Privacy Policy

1. Introduction

Atomixair Technologies Ltd ("we", "us", or "our") is the data controller responsible for your personal data. This Privacy Policy applies to Intelli-BuildAI — our deterministic building performance, decarbonisation and project delivery platform — together with all of its modules, portals and related services (the "Service").

This policy should be read alongside our Terms of Service, which govern your use of the Service and our intellectual property.

We respect your privacy and are committed to protecting your personal data. This policy will inform you about how we look after your personal data and tell you about your privacy rights and how the law protects you.

2. Data Controller Information

3. Information We Collect

3.1 Personal Information

We collect the following personal information when you register for and use our Service:

• Account Information: Full name, email address, password (encrypted)
• Contact Details: Phone number, company name, job title, address
• Profile Information: Company name, team/department name, professional details
• Authentication Data: Login credentials, session tokens
• Consent Records: Your separate choices for contact, marketing email and marketing telephone, each with the date and time recorded

3.1a Business Contact and Enquiry Data

Where you contact us, request a demonstration, download a document or complete a building scan, we additionally hold a business enquiry record containing your professional contact details, the enquiry itself, your area of interest, the pages and campaigns that brought you to us, and a commercial qualification score and tier generated as described in section 5a.

3.2 Building and Project Data

When you use the Service, we collect and process:

• Building characteristics (size, type, location)
• Energy consumption data (electricity, gas, oil usage)
• Energy Performance Certificate (EPC) information
• Retrofit measure specifications and financial data
• Project documents, drawings, schedules, tender packs and reports you create or upload
• Commercial and financial project data, including cost plans, fee models and funding cases
• Provenance and audit records — the standard, formula, input value, assumption, author and timestamp behind each calculated figure

3.3 Technical Information

We automatically collect certain technical information:

• IP address and approximate geographic location
• Browser type and version
• Device information and operating system
• Usage data (pages visited, features used, time spent)
• Error logs and diagnostic information

3.4 Cookies and Tracking Technologies

We use cookies and similar technologies in three distinct categories. You control the analytics and marketing categories through the cookie banner shown on your first visit, and you can change your choice at any time. You can also instruct your browser to refuse all cookies.

Refusing analytics or marketing cookies does not restrict your access to any part of the Service.

4. Legal Basis for Processing

We process your personal data under the following legal bases:

5. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, maintain, and improve the Service functionality
• Account Management: To create and manage your user account
• Calculations: To perform energy calculations, assessments, and generate reports
• Customer Support: To respond to your inquiries and provide technical support
• Service Improvement: To analyze usage patterns and improve Service features
• Security: To detect, prevent, and address technical issues and security vulnerabilities
• Communications: To send service-related notifications and updates
• Marketing: To send promotional communications (only with your consent)
• Research: To conduct research using anonymized and aggregated data, and to refine our deterministic calculation engines and sector benchmarks
• Legal Compliance: To comply with legal obligations and protect our rights

5a. Automated Decision-Making and Profiling

We want to be direct about the one place where we profile people. Where you make a commercial enquiry, we generate a qualification score and tier, together with suggested outreach and a suggested pitch, to help our team prioritise and personalise their response. This is profiling within the meaning of the UK GDPR, and it is carried out under our legitimate interest in operating a commercial business.

We do not use profiling to price the Service differently for different people, to refuse anyone access, or to make any decision about your legal rights or entitlements. Every enquiry is handled by a person, and no special category data is involved at any stage.

The engineering outputs of the platform are not automated decisions about you. They are deterministic calculations about a building, produced from the inputs you supply, and they are always subject to review and professional verification by you.

To exercise any of these safeguards, contact us at info@muna-group.com and we will route your request to a member of our team with authority to change the outcome.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including:

• Account Data: Retained while your account is active, plus 12 months after account closure
• Project Data: Retained while your account is active, or as required by you
• Provenance, Audit and Evidence Records: Retained for 12 years from the date of the report they support. Because our outputs are relied upon for professional sign-off, the record of how each figure was derived must outlive the project itself so that any figure can be reconstructed and defended for the duration of professional liability
• Financial Records: Retained for 7 years in accordance with UK tax law
• Business Enquiry Records: Retained for 24 months from your last interaction with us, then deleted
• Support Communications: Retained for 3 years
• Analytics Data: Anonymized and retained for statistical purposes

You may request deletion of your data at any time by contacting us. We will comply with deletion requests except where we are required to retain data by law.

7. Data Sharing and Disclosure

7.1 We Do Not Sell Your Data

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

7.2 Service Providers

We share data with the following named sub-processors, each of which is bound by a written data processing agreement and may use your data only for the purpose we specify:

Marketing and advertising sub-processors receive data only where you have consented to marketing cookies or communications. We will update this list before adding any new sub-processor that handles personal data.

7.2a Collaborators, Clients and Lenders

The Service is built for collaboration, so project data you create may be shared with parties you or your team choose to involve:

• Team members and project collaborators you invite, at the access level you grant them
• Client portal guests — external parties given limited, capability-controlled access to milestones, documents, commercials or variations, as configured by the project team
• Lenders and funding parties — where your team issues a due-diligence access grant, an authorised lender may view the project's financial, programme and evidence records through a read-only portal

These parties are recipients of the data, not our sub-processors. Every grant is explicit, scoped, revocable and logged, and every action taken within a portal is recorded in the project audit trail. We never initiate such sharing ourselves.

7.3 Legal Requirements

We may disclose your personal data where required by law, court order, or governmental authority, or where necessary to:

• Comply with legal processes or regulatory requirements
• Protect our rights, property, or safety
• Prevent fraud or illegal activities
• Enforce our Terms of Service

8. International Data Transfers

Your personal data is stored and processed in the United Kingdom, the European Economic Area and the United States. Several of the sub-processors listed in section 7.2 — including our hosting, payment, analytics and document-extraction providers — operate infrastructure in the United States, so transfers outside the UK do occur as a routine part of delivering the Service.

For every such transfer we put appropriate safeguards in place:

• The UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum
• Reliance on the UK Extension to the EU–US Data Privacy Framework where the receiving organisation is certified under it
• Transfer risk assessments, with supplementary technical measures such as encryption in transit and at rest
• Adequacy regulations where the destination country benefits from one

Following the Data (Use and Access) Act 2025, the European Commission began the process of adopting renewed adequacy decisions for the United Kingdom in July 2025, allowing personal data to continue flowing freely between the EEA and the UK. We monitor the status of those decisions and will update this section if the position changes.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

While we strive to protect your personal data, no method of transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

10. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights:

To exercise any of these rights, please contact us at info@muna-group.com. We will respond to your request within one month.

11. Marketing Communications

We will only send you marketing communications if you have given us your explicit consent. You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Updating your preferences in your account settings
• Contacting us directly at info@muna-group.com

Note: You will continue to receive essential service-related communications regardless of your marketing preferences.

12. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us immediately.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page with an updated "Last updated" date
• Sending an email notification to the address associated with your account
• Displaying a prominent notice within the Service

We encourage you to review this Privacy Policy periodically for any changes.

14. Contact Us and Complaints