Privacy and cookies

1. Who we are

We are Oxus Technologies Limited, a private company limited by shares registered in Ireland, company number 818468, with its registered office at Greenhills Road, Walkinstown, Dublin 12, D12 DX80, Ireland. VAT number IE4756195AH. For anything to do with your personal data, email info@oxus.ie or write to us at the address above.

This notice covers our website (oxus.ie), every product we run, software we license, and the work we do for clients. If a product publishes its own privacy notice, that notice is more specific and applies to that product; this one covers anything it does not.

2. Two roles: when we decide, and when we act for someone else

Under the GDPR and the UK GDPR, we are a controller when we decide why and how personal data is used. That covers visitors to our website, people who contact us, our clients, and the people who hold accounts on our products.

We are a processor when a business uses our software to hold information about other people: its employees, drivers, tenants, contractors, customers, delivery recipients and so on. That business is the controller and decides what happens to that data; we handle it only on its instructions and under a data processing agreement (see section 12 of our terms). If your details are in a system run by a business you deal with, please contact that business first. We will help them answer you.

3. What we collect when we are the controller

Website visitors and enquiries

When you send a form on oxus.ie, such as the audit request or the admin cost calculator, we receive what you type: your name, email and anything else you add, such as your phone number, business name and answers. We use it to reply and arrange what you asked for. The forms are delivered to our inbox by Web3Forms, which passes the message on and does not use it for anything else. If you write us a testimonial, it is stored in our database and appears on the site only after we approve it; ask us and we remove it.

Clients

For people we work with or for, we keep contact details, correspondence, meeting notes, quotes, contracts, invoices and payment records, so we can do the work, get paid and keep proper accounts.

Account holders on our products

• Account details: name, email, password (stored only as a secure hash), organisation, role, and settings.
• Billing: plan, subscription history, invoices, VAT number and billing address. Card details go straight to Stripe; we never see them.
• Usage and security: sign-in times, IP address, device and browser type, an audit trail of changes, and error reports, to keep the service secure and working.
• Support: messages, problem reports and feedback you send us.
• Emails we send: records of service emails, and whether they were delivered.

Licensed software

Software such as a browser extension or desktop tool may send us a licence key, a random device identifier and the version number, to check the licence is valid. Unless its own notice says otherwise, it does not send us the content you work with.

4. What our products may hold as a processor

Depending on the product and how our customer uses it, this can include names and contact details; addresses and Eircodes or postcodes; employment, rostering, attendance, pay and commission records; driver licence and vehicle details; tenancy and property records; certificates, contracts and other uploaded documents; electronic signatures with the time and IP address; invoices, tax identifiers and bank details; proof-of-delivery photos, signatures and location; mileage and expense claims; and bookings and customer records, which may include children's names and ages where a business such as a studio or a school provider records them. The business using the product is responsible for telling those people how their data is used.

5. Why we use it, and our lawful basis

• To provide a service you signed up for or asked about, including replying to enquiries: performing a contract, or steps before one.
• To bill you and keep accounts: legal obligation (tax and company law).
• To keep our services secure, prevent fraud and fix faults: our legitimate interests.
• To send service messages, such as reminders, receipts and important changes: performing our contract with you.
• To tell existing customers about similar services: our legitimate interests, and you can opt out in any email.
• Advertising measurement and analytics cookies: your consent, which you can withdraw at any time.

We do not sell personal data, and we do not make decisions about you by automated means that have legal or similarly significant effects.

6. Cookies, Meta and TikTok on oxus.ie

By default this website sets no tracking cookies. We ask first. If you click Accept on the cookie banner, we load two advertising pixels. The Meta Pixel sets Meta's cookies (_fbp, and _fbc if you arrived from one of our Facebook or Instagram ads) and tells Meta which pages you viewed. The TikTok Pixel does the same for TikTok: it sets TikTok's cookies (including _ttp and ttcsid, and ttclid if you arrived from one of our TikTok ads) and tells TikTok which pages you viewed, and whether you tapped our phone number, email address or WhatsApp link.

