Acceptable Use Policy

Purpose and scope

This Acceptable Use Policy explains how One Big Team may and may not be used. It applies to every customer, administrator, employee, invited user and other person who accesses the Service.

This policy forms part of our Terms of Service. Customers are responsible for ensuring that everyone they authorise to use the Service complies with it.

Lawful and authorised use

You may use the Service only for lawful business purposes and only within the organisation, records and functionality you are authorised to access.

You must not:

• Access, attempt to access or allow another person to access an account, organisation, record or part of the Service without permission.
• Use another person's identity or account, impersonate another person or misrepresent your authority.
• Use the Service in breach of applicable employment, equality, privacy, data protection, intellectual property or other laws.
• Use information obtained through the Service for a purpose that is incompatible with the purpose for which it was collected or made available.

Employee and applicant information

The Service may contain confidential and sensitive information about employees, workers, applicants and other individuals. You must have an appropriate lawful basis and authority for the information you enter, upload, view, change, export or otherwise process.

You must not:

• Upload or process personal information that your organisation is not entitled to collect or use.
• Use health, absence, equality or other sensitive information unlawfully, unfairly or for unauthorised monitoring or decision-making.
• Use the Service to discriminate unlawfully, harass, intimidate, exploit or cause harm to another person.
• Upload content that is unlawful, defamatory, fraudulent, deceptive, abusive, threatening, obscene or that infringes another person's rights.

Account security

You must:

• Keep login credentials confidential and use an individual account rather than sharing credentials.
• Take reasonable steps to protect devices and accounts used to access the Service.
• Keep user access and permissions appropriate and remove access when it is no longer required.
• Tell us promptly at security@onebigteam.co.uk if you believe an account, credential or customer record has been compromised or used without permission.

Technical misuse

You must not:

• Introduce malware, ransomware, viruses, harmful code or corrupted data.
• Probe, scan, test or attempt to exploit a vulnerability without our prior written permission.
• Bypass or attempt to bypass authentication, authorisation, usage limits, tenant isolation or other security controls.
• Interfere with, overload, disrupt or degrade the Service or another customer's use of it, including through denial-of-service activity or excessive automated requests.
• Reverse engineer, decompile, disassemble, scrape or systematically extract data from the Service except where applicable law expressly permits it or we have agreed in writing.
• Use bots, scripts, integrations or other automated methods except through functionality we provide or have approved.
• Attempt to obtain source code, credentials, security keys or confidential information belonging to One Big Team, another customer or another user.

Good-faith security research must be authorised by us in writing before testing begins. Reports may be sent to security@onebigteam.co.uk.

Communications and recruitment

You must not use the Service to send spam, unsolicited bulk communications, fraudulent messages or material that violates applicable marketing or communications laws.

Recruitment and employee communications must be relevant to a legitimate business purpose and sent only to people your organisation is entitled to contact.

Intellectual property and third-party rights

You must not upload, copy, distribute or use material through the Service unless you have the necessary rights and permissions. You must not remove or obscure proprietary notices or use the Service to infringe intellectual property, confidentiality or contractual rights.

Monitoring and enforcement

We may investigate suspected misuse and take reasonable steps to protect the Service, our customers and affected individuals. Depending on the nature, severity and urgency of the issue, these steps may include:

• Asking the customer or user to stop or remedy the misuse.
• Restricting particular activity, content or functionality.
• Removing or disabling access to unlawful or harmful content where appropriate.
• Temporarily suspending an account or access to the Service.
• Terminating access in accordance with the Terms of Service.
• Preserving or disclosing relevant information where required or permitted by law.

Where reasonably practicable, we will notify the affected customer and provide an opportunity to remedy a breach. We may act without prior notice where we reasonably believe immediate action is necessary to protect security, prevent harm, comply with law or preserve the integrity of the Service.

Reporting misuse

Please report suspected misuse or security concerns to security@onebigteam.co.uk. Include enough information for us to understand and investigate the issue, but do not send passwords or unnecessary personal information.

Changes to this policy

We may update this policy to reflect changes to the Service, applicable law or security risks. We will publish the revised policy with an updated date and provide additional notice where a change materially affects how customers may use the Service.