Privacy @OnYXIO

Last updated: September 2026

◇ Privacy, in plain English

At Onyxio, we take privacy seriously, and we believe privacy information should be easy to understand.

This notice explains what personal data we collect and use, where it comes from, why we use it, who we may share it with, how long we keep it and the rights and choices you have.

It applies when you visit our website, contact us, work with us, receive professional communications from us or otherwise interact with Onyxio.

Our approach is simple: use the data we reasonably need, for clear purposes, and protect it appropriately.

For information about cookies and similar technologies, please see our Cookie Policy.

🏢 Who we are

Onyxio is the trading name of Onyxio Group Ltd, a company registered in England and Wales (company number 17369539), with its registered office at Unit 4 Block B Knowledge Gateway, Nesfield Road, Colchester, England, CO4 3ZL. When Onyxio decides why and how personal data is used for our own business purposes, Onyxio Group Ltd is the controller of that data.

When delivering client work, we may occasionally have limited access to personal data held within a client's systems or materials. Where we process that data solely on the client's instructions, the client will generally be the controller and Onyxio will act as its processor.

We minimise access to client personal data wherever practical and handle it in accordance with our contractual and data protection obligations.

◇ Personal data we collect

We keep the personal data we collect proportionate to what we need. Depending on how you interact with us, this may include:

  • your name and professional contact details;

  • your organisation, role and professional interests;

  • data you provide in enquiries, meetings, emails and other communications;

  • data relevant to our relationships with clients, prospective clients, associates, partners, suppliers and other professional contacts;

  • data needed to manage client engagements, contracts, invoices and business administration; and

  • limited technical data when you use our website, such as your IP address, browser or device information and data about how the website is used.

When delivering client work, we may occasionally have access to personal data contained in client systems, documents or other materials. We aim to minimise this and only access or use data needed for the agreed work.

We don't intentionally collect more personal data than we need.

↙ Where personal data comes from

Most personal data we use comes directly from you.

We may also obtain professional data from:

  • your organisation;

  • referrals and introductions;

  • professional networks and events;

  • publicly available professional sources, such as company websites and professional networking platforms; and

  • clients or other organisations where this is necessary for an engagement.

Where we obtain personal data indirectly, we handle it in accordance with applicable transparency requirements. For example, if we use professional contact data obtained from a public source to contact you, we'll make relevant privacy information available when we first communicate with you or otherwise within the period required by law. Information Commissioner

→ How we use personal data

We may use personal data to:

  • respond to enquiries and discuss potential work;

  • deliver and administer client engagements;

  • manage relationships with clients, prospective clients, associates, partners, suppliers and other professional contacts;

  • work with associates, suppliers and professional advisers;

  • keep relevant professional contacts informed about Onyxio's services, insights, activities and events;

  • develop our professional network and business;

  • operate, secure and improve our website and services;

  • manage contracts, accounts, invoicing and other business administration; and

  • meet our legal, regulatory and professional obligations.

We would never sell personal data. We also don't share personal data with other organisations so they can market their own services to you.

⚖️ Our lawful bases

Data protection law requires us to have a lawful basis for processing personal data. The basis we rely on depends on what we're doing and why.

  • Legitimate interests. We have legitimate interests in running and developing Onyxio, maintaining professional relationships, responding to enquiries, identifying and communicating with relevant business contacts, improving our services and sharing relevant information about our work, insights and events. When we rely on legitimate interests, we consider whether the processing is necessary and proportionate, what you would reasonably expect, the nature of the data and the potential impact on your rights and interests.

  • Steps before entering into a contract. For example, where you ask us to discuss, scope or prepare for working together.

  • Performance of a contract. Where processing personal data is necessary to provide agreed services or manage our contractual relationship.

  • Legal obligations. Where we need to process or retain data to meet legal, tax, accounting or regulatory requirements.

  • Consent. Where consent is appropriate or legally required. If we rely on consent, you can withdraw it at any time.

✉️ Professional communications and marketing

We may occasionally contact relevant professional contacts about Onyxio services, insights, events or opportunities where this is appropriate and permitted by law.

For business-to-business communications, the rules can differ depending on who we're contacting and how. We apply relevant data protection requirements and the Privacy and Electronic Communications Regulations (PECR) where applicable. For example, PECR treats electronic marketing to corporate subscribers differently from electronic marketing to individuals, sole traders and certain partnerships. Information Commissioner

We aim to keep our communications relevant, targeted and proportionate. You can object to direct marketing at any time.

