Optimal Nexus Ltd ("we", "us", "our") operates ONX, an operating system for people businesses spanning Revenue, Hiring, Operations and Finance. This policy explains how we handle personal data for which we are the data controller: visitors to our website, ONX account holders, and the B2B contact data we source for the Revenue module. For personal data you process within ONX, such as candidate records in Hiring, or client and workforce data in Operations and Finance. You are the controller and we act as your processor under a Data Processing Agreement; that processing is governed by your own privacy notices and our DPA, not this policy. For questions about this policy, contact us at compliance@optimalnexus.com.
Name, email address, company name, and billing information collected when you sign up.
Log data, feature interactions, and session information to operate and improve the Service.
Within the Revenue module, ONX sources business contact information (names, job titles, company email addresses, LinkedIn profiles) from publicly available information and third-party enrichment providers. This data relates to individuals in their professional capacity and is processed for legitimate B2B purposes such as account research and prospecting.
When you connect a third-party account, such as Google Search Console, Bing Webmaster Tools, HubSpot, or LinkedIn, ONX fetches performance and analytics data on your behalf using OAuth 2.0 or API credentials that you provide. This includes search performance metrics, post analytics, page statistics, and audience engagement data. This data is displayed only within your ONX dashboard and is never shared with other users or third parties.
Personal data you upload to or generate within the platform, for example candidate records in Hiring, or client, programme and workforce data in Operations and Finance, is processed on your behalf as your processor and is covered by our Data Processing Agreement, not the controller activities described in this policy.
Within ONX Revenