.
• Use a password of at least twelve characters. A memorable phrase of three or four unrelated words is stronger than a short one with symbols in it.
• Sign out on shared or public computers, and do not tick "Remember me" on a device that is not yours.
• Report a suspected compromise immediately, before trying to fix it yourself.

You must not:

• Let anyone else use your account, including a colleague who has been slow to get their own.
• Use anyone else's account, even with their permission.
• Create accounts for people who have not been properly authorised.

3. Handling project material

Everything on the Portal is confidential unless you have been told otherwise. Some of it is sensitive beyond ordinary commercial confidence, and needs particular care:

If you are unsure which category something falls into, ask the project lead before sharing it.

4. Uploading

You must:

• Have the right to upload the file and to make it available to everyone who has access to that project.
• Put files in the correct project and folder. Filing something in the wrong place can expose it to the wrong people.
• Complete the drawing number, revision and date so that the record is usable later.
• Check a file before uploading it — an untrimmed spreadsheet or an unflattened PDF often contains more than you meant to send.

You must not:

• Upload malicious files, or files you have any reason to suspect. The Portal restricts file types but does not scan content.
• Upload unlawful, infringing or offensive material.
• Upload personal data about other people beyond what the project genuinely needs — see section 6.
• Attempt to bypass the file type restrictions by renaming a file.

5. Sharing outside the Portal

Shared links are the main way project material leaves the Portal, and the main way it ends up somewhere it should not be.

Rules for creating a link:

• Send to a named recipient wherever possible, rather than creating an open "anyone with the link" share.
• Never use an open link for sensitive material. If the content falls into the Sensitive or Restricted rows in section 3, an open link is not permitted.
• Set the shortest sensible expiry. Thirty days is the default and is usually right. Twelve months is the absolute maximum and needs a reason.
• Check the scope before you send. The sharing screen shows exactly what the recipient will see. Read it. A link created at project level shares the whole visible tree, not just the folder you had open.
• Turn off download where the recipient only needs to look. Be aware this hides the download controls rather than locking the file — for genuinely restricted content, do not grant visibility at all.
• Tell the recipient it is personal to them and must not be forwarded.
• Revoke it when the work is done. Do not wait for expiry.

Two behaviours to be aware of:

• Open links to the same project share one set of permissions. Opening up a folder for one open link can widen another open link on the same project.
• Adding someone to a project directory changes how existing links resolve for that email address. Adding a contact is a sharing decision, not just an address book entry.

Never send project material through personal email, personal cloud storage or messaging apps as a way around these rules.

6. Personal data and free text

• Only upload personal data the project actually needs, and no more of it than necessary.
• Do not type personal data into comments, bug reports or table cells. These are free-text fields that are not indexed. Personal data buried in them is hard to find, hard to correct and hard to delete when someone exercises their rights.
• Never upload special category data — health, ethnicity, religion, political opinions, trade union membership, sex life, sexual orientation, genetic or biometric data. The Portal is not designed for it.
• If you add someone to a project directory, make sure they know: they have a right to be told that their details are held.
• If you find personal data that should not be there, report it rather than deleting it yourself.

7. Downloading

• Download only what you need, and only for the project.
• Once a file leaves the Portal, none of its protections travel with it. Store downloaded material on managed company systems, not personal devices or personal cloud accounts.
• Do not forward downloaded material to anyone who would not have been given access in the Portal.
• Delete local copies when you no longer need them.
• Take particular care with anything from the Sensitive or Restricted categories.

8. Prohibited activity

You must never:

• Attempt to access projects, spaces, folders or files you have not been granted permission to see.
• Guess, alter or reuse addresses, identifiers or links in order to reach content.
• Probe, scan, penetration-test or otherwise interfere with the security or availability of the Portal without written authorisation.
• Attempt to bypass permission checks, rate limits or session timeouts.
• Extract content in bulk by automated means.
• Interfere with, disable or attempt to alter the activity record.
• Introduce malware, or use the Portal to distribute it.

9. What is recorded

The Portal keeps a record of activity, and you should assume your actions are attributable to you. Recorded events include sign-ins, uploads, edits, moves, archiving and deletion, permission changes, comments, the creation and revocation of shared links, and visits to shared links.

This is monitoring for security, accountability and project record-keeping — not performance management. Retention periods and your rights over these records are in the Privacy Notice.

10. Reporting problems

Report the following as soon as you notice them, without waiting to be certain:

• A link, file or folder that shows you something you should not be able to see.
• A shared link that has reached someone it was not intended for.
• A suspected compromise of your account, or an unexpected security email about it.
• A file uploaded to the wrong project or containing more than it should.
• Anything that behaves as though a permission is not being applied.

Use the bug report button in the Portal for faults, and contact {{DP_EMAIL}} directly for anything involving personal data or a suspected breach. Reporting a genuine mistake promptly will never be treated as a disciplinary matter — concealing one may be.

11. If this policy is broken

Depending on what happened, we may:

• revoke a shared link or reduce permissions immediately;
• suspend or close the account involved;
• notify the affected project client;
• report the matter to the Information Commissioner's Office, where personal data is involved and the risk requires it;
• take disciplinary or contractual action, and report criminal conduct to the police.

12. Questions

If you are not sure whether something is allowed, ask before you do it — {{SUPPORT_EMAIL}}.

Close