Privacy policy

This policy explains what personal data OLXR collects through this website, why, and what happens to it.

OLXR Limited is a company registered in the Isle of Man (company number 133388C), run by me, Owen Jones. Where this policy says “I” or “me”, it means OLXR Limited. OLXR is the data controller for the personal data described here.

The short version: I only collect what I need to reply to you and run the website, I don’t sell it or share it with advertisers, and you can ask me to see or delete it at any time.

What I collect

When you fill in a form - the contact form, a managed website or bespoke software enquiry, or a Free Website Check request:

• Your name and email address
• Your business name and website address, if you give them
• What you tell me about your business and what you need - for example what you do, who your customers are, and a rough budget or timescale

When you book a call - the time you pick, along with your name and email address, so I can put the appointment in my calendar and send you the invitation.

When you message me directly - by email or WhatsApp - whatever you include in your message, plus your email address or phone number.

When you visit the site - your IP address and basic browser information. This is sent automatically whenever any browser loads a web page; I use it only to deliver the site, keep it secure, and check that form submissions come from a person rather than a bot.

What I don’t collect. I don’t ask for or collect special category data (such as health, religious or biometric information), I don’t build profiles of visitors, and I don’t make automated decisions about you.

How I use it

Data protection law asks me to have a lawful reason for each thing I do with your data. Here they are:

What I do	Lawful basis
Reply to your message or enquiry	Legitimate interest - you contacted me and expect a reply
Put a call you book in my calendar and send you the invitation	Legitimate interest - you asked for the appointment
Carry out your Free Website Check, send you your results, and follow up about them	Legitimate interest - you asked for it
Prepare a proposal, and deliver and support work you agree to	Contract - taking steps at your request before a contract, then performing it
Keep the site and forms secure and free of spam	Legitimate interest - protecting the site and the people who use it
Understand how the site is used, in aggregate	Legitimate interest - improving the site; no personal data is used
Keep business and tax records	Legal obligation

I won’t add you to a mailing list, and I won’t use your details for marketing unless you ask me to.

How long I keep it

• Enquiries and messages - while we’re in touch, and for up to two years afterwards, so I have a record of what was discussed. Deleted sooner if you ask.
• Free Website Check requests and results - up to two years, so I can refer back to them if you get in touch again. Deleted sooner if you ask.
• WhatsApp conversations - messages delete automatically after 90 days. If a conversation turns into work together, I’ll move it to email and keep it with the rest of our project records.
• Calendar appointments - kept with the rest of my calendar, so there’s a record of when we spoke. Deleted sooner if you ask.
• Client records - for as long as we work together, then as long as the law requires for tax and accounting purposes.
• Security logs - kept briefly by my hosting and security providers, then deleted automatically.

Who I share it with

I don’t sell your data, and I don’t share it with advertisers. I use a small number of service providers to run the site and handle messages. They process data only to provide their service to me:

• Amazon Web Services - hosts the website, and sends and receives form submissions by email.
• Cloudflare Turnstile - checks that form submissions come from a person rather than an automated script.
• Fathom Analytics - counts page visits in aggregate. It doesn’t use cookies, and it doesn’t store personal data or identify you.
• WhatsApp (Meta) - if you choose to message me on WhatsApp, that conversation is handled by WhatsApp under its own privacy policy.
• Microsoft 365 - my email, where messages you send me, and my replies, are stored. It also holds my calendar: when you book a call, the site asks Microsoft for my free times and writes the appointment straight into it.

I may also share data where the law requires it - for example, with tax authorities.

Where your data is kept

The website and its email handling run on Amazon Web Services, and connections to the site are encrypted. Form submissions are sent to me by email rather than stored in a database on the website.

Some of my service providers - Cloudflare, Fathom and WhatsApp - are based outside the UK and Isle of Man, or process some data elsewhere. Where that happens, the transfer is covered by the safeguards they provide, such as standard contractual clauses or the UK International Data Transfer Addendum.

Your rights

You can ask me to:

• See the personal data I hold about you
• Correct anything that’s wrong or incomplete
• Delete your data
• Restrict how I use it, or object to me using it
• Send it to you or someone else in a usable format

You can also complain to the regulator - see the end of this policy.

Asking is free, and I’ll reply within one month. To make a request, use the form on the contact page.

Cookies and analytics

This site doesn’t use advertising, tracking or profiling cookies, which is why you won’t see a cookie banner. Only what’s strictly needed for the site to work and stay secure is used.

Visitor numbers come from Fathom Analytics, which counts visits in aggregate without cookies and without identifying you. Cloudflare Turnstile, which protects the forms, processes your IP address and basic browser signals to tell people from bots - and only for that. Like Fathom, it doesn’t use cookies.

See the cookie policy for details.

Business outreach

Sometimes I contact businesses directly about my services, using business contact details they’ve made public - for example on their own website or in a business directory. My lawful basis is legitimate interest: offering relevant services to businesses who might benefit from them.

When I do, I:

• Only use business email addresses, never personal accounts
• Write to each business individually, never in bulk
• Say who I am clearly in every message
• Stop straight away if you ask me to
• Delete your details within 12 months if you don’t reply

If you’ve heard from me and would rather not, just reply to say so and I’ll remove your details.

Changes to this policy

If anything changes, I’ll update this page and the date at the top.

Contact me

The data controller is OLXR Limited, registered in the Isle of Man under company number 133388C. Its registered office is 61 Port-E-Chee Avenue, Douglas, IM2 5EU, Isle of Man, and it is registered with the Isle of Man Information Commissioner under registration number R629904.

For anything about this policy or your data, use the form on the contact page.

Complaints

I’d rather hear from you first, so please get in touch if something concerns you. If you’re not satisfied with my response, you can complain to the Isle of Man Information Commissioner at inforights.im.