Privacy Policy

1. Introduction

OroMiQ Ltd, a company registered in England and Wales (company number 17083358) with its registered office at Bank Gallery, 13 High Street, Kenilworth, CV8 1LY ("OroMiQ", "we", "us", or "our"), is committed to protecting your privacy. We are registered with the Information Commissioner's Office (ICO) under registration number ZC250073.

This Privacy Policy explains how we handle personal data when you visit our website, sign up for or use the OroMiQ platform (the "Service"), or contact us, and how we handle public register data in our data layers.

We are the controller for our website, for accounts, billing, support and security, and for the public register data we compile for the data layers. When our customers use OroMiQ to manage their own contacts, emails, documents, deals and similar records, the customer is the controller of that data and we process it on the customer's behalf (see section 2.6). If an OroMiQ customer holds your details, please contact that organisation about how it uses them.

2. Data We Collect

2.1 Account Information

When you create an account or are invited to join, we collect:

• Full name
• Email address
• Password (stored in hashed form)
• Organisation name and details
• Role within your organisation
• Your organisation's phone number and website, if you give them
• Two-factor authentication and passkey settings
• Your sign-in history: the date, time, IP address and browser of each sign-in attempt

2.2 Billing Information

Payments are handled by Stripe. Stripe collects your card details and may also collect your billing address and VAT number. We do not see or store your full card details. We keep a Stripe customer identifier and billing records such as your plan, add-ons, billing dates and invoices.

2.3 Usage Data

We collect information about how you use the Service:

• Your settings and preferences, such as dashboard layouts
• Usage counts for your plan's allowances, such as storage used and emails sent
• Which Market Intelligence views you open and the filters you apply
• When something goes wrong, an error report with the recent clicks and pages that led to it, but never what you typed

If you accept analytics cookies, Google Analytics also records the pages you visit (section 9). Records you create for your organisation, such as notes, watchlists and portfolios, are your organisation's Customer Data (section 2.6).

2.4 Technical Data

We automatically collect:

• IP address
• Browser type and version
• Device type and operating system
• Referring URLs
• Session duration and timestamps

2.5 Public Register and Open Data

Our optional data layers use public registers and open data sources: Companies House, The Gazette, the Gender Pay Gap service, the Energy Performance Certificate (EPC) register, the ICO register of fee payers, the Food Standards Agency's food hygiene ratings, the Care Quality Commission (CQC) and the Care Inspectorate (Scotland) datastore. Our Data sources page lists exactly what we take from each one.

Most of this data is about organisations and premises, but some is about individuals: company officers and people with significant control, with the names, roles, occupations, dates and correspondence addresses that Companies House publishes, but not their month and year of birth, nationality or country of residence, which we do not keep; CQC registered managers, nominated individuals and people registered with CQC as a provider in their own name; childminders and other services registered in a person's name with the Care Inspectorate; and sole traders on the ICO register of fee payers and in food hygiene ratings. We collect this from the published registers, not from the individuals themselves. We do not take personal insolvency, bankruptcy or deceased estates notices from The Gazette, or the names of people responsible for Gender Pay Gap reports.

We process this data on the basis of legitimate interests: ours in providing a business intelligence service, and our customers' in understanding the organisations they work with or may want to work with. We use it to show information on company records, to let customers search some registers and add organisations to their CRM, to alert customers to changes and new registrations that match their filters, and to produce market statistics.

On the record of a company a customer has in OroMiQ, the Companies House data layer lists the company's current officers and, for 12 months after they resign, its past officers. For any other company it shows only owners that are organisations, never people. Current officers, and the registered manager and nominated individual from the CQC data layer, are offered so that a customer can add them as contacts. If a customer adds a person or an organisation from a register, the copy becomes part of the customer's own records (section 2.6): the customer is its controller, is responsible for how it uses it and for telling the people concerned, and the retention periods below do not apply to that copy.

We do not sell or rent this data as lists. Each customer decides whether to contact any organisation or person it finds through OroMiQ, and is responsible for doing so lawfully, including under the rules on marketing emails and calls. The ICO register of fee payers and the EPC register only add information to companies a customer already holds: they cannot be used to search for, or be alerted to, new organisations. To match the ICO register against customers' companies, we hold a copy of the whole register, including sole traders' names and business addresses, but a customer only ever sees an entry that matches a company it holds.

Where a register entry is likely to be a person's home, we never show the street address, and we show only the first part of the postcode (for example EH12). This covers childminders, people registered with CQC in their own name, food businesses whose council has not published a street address, usually because the business is run from a home, and every entry from the ICO register of fee payers, because that register does not say whether an entry is a sole trader or a company.

How long we keep register data about individuals:

• Companies House officers and people with significant control: we hold these only for companies that a customer has in OroMiQ. While a customer has a company, we refresh its details at least every 7 days, so anything Companies House removes or suppresses is removed from OroMiQ at the next refresh. We delete an officer's details 12 months after they resign, and a PSC's 12 months after they stop being one, even though Companies House keeps publishing them. We delete all of a company's officer and PSC details 30 days after no customer has it in OroMiQ.
• Other register entries about individuals (ICO fee payers, food hygiene ratings, CQC and Care Inspectorate): except as set out below, we keep them while the register publishes them, and delete them within 12 months after they stop appearing, for example when a registration ends or a service is cancelled.
• CQC nominated individuals: we keep only the current nominated individual, not past ones.
• Past CQC registered managers: we keep their names for 6 years after they leave a service, because the history of a service's management is part of how customers understand it.
• Changes to a register that we show in alerts and timelines, such as an officer's appointment or resignation: 12 months.

If your details appear in one of these registers, you can ask about our use of them or object to it using the details in section 13. To correct the register itself, contact the body that publishes it.

The business rates data layer does not import or store any business rates data: it links to the Valuation Office Agency's public Find business rates service.

2.6 Data We Process for Our Customers

Our customers use OroMiQ to hold personal data about the people they deal with. This includes: contact details and notes about people at the companies they work with, including people they add from a public register (section 2.5); their watchlists and portfolios; emails sent and received through a connected Microsoft 365 mailbox, including attachments; whether emails sent from a connected mailbox were opened and which links were clicked, with details of the browser or email app used; whether quotes, invoices, payment reminders and credit notes they send through OroMiQ were delivered, opened and clicked; details entered on their web forms and booking pages, and the IP address and browser details of people who submit their web forms; the names, email addresses, signatures, IP addresses and browser details of people who sign documents, with a record of when they viewed and signed; the names and email addresses of guests invited to secure rooms, with a record of what they opened or uploaded and the IP address and browser used; documents they upload; and records of calls they log. Some customers may record information that reveals someone's health, for example a note that a contact is on long-term sick leave or needs an accessible meeting room. We process this only to provide the Service to that customer. The customer decides what is collected and is responsible for telling the people concerned.

2.7 Website Visits, Enquiries and Signup

When you visit our website we collect technical data (section 2.4) and, if you accept cookies, analytics and advertising measurement data (section 9). If you send us an enquiry or support request, we keep your name, email address, the topic and your message. When you sign up, we record where you came from, such as a campaign link or voucher code, and keep your signup progress for up to 7 days. Our sign-up and password reset forms use Cloudflare Turnstile to check that you are not a bot; Turnstile processes your IP address and browser details.

3. How We Use Your Data

We use your personal data for the following purposes:

• Service delivery: To provide, maintain, and improve the OroMiQ platform and your account.
• Authentication: To verify your identity and manage access to your account and organisation.
• Billing: To process payments, manage subscriptions, and issue invoices.
• Communication: To send you service-related notifications, updates, and support responses.
• Understanding use: To see how the Service is used and improve it, from error reports, usage counts and Market Intelligence usage (section 2.3) and, if you accept analytics cookies, Google Analytics.
• Security: To detect, prevent, and respond to security incidents, fraud, or abuse.

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract: where you personally are our customer, for example as a sole trader, processing needed to provide the Service and manage your subscription.
• Legitimate interests, where they are not overridden by your rights: providing the Service to the organisation you work for, including your login if you signed up on its behalf or it invited you; keeping the Service secure; understanding how the Service is used from error reports, usage counts and Market Intelligence usage, none of which use cookies; answering enquiries and support requests; and providing our data layers (section 2.5).
• Consent: for Google Analytics and Google Ads measurement cookies (section 9). You may withdraw consent at any time.
• Legal obligation: Where we are required to process data to comply with a legal obligation.

5. Who We Share Data With

We do not sell your personal data. We use these service providers, which process personal data for us:

• Microsoft Azure: hosts the Service, including its files and logs, in the UK (UK West region).
• MongoDB Atlas: our database, hosted on Microsoft Azure in the UK.
• Stripe: payment processing, billing and invoices.
• Twilio SendGrid: delivers the emails we send you, such as sign-up codes, password resets and billing notices, and these emails our customers send through OroMiQ: quotes, invoices, payment reminders, credit notes, signing requests and secure room invitations. For quotes, invoices, payment reminders and credit notes, SendGrid reports back to us whether each email was delivered, bounced, opened or clicked.
• Microsoft 365 (Microsoft Graph): if you connect a Microsoft 365 mailbox, OroMiQ reads each new email to check whether it is to or from a contact in your CRM. Matching emails, including attachments, are copied into OroMiQ and shown on the company's timeline; other emails are not copied into OroMiQ. OroMiQ also sends email from the mailbox when you or your sequences send, and reads and creates calendar events for calendar and meeting features. Connecting is optional and can be undone at any time from Settings. Sign-in tokens are encrypted at rest.
• Google: with your consent, Google Analytics on our website and in the app, and Google Ads measurement on our website (see section 9). Our website also loads its font from Google Fonts. Google may process data outside the United Kingdom. See Google's Privacy Policy.
• Cloudflare: Turnstile, which checks that people using our sign-up and password reset forms are not bots.
• Sentry: error reports from our website, the app and our servers, stored in the European Union. We remove sign-in tokens and cookies from these reports and, in the website and app, identify a signed-in user only by an internal ID.
• Slack: We use Slack internally to handle product feedback and support conversations. When you submit feedback or contact support through the Service, the content of your message together with your name, email address, organisation, and the page you were using may be shared with our support team via Slack so we can respond to you. Slack processes this data under its data processing agreement; see Slack's Privacy Policy. We also use Slack to alert our team to errors, and an alert can include the internal ID of the user affected and the page they were using.

