Trust CenterWhat we collect, why, and your control over it

Privacy Policy

This Privacy Policy explains how OnyxOne collects, uses and protects personal data in relation to our website, our enquiries and sales process, and the accounts of the people who use our platform. OnyxOne sells to organisations, so the personal data in this policy is almost always business-contact data about people acting for an organisation. Where OnyxOne processes personal data on behalf of a customer as part of the Service, that processing is governed by our Data Processing Agreement rather than this policy.

Last updated · 22 September 2026

Who is responsible for your data

For the personal data described in this policy, the data controller is ONYXONE TECHNOLOGIES LTD, a private limited company registered in England and Wales under company number 17352132, whose registered office is at 3 Mantua Street, London, England, SW11 2NE. ONYXONE TECHNOLOGIES LTD also operates this website. You can contact us about your personal data at hello@onyxone.uk, or by post at our registered office.

We process personal data in accordance with the UK GDPR and the Data Protection Act 2018, supervised by the Information Commissioner's Office (ICO).

Personal data we collect

  • Account data: the name, work email and role of the people who use the platform or contact us.
  • Usage and technical data: device, session, IP-derived location and security signals needed to protect accounts and prevent misuse.
  • Communications: enquiries, demonstration requests, support requests and security reports you send us, and our correspondence with you about them.
  • Sales and contract data: the business-contact details, organisation details and correspondence needed to prepare a proposal, agree an order and administer the resulting subscription.
  • Website data: cookieless measurement of the pages you visit, using an identifier that changes every day, while you have not accepted analytics cookies, and cookie-based analytics once you have, both through Google Analytics (see our Cookie Policy).

Customer data processed on behalf of customers

When a customer uses OnyxOne to run compliance operations, the platform processes records about that customer's own customers and third parties (for example screening and due-diligence data). For that processing the customer is the controller and OnyxOne acts as a processor on the customer's instructions, under our Data Processing Agreement. This Privacy Policy does not govern that processing.

Lawful bases (UK GDPR)

  • Contract: to provide and administer the Service and accounts.
  • Legal obligation: to meet our own tax, accounting and record-keeping duties.
  • Legitimate interests: to secure the platform, prevent misuse, improve the Service and measure website use without cookies, balanced against your rights.
  • Consent: for non-essential cookies and optional communications, which you can withdraw at any time.

How we use personal data

  • To operate, secure and support the Service and its accounts.
  • To respond to enquiries, provide support and manage our relationship with customers.
  • To meet our own legal and record-keeping obligations.
  • To understand how our website is used: without cookies while you have not accepted analytics cookies, and with them once you have.

What we never do

  • We never place personal or sensitive data in URLs.
  • We do not market to consumers, and this website is not directed at children; we do not knowingly collect personal data from anyone under 18.
  • We never sell your personal data.
  • We do not use customer data processed on a customer's behalf for our own purposes.

Sub-processors & sharing

We share personal data only with the infrastructure and service providers below, and with authorities where legally required. Screening and data providers are contracted and configured per customer deployment rather than being a single fixed partner.

  • Vercel Inc.: application hosting & edge delivery (US/EU regions)
  • Supabase: database, authentication & storage (EU region)
  • Google Ireland Limited: website analytics (Google Analytics 4)
  • Screening & data providers: contracted and configured per customer deployment

International transfers

Where personal data is transferred outside the UK/EEA, we rely on an appropriate safeguard: an adequacy decision, the UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses, and we apply additional measures where needed.

Retention

We keep account and website personal data only as long as needed to provide the Service and meet our legal obligations, then delete or anonymise it. Retention of data processed on a customer's behalf is governed by the customer's instructions and the Data Processing Agreement.

Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to processing of your personal data, and to data portability. You can also lodge a complaint with the ICO. To exercise your rights, contact us; we respond within the statutory timeframe. Where the data relates to a customer's processing, we will direct the request to that customer as controller.

Security & cookies

We protect personal data with encryption in transit and at rest, strict access controls and server-side secret handling (see our Security page). Our use of cookies is described in the Cookie Policy.

Contact

Privacy questions or requests: hello@onyxone.uk.