If you then send us a form, we also tell Meta and TikTok that a request was made, so we can see which of our ads bring in enquiries. To match it to our ads, Meta receives your email, phone and name in scrambled (hashed) form, and TikTok receives your email and phone in scrambled (hashed) form. Each receives them both from your browser and from our server, which also passes on your IP address and the type of browser you use. We use this only to measure and improve our ads.

If you click No thanks, none of that happens and the site works the same. Your choice is remembered in your browser, and you can change it at any time with Cookie settings, which is also in the footer of every page. Our fonts are served from our own site, so loading a page does not contact any font service.

Our products use strictly necessary cookies to keep you signed in. Where a product uses analytics or advertising cookies, it asks for your consent first and explains them in its own cookie notice.

7. Who we share it with

We use trusted providers to run our services. Each is bound by a contract to protect the data and use it only for us. Which ones a given product uses is set out in that product's own documents where it has them.

• Hosting and databases: Vercel and Supabase, with data stored in the EU (Ireland) wherever the service allows. Some client systems run on the client's own servers or cloud account instead.
• Email: Resend for sending service email, and Google Workspace for our mailboxes.
• Payments: Stripe, which is also an independent controller for payment and fraud-prevention data.
• AI features: Anthropic, Amazon Web Services (Bedrock, EU region) and Google (Gemini), only in products or projects that have AI features, and on terms that stop them training models on the content.
• Error monitoring: Sentry (EU).
• Licensing: Cloudflare, for checking software licences.
• Lookups: official and commercial services a feature relies on, such as company and VAT registers, vehicle registration lookups and address or mapping services.
• Forms, analytics and advertising: Web3Forms, Meta, TikTok, and Google Analytics and Google Ads, the last four only with your consent.
• Professional advisers, such as our accountants and lawyers, and authorities where the law requires it.

If we sell or reorganise our business, the data may pass to the new owner, who must respect this notice.

8. Transfers outside Ireland

We keep data in the EU where we can. Some providers are based in, or may access data from, the United States or the United Kingdom. The UK has an EU adequacy decision. For the US, we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses. Transfers from the UK use the UK equivalents. Ask us for a copy of the safeguard that applies. TikTok, if you accept its cookies, may also process data in countries outside the EU other than those two. Where, and under what safeguards, is set out in TikTok's own privacy policy.

9. How long we keep it

• Enquiries that do not become work: up to 24 months after our last contact.
• Client and billing records: 6 years after the end of the financial year they relate to, as Irish tax law requires.
• Product accounts: while your account is open, then 30 days so you can take a copy, then deleted, except billing records as above.
• Security logs: normally no more than 12 months.
• Data we process for a customer: as that customer instructs, and deleted or returned when the service ends.

A product's own notice may set shorter periods for particular records.

10. Security

We encrypt data in transit, restrict access to the people who need it, use role-based permissions in our products, keep audit trails and backups, and store documents in access-controlled storage. No system is perfectly secure, and if a breach puts your rights at risk we will tell you and the regulator as the law requires.

11. Children

Our services are for adults and businesses, and we do not knowingly collect data directly from children. Some of our customers record information about children in our products, for example for bookings or school workshops. They do so as controllers, and they are responsible for having a lawful basis and giving the required information to parents or guardians.

12. Your rights

You can ask us for a copy of your personal data; to correct it; to delete it; to restrict or object to how we use it; and to receive data you gave us in a portable format. Where we rely on consent, you can withdraw it at any time. Email info@oxus.ie and we will reply within one month. We may need to confirm your identity first.

If you are unhappy with how we have handled your data, please tell us so we can put it right. You can also complain to the Data Protection Commission in Ireland, or, if you are in the UK, including Northern Ireland, to the Information Commissioner's Office.

13. Changes to this notice

We update this notice when our services or the law change. The date at the top shows the latest version. If a change significantly affects how we use data we already hold about you, we will tell you before it takes effect.