Trust CenterWhat we collect, why, and your control over it

Privacy Policy

This Privacy Policy explains how OnyxOne collects, uses and protects personal data in relation to our website and the accounts of the people who use our platform. Where OnyxOne processes personal data on behalf of a customer as part of the Service, that processing is governed by our Data Processing Agreement rather than this policy.

Last updated · 22 September 2026

Who is responsible for your data

For the personal data described in this policy, the data controller is ONYXONE TECHNOLOGIES LTD, a private limited company registered in England and Wales under company number 17352132, whose registered office is at 3 Mantua Street, London, England, SW11 2NE. ONYXONE TECHNOLOGIES LTD also operates this website. You can contact us about your personal data at hello@onyxone.uk, or by post at our registered office.

We process personal data in accordance with the UK GDPR and the Data Protection Act 2018, supervised by the Information Commissioner's Office (ICO).

Personal data we collect

  • Account data: the name, work email and role of the people who use the platform or contact us.
  • Usage and technical data: device, session, IP-derived location and security signals needed to protect accounts and prevent misuse.
  • Communications: enquiries, support requests and security reports you send us.
  • Website data: anonymous, cookieless visit measurement for all visitors, and cookie-based analytics where you have accepted it, both through Google Analytics (see our Cookie Policy).

Customer data processed on behalf of customers

When a customer uses OnyxOne to run compliance operations, the platform processes records about that customer's own customers and third parties (for example screening and due-diligence data). For that processing OnyxOne acts as a processor on the customer's instructions under our Data Processing Agreement — the customer is the controller. This Privacy Policy does not govern that processing.

Lawful bases (UK GDPR)

  • Contract — to provide and administer the Service and accounts.
  • Legal obligation — to meet our own tax, accounting and record-keeping duties.
  • Legitimate interests — to secure the platform, prevent misuse, improve the Service and measure website use without cookies, balanced against your rights.
  • Consent — for non-essential cookies and optional communications, which you can withdraw at any time.

How we use personal data

  • To operate, secure and support the Service and its accounts.
  • To respond to enquiries, provide support and manage our relationship with customers.
  • To meet our own legal and record-keeping obligations.
  • To understand how our website is used: anonymously and without cookies for all visitors, and in more detail where you have accepted analytics cookies.

What we never do

  • We never place personal or sensitive data in URLs.
  • We never sell your personal data.
  • We do not use customer data processed on a customer's behalf for our own purposes.

Sub-processors & sharing

We share personal data only with the infrastructure and service providers below, and with authorities where legally required. Screening and data providers are contracted and configured per customer deployment rather than being a single fixed partner.

  • Vercel Inc. — application hosting & edge delivery (US/EU regions)
  • Supabase — database, authentication & storage (EU region)
  • Google Ireland Limited — website analytics (Google Analytics 4)
  • Screening & data providers — contracted and configured per customer deployment

International transfers

Where personal data is transferred outside the UK/EEA, we rely on an appropriate safeguard — an adequacy decision, the UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses — and apply additional measures where needed.

Retention

We keep account and website personal data only as long as needed to provide the Service and meet our legal obligations, then delete or anonymise it. Retention of data processed on a customer's behalf is governed by the customer's instructions and the Data Processing Agreement.

Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to processing of your personal data, and to data portability. You can also lodge a complaint with the ICO. To exercise your rights, contact us; we respond within the statutory timeframe. Where the data relates to a customer's processing, we will direct the request to that customer as controller.

Security & cookies

We protect personal data with encryption in transit and at rest, strict access controls and server-side secret handling (see our Security page). Our use of cookies is described in the Cookie Policy.

Contact

Privacy questions or requests: hello@onyxone.uk.