Privacy Policy

1. Who we are

Onyx Hub Ltd ("Onyx", "we", "us") is the controller of personal data processed through this website. Registered office: 195-197 Wood Street, Suite Ra01, London, E17 3NU, United Kingdom. Company number: [COMPANY NUMBER].

Contact for privacy matters: [email protected].

2. Data we collect

• Early-access and design-partner requests: work email address and, where the form asks for it, company, role and a description of your contract operations challenge.
• Messages you send us by email: your name, email address and the content of your message.
• Technical data: IP address, browser type, device information and pages visited, collected through server logs and, where you consent, analytics. See our Cookie Policy.
• If you are invited to use the Onyx product: account details, and the contract data you or your organisation upload. In that case the terms of your service agreement and a data processing agreement apply, and Onyx acts as a processor for that contract data.

3. Why we use it and our legal basis

• To respond to your request and decide whether to invite you to the design-partner programme: legitimate interests (running our business and evaluating prospective partners) or steps taken at your request before entering a contract.
• To send you updates about the early-access programme you asked for: your consent or legitimate interests, and you can opt out at any time.
• To keep the website secure and working: legitimate interests.
• To measure and improve the website through non-essential analytics: your consent.
• To meet legal obligations, for example accounting and responding to lawful requests: legal obligation.

4. Who we share it with

We do not sell personal data. We share it only with service providers that help us run the website and the programme, under written agreements, such as hosting, email delivery and form handling, analytics (if enabled), and professional advisers. Current providers: [LIST PROVIDERS, e.g. hosting, email].

We may disclose data where required by law or to protect our rights.

5. International transfers

Our team and some providers may process data outside the UK and the European Economic Area. Where we do, we rely on an adequacy decision or on appropriate safeguards, such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses.

6. How long we keep it

We keep early-access and enquiry data for as long as needed to handle your request and for up to [RETENTION PERIOD, e.g. 24 months] afterwards, unless you ask us to delete it sooner or we enter into a contract with you. Server logs are kept for [LOG RETENTION, e.g. 90 days]. Data required for legal or accounting reasons is kept for the period the law requires.

7. Your rights

Under the UK GDPR and, where it applies to you, the EU GDPR, you have the right to access your data, correct it, erase it, restrict or object to processing, receive it in a portable format, and withdraw consent at any time. To exercise a right, email [email protected]. We will respond within one month.

You may complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EU, to your local supervisory authority, for example the Polish UODO (uodo.gov.pl). We would appreciate the chance to resolve your concern first.

8. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit and access controls. No system is completely secure, so we cannot guarantee absolute security.

9. Automated decision-making

We do not use the personal data collected through this website for decisions based solely on automated processing that significantly affect you.

10. Changes to this policy

We may update this policy. The date at the top shows the latest version. We will give notice of material changes where appropriate.