What we collect, and what we don’t.

Who is responsible

OLTRX, trading as OLTRX, is the controller of the personal data described here. We are [ADD: entity type] registered in the United States under number [ADD: reg number], at [ADD: address].

For anything in this policy, write to privacy@oltrx.io. A person reads it. We have not appointed a Data Protection Officer, because our processing does not meet the threshold in Article 37 of the GDPR.

What we collect

Three things, and nothing else.

What you type into the contact form

Your name, email address, the topic you choose, your message, your organization if you give it, and a record that you ticked the consent box and when.

What you send us by email

Whatever is in the message you send to hello@oltrx.io or privacy@oltrx.io, including your address and anything you attach.

Server logs

Our host records the usual technical details of each request, IP address, time, the page requested, browser user-agent. This happens for every website; it is how a server answers a request at all. We do not use these logs to build any profile of you and we do not link them to anything else.

We do not collect anything else. Specifically, this site does not:

• set cookies of any kind, first party or third party;
• use localStorage, sessionStorage or any other storage on your device;
• run analytics, tag managers, pixels, session recording or heatmaps;
• load fonts, scripts, images, videos, maps or embeds from any other company’s servers;
• use a CAPTCHA;
• sell or share personal data, or use it for targeted advertising.

We chose to self-host our typefaces for exactly this reason. Loading them from a font service would send your IP address to that company before you had done anything at all.

Why, and on what legal basis

If the GDPR or the UK GDPR applies to you, these are our lawful bases.

What	Why	Lawful basis
Contact form and email	To read your inquiry and reply to it	Article 6(1)(b), steps at your request before entering a contract. Where no contract is in view, Article 6(1)(f), our legitimate interest in answering people who contact us.
The consent tick	To record that you were shown this policy and asked us to reply	Article 6(1)(c), our own accountability obligation under Article 5(2).
Client project records	To do the work, invoice for it and keep accounts	Article 6(1)(b) for the contract, and Article 6(1)(c) for tax and accounting records.
Server logs	To serve the site, and to see abuse or attacks	Article 6(1)(f), our legitimate interest in a working, secure site.

We do not make automated decisions about you, and we do not profile you.

Please do not send us special category data, health, biometrics, political or religious views, trade union membership, sexual orientation, through this site. We have no reason to hold it. If you send it anyway, we will delete it once we have dealt with your message.

Who else sees it

Only the providers we need to run the business. Each acts as our processor under a written agreement, and none of them may use your data for their own purposes.

• Netlify, Inc. hosts this site and produces the server logs.
• Netlify Forms receives and stores contact form submissions.
• [ADD: mail provider] carries and stores our email.

We may also disclose personal data to our accountant or professional advisers where necessary, or to a public authority where we are legally required to. We do not sell personal data, and we have never done so.

Where it is stored

Data handled by the providers above is stored in the United States.

If you are in the European Economic Area, the United Kingdom or Switzerland and your data is stored outside it, that transfer relies on the European Commission’s Standard Contractual Clauses, or on an adequacy decision where one covers the provider. You can ask us for a copy of the safeguards that apply.

How long we keep it

What	How long
Inquiries that don’t lead to work	Deleted within 12 months of the last message
Client project records and correspondence	For the engagement, then 6 years
Invoices and accounting records	As long as tax law in the United States requires
Server logs	As long as our host retains them, typically around 30 days

Your rights

Under the GDPR and the UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to someone else in a portable form. You can object to processing we base on legitimate interests, and where we rely on consent you can withdraw it at any time without affecting what we did before you did.

Write to privacy@oltrx.io. We answer within one month. There is no charge, and we will not treat you differently for asking.

If you think we have got it wrong, you can complain to the data protection authority where you live or work. In the EU, the list is at edpb.europa.eu. In the UK it is the Information Commissioner’s Office at ico.org.uk. We would rather you told us first, but you do not have to.

If you are in the United States

Twenty states now have comprehensive privacy laws. Most of them only bite above thresholds, commonly 35,000 to 100,000 consumers a year or 25 million dollars in revenue, that a business of our size does not reach. We are telling you what we do anyway, because the answer is short.

In the last twelve months we have not sold personal information, shared it for cross-context behavioral advertising, or used it for targeted advertising or profiling. We collect the identifiers and message contents described above, and nothing in the categories of sensitive personal information.

Wherever you live in the United States, you may ask us to tell you what we hold, give you a copy, correct it or delete it, by writing to privacy@oltrx.io. We will not discriminate against you for asking. Because we do not sell or share personal information, there is nothing for a “Do Not Sell or Share” link to switch off, and we honour Global Privacy Control signals by default in the sense that there is no sale or sharing to opt out of.

If you are in Latin America

If you are in Brazil, the LGPD gives you rights to confirmation, access, correction, anonymization or deletion, portability, information about who we share data with, and to withdraw consent. If you are in Mexico, Argentina, Chile, Colombia or elsewhere in the region, comparable rights apply under your national law. Use the same address , privacy@oltrx.io, and we will handle your request the same way.

Children

This site is aimed at businesses and at adults looking for work or training. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, tell us and we will delete it.

Security

The site is served over HTTPS. The number of places your data can sit is deliberately small, which is itself a security measure. No method of transmission over the internet is completely secure, so please do not send us passwords, card numbers, or credentials of any kind.

Changes

If we change how we handle personal data we will update this page and move the date below. If a change is significant and we hold your address because you are a client, we will tell you directly.

Effective [ADD: effective date]. OLTRX, [ADD: address].