Privacy Policy

This privacy policy explains how OLXR Limited uses the personal data we hold - whether you have provided it to us, or we have collected it from publicly available sources.

What data do we collect?

OLXR Limited collects the following data:

Personal identification information (name, email address, phone number)
Company or organisation name
Project details, budgets, timelines and requirements you provide through enquiry forms
Technical data - your IP address and basic browser information - processed automatically when you load a page or submit a form, for security and anti-spam purposes

We do not collect special category data (such as health, religious or biometric information), and we do not carry out automated decision-making or profiling.

How do we collect your data?

You directly provide OLXR Limited with most of the data we collect. We collect and process data when you:

Subscribe to our newsletter
Submit a contact, consultation, quote, project enquiry, package enquiry or hire request form
Email us directly, or reply to an email we have sent you

We also receive your IP address automatically whenever your browser requests a page, which is unavoidable in how the internet works. We use it only to deliver the site, to protect it from attack, and to check that form submissions come from a person rather than a bot. We do not use it to build a profile of you.

How will we use your data?

OLXR Limited uses your data to:

Respond to your enquiries, consultation bookings and quote requests
Send you newsletter updates and information about our products and services, where you have opted in
Keep our site secure and free of automated abuse
Understand in aggregate which pages are useful, so we can improve the site

Our lawful basis for each purpose

What we do	Lawful basis
Responding to an enquiry you sent us	Legitimate interest - you contacted us and expect a reply. Where the enquiry leads to work, performance of a contract.
Sending newsletters and marketing emails	Consent - given when you subscribe, withdrawable at any time.
Security, anti-spam and bot protection	Legitimate interest - keeping our site and our correspondents safe from abuse.
Aggregate website analytics	Legitimate interest - understanding site usage. No personal data is collected for this purpose.
Business outreach to professional firms	Legitimate interest - see the section below.

How do we store your data?

Our website and database are hosted on Amazon Web Services in their London region, so data we store is held in the United Kingdom. Connections to our site are encrypted in transit, and our database is encrypted at rest.

Enquiries submitted through our forms are sent to us by email rather than stored in a website database. Newsletter subscriptions are stored in our database so we can manage your subscription and honour unsubscribe requests.

How long we keep it

Enquiries: kept while we are in correspondence with you, and for up to two years afterwards so we have a record of what was discussed. Deleted sooner on request.
Newsletter subscriptions: kept until you unsubscribe. We retain a record of the unsubscribe itself so we do not contact you again by mistake.
Prospect records: deleted within 12 months if no engagement results - see the outreach section below.
Client records: kept for the duration of the engagement and then as long as we are required to for legal, tax and accounting purposes.

We do not sell your data, and we do not share it with advertisers. We use a small number of service providers to run the site and our email, and they process data only on our instructions:

Amazon Web Services - website and database hosting, London (UK) region.
Twilio SendGrid - delivery of enquiry notifications and newsletter emails. SendGrid is based in the United States.
Cloudflare - content delivery, site security and bot protection (Turnstile). Cloudflare is based in the United States and operates a global network.
Fathom Analytics - aggregate website statistics. Fathom does not receive personal data from us.

Where a provider is outside the UK, that transfer is covered by the safeguards those providers offer for international transfers, such as the UK International Data Transfer Addendum or Standard Contractual Clauses. We may also disclose data where we are legally required to do so.

Marketing

If you subscribe to our newsletter or consent to receive updates, we may send you information about our products, services and company news. You can opt out at any time by using the unsubscribe link in any email or by contacting us directly.

Business outreach and prospect research

In addition to data you provide directly, we may collect publicly available business contact information for the purpose of contacting professional services firms about our services. This is typically a partner or practice manager's name, their professional email address, and the firm's publicly listed details, sourced from the firm's own website, business directories, or other publicly accessible sources.

Our lawful basis for this processing is legitimate interest - specifically, our interest in marketing relevant business services to professional firms whose work suggests they may benefit from them. We balance this interest against the recipient's privacy rights by:

Limiting outreach to professional contacts at corporate addresses, never personal email accounts
Personalising every message to the firm we're contacting, never sending in bulk
Identifying ourselves clearly in every message
Honouring opt-out requests immediately and permanently
Holding prospect contact details only as long as the outreach activity is active, and deleting them within 12 months if no engagement results

If you have received an unsolicited email from OLXR Limited and would prefer not to receive further contact, simply reply to the email and we will remove your details from our prospect records. You can also write to us using the contact details on this site.

What are your data protection rights?

The right to access – request copies of your personal data.
The right to rectification – correct inaccurate or incomplete data.
The right to erasure – request deletion under certain conditions.
The right to restrict processing – request limitations on data use.
The right to object to processing – oppose certain processing.
The right to data portability – request your data to be transferred.
The right to withdraw consent – where we rely on your consent, such as our newsletter, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.
The right to complain – raise a concern with the relevant data protection authority, as set out at the end of this policy.

Exercising any of these rights is free, and we will respond within one month. To make a request, email [email protected].

Cookies

We use only strictly necessary cookies - those needed to make the site work and keep it secure. We do not use advertising, profiling or cross-site tracking cookies, which is why this site shows no cookie consent banner. For full details, please see our Cookie Policy.

Third-party services

Analytics. We use Fathom Analytics to see which pages are read and how people find us. Fathom collects aggregate statistics only - it sets no cookies, stores nothing on your device, does not fingerprint you and does not track you across other websites.

Bot protection. Our forms are protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than an automated script. It processes your IP address and basic browser signals for that check alone, and is not used to build an advertising profile or to track you across websites.

Hosting and security. Our site is delivered through Cloudflare, which processes your IP address to protect against malicious traffic and to serve pages quickly.

Privacy policies of other websites

Links on our website may lead to other websites. Our privacy policy applies only to this website, so you should review their privacy policies separately.

Changes to our privacy policy

We review this policy regularly and post updates on this page. The effective date is shown at the top of this page.

How to contact us

The data controller is OLXR Limited, registered in the Isle of Man under company number 133388C.

If you have questions about this policy, or wish to exercise any of your rights, email [email protected] or use the form on our contact page.

How to contact the appropriate authority

We would rather hear from you first, so please contact us if something concerns you. If you are not satisfied with our response, you have the right to complain to a supervisory authority.

As an Isle of Man company, our supervisory authority is the Isle of Man Information Commissioner: www.inforights.im. If you are in the United Kingdom, you may instead complain to the Information Commissioner's Office: ico.org.uk.

Contents