If you opt out, we may keep limited data on a suppression list so we can remember and respect your choice. The right to object to direct marketing is absolute and must be clearly brought to people's attention. Information Commissioner

🤝 Who we share personal data with

We use a small number of trusted technology and professional service providers to help us operate Onyxio. Our core technology providers currently include:

  • Google Workspace — email, documents, cloud storage and business productivity;

  • FreeAgent — accounting and financial administration;

  • Squarespace — our website; and

  • Canva — design, content and business-document creation and collaboration.

These providers may process limited personal data when providing their services to us.

Where necessary, we may also share limited personal data with:

  • associates or specialist advisers supporting an Onyxio engagement;

  • accountants, lawyers and other professional advisers;

  • other suppliers needed to operate our business or provide our services;

  • clients, where appropriate to the work we're carrying out; and

  • regulators, courts, law-enforcement bodies or other authorities where required by law or where necessary to establish, exercise or defend legal rights.

We take a proportionate, risk-based approach to the organisations we work with. This includes considering their privacy and security arrangements, using appropriate contractual protections and limiting access to the data reasonably required.

🌍 International data transfers

Some of our technology providers and professional relationships operate internationally. This means personal data may sometimes be accessed or processed outside the UK or European Economic Area.

Where data protection law treats this as a restricted international transfer, we use an appropriate legal mechanism. Depending on the circumstances, this may include an applicable adequacy arrangement or approved contractual safeguards.

If you'd like more information about safeguards relevant to your personal data, contact hello@onyxio.co.

🕒 How long we keep personal data

We only keep personal data for as long as we reasonably need it.

How long that is depends on the nature of the data, why we collected it, our relationship with you and any legal, contractual, tax, accounting or regulatory requirements that apply.

For example, records relating to client engagements or financial transactions may need to be retained after an engagement ends. Data that no longer has a continuing business or legal purpose can be deleted sooner.

We periodically review the data we hold and delete or anonymise it when we no longer need it.

🔐 How we protect personal data

We use appropriate organisational and technical measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

This includes limiting access to data, using established technology providers and applying appropriate account, access and security controls.

No system can guarantee absolute security, but we aim to apply safeguards proportionate to the nature and sensitivity of the data we handle.

✓ Your data protection rights

Depending on the circumstances and the lawful basis involved, you may have the right to:

  • access personal data we hold about you;

  • correct inaccurate or incomplete data;

  • ask us to delete personal data in certain circumstances;

  • restrict certain processing;

  • object to certain processing;

  • receive or transfer certain data in a portable format, where applicable; and

  • withdraw consent at any time where processing is based on consent.

You can object to the use of your personal data for direct marketing at any time.

To exercise any of your rights, email hello@onyxio.co.

We may ask for enough information to confirm your identity and understand your request. There is normally no charge for exercising your data protection rights.

If we're processing personal data solely on behalf of one of our clients, you should normally contact that organisation about your rights. We'll support our client in responding where required.

◇ Providing personal data

Usually, you choose what personal data you provide to us.

Sometimes we need particular data to respond to a request, enter into or perform a contract, provide our services or meet a legal requirement.

If required data isn't provided, we may not be able to proceed with the relevant request or service.

⚙️ Automated decision-making

We don't use personal data to make solely automated decisions that produce legal or similarly significant effects about you.

💬 Questions or concerns

If you have a question or concern about how we process personal data, contact us at hello@onyxio.co.

You also have the right to complain to the UK data protection regulator:

Information Commissioner (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

Telephone: 0303 123 1113

Information Commissioner's Office

◌ Cookies and website analytics

We may use cookies and similar technologies to operate our website, understand how it is used and improve the experience.

Where consent is required for non-essential cookies or similar technologies, we ask for it.

You can find out more about the technologies we use and manage your choices in our Cookie Policy or through Cookie Preferences on this website.

↗ Other websites

Our website may contain links to websites operated by other organisations.

We don't control those websites or how they process personal data. If you follow a link to another website, its own privacy information will apply.

↻ Keeping this notice up to date

We'll review and update this notice when our services, technology, processing of personal data or legal requirements change.

The latest version will be published here with the last updated date shown at the top.

@ Contact us

Questions about this notice, how we process personal data or your data protection rights?

Onyxio Group Ltd
hello@onyxio.co