GDPR

Who we are

"Omonix", "we" and "us" refer to two related entities, each acting as an independent data controller for the clients and enquiries it handles:

• Omonix Ltd, registered in England and Wales, company number 11390775, Office 3.05, 1 Kings Street, London EC2V 8AU, United Kingdom.
• Union Roth Capital PTY LTD, trading as Omonix, ACN 118 686 178, PO Box 6666, East Perth Business Centre WA 6892, Australia.

Which entity is responsible for your information depends on which contracted with you or received your enquiry. If you are unsure, write to and we will confirm.

Controller and processor roles

We act in two distinct capacities, and the distinction matters:

• As a controller for our own enquiries, correspondence, client relationships and business records. We decide what is collected and why, and this is governed by our Privacy Policy.
• As a processor when an advisory engagement requires us to handle personal data belonging to your staff, customers or users. There we act only on your documented instructions, under a written data processing agreement.

Our commitments as a processor

Where we process personal data on your behalf, we will:

1. Process it only on your documented instructions and for the purposes of the engagement.
2. Enter a written data processing agreement covering the requirements of Article 28.
3. Apply appropriate technical and organisational security measures, and describe them to you on request.
4. Ensure anyone we authorise to access the data is bound by confidentiality.
5. Not engage a sub-processor without your prior authorisation, and remain responsible for any we do engage.
6. Assist you in responding to data subject requests that concern data we hold for you.
7. Notify you without undue delay on becoming aware of a personal data breach affecting your data.
8. Return or delete the data at the end of the engagement, as you direct, and confirm when we have.
9. Make available the information you reasonably need to demonstrate compliance, and permit audit on reasonable notice.

Data minimisation in practice

Most of our advisory work does not require copies of personal data at all. Assessments can normally be carried out through screen-shared review, redacted extracts, aggregate figures and configuration exports rather than data transfers. Where a copy genuinely is needed, we scope it to the narrowest set that answers the question, hold it for the shortest period that allows the work to be completed, and delete it on confirmation.

Legal bases we rely on as a controller

• Article 6(1)(b), performance of a contract, for delivering engagements and taking pre-contractual steps at your request.
• Article 6(1)(c), legal obligation, for statutory financial and tax records.
• Article 6(1)(f), legitimate interests, for responding to business enquiries you initiate and for protecting our systems. We have assessed that these do not override your rights, given the business context and the limited data involved.
• Article 6(1)(a), consent, for optional website measurement only, which you may withdraw at any time.

We do not process special category data as a controller, and we do not seek it. We do not carry out automated decision-making within the meaning of Article 22.

Your rights, and how to exercise them

Under the UK and EU GDPR you have the right of access (Article 15), rectification (16), erasure (17), restriction (18), data portability (20), objection (21), and withdrawal of consent (7(3)).

Send requests to . We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month and explain why. There is no charge unless a request is manifestly unfounded or excessive. If your request concerns data we hold as a processor for one of our clients, we will refer you to that client and support them in responding.

International transfers

Where personal data moves out of the United Kingdom or the EEA, we rely on UK adequacy regulations or European Commission adequacy decisions where they apply, and otherwise on the UK International Data Transfer Agreement, the UK Addendum, or the EU Standard Contractual Clauses, supported by a transfer risk assessment.

Breach notification

As a controller, we assess any personal data breach and notify the relevant supervisory authority within 72 hours where the breach is likely to result in a risk to individuals’ rights and freedoms, and notify affected individuals where the risk is high. As a processor, we notify the client controller without undue delay and support their assessment and reporting.

A note on scope

Our cyber and data protection work is advisory and readiness. We help clients understand their obligations, close gaps and prepare for assessment. We are not a certification body, we do not provide legal advice, and we do not act as an outsourced Data Protection Officer unless that is separately and expressly agreed in writing. Where a question needs a legal opinion, we will say so and recommend you obtain one.

Contacting us

For any data protection matter, including processor agreements and due diligence questionnaires, write to and mark it for the attention of data protection.