Of these, Microsoft Azure, MongoDB Atlas, Twilio SendGrid and Sentry process our customers' Customer Data, so we give our customers at least 30 days' notice before adding or replacing one of them (section 12). A customer's Microsoft 365 mailbox is the customer's own service, which OroMiQ connects to under the customer's agreement with Microsoft.

We may also share personal data:

• Your organisation: If you are part of a team, your name, email, and role are visible to administrators within your organisation (the administrators of its workspace in the Service).
• Our customers: register data, including the names of company officers, people with significant control and CQC managers, and the other individuals named in section 2.5, is shown to the users of customers who switch on the relevant data layer (section 2.5). Company officers and people with significant control are shown only to customers that have the company in OroMiQ.
• Legal requirements: Where required by law, regulation, or legal process.

6. How Long We Keep Data

• Your account and your organisation's Customer Data: for as long as your organisation's account (your workspace) exists, including after a subscription ends, so that you can export your data or subscribe again. We delete it when your organisation's account administrator asks us to, apart from records the law requires us to keep. Some parts are kept for shorter periods, listed below.
• Sign-in history: 12 months.
• Sign-in sessions: until you sign out or your session expires.
• Signup progress: 7 days.
• Records of email opens and clicks (part of Customer Data): 24 months.
• Results of intelligence alerts, meaning the matches and changes an alert finds: 12 months. The alerts a customer sets up are kept with its account.
• In-app notifications: 90 days.
• Market Intelligence usage: 180 days.
• Error logs in our own systems: 30 days.
• Error reports in Sentry: deleted by Sentry within 90 days.
• Enquiries, support requests and feedback, including copies in Slack: 2 years after our last contact about them, or sooner if you ask us to delete them.
• Billing records: at least six years, as UK tax law requires.
• Public register data: as described in section 2.5.
• Database backups: 3 days.

Deleted data can remain in our database backups until those backups expire, up to 3 days after it is deleted.

If you ask us to delete personal data we hold as controller about you, such as your account, sign-in history or an enquiry, we will respond within one month and delete it unless the law requires us to keep it. For register data, you can object (section 2.5), and we will stop using your data unless we have compelling legitimate grounds that override your interests. For data a customer holds about you in OroMiQ, contact that customer (section 1).

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption in transit and at rest, access controls, and regular security reviews.

8. Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal and contractual obligations.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Data portability: Request a copy of your data in a structured, commonly used format.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

If your details appear in a public register we use (see section 2.5), these rights apply to our use of that data too, including the right to object.

To exercise any of these rights, contact us through our help centre or email hello@oromiq.com. We will respond within one month.

You have the right to complain to us about how we handle your personal data. Email hello@oromiq.com with "Data protection complaint" in the subject, use our help centre, or write to us at Bank Gallery, 13 High Street, Kenilworth, CV8 1LY. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office at any time (section 13).

9. Cookies and Similar Technologies

We use cookies and similar browser storage. Essential ones are needed for our website and the OroMiQ app to work. Functional ones remember choices you make, such as whether you view prices with VAT or how you have set up a table. We do not ask for consent for essential or functional storage. You can remove functional storage at any time by clearing it in your browser, and our website and app keep working without it: they just forget those choices. We only use analytics and advertising measurement cookies if you accept them.

We only load Google Analytics (on our website and in the app) and Google Ads measurement (on our website) after you click Accept. If you click Decline, we do not load them. Google Analytics uses cookies and a random identifier rather than your name, but its data is still personal data. Google Ads measurement tells us whether our adverts lead to enquiries and sign-ups; we do not use it for remarketing or personalised advertising.

Our website loads its font from Google Fonts, so your browser sends your IP address to Google when a page loads.

You can change your choice at any time: on our website from Cookie settings in the footer, and in the OroMiQ app from Cookie settings in the menu under your name. If you withdraw consent, we tell Google to stop using analytics and advertising cookies and remove the Google cookies we have set.

10. International Transfers

We host the Service in the UK (Microsoft Azure, UK West). Some of our service providers process data outside the UK, including in the United States and the European Union. Where a country does not have UK adequacy regulations, we use the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified.

11. Children

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or through the Service. If we add or replace a service provider in section 5 that processes our customers' Customer Data, we give our customers at least 30 days' notice, as section 7.2 of our Terms of Service describes. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Contact

If you have any questions about this Privacy Policy or how we handle your data, contact us through our help centre, email hello@oromiq.com, or write to us at Bank Gallery, 13 High Street, Kenilworth, CV8 1LY.

You can complain to us (section 8), and you also have the right to complain to the Information Commissioner's Office (ICO) at any time, at ico.org.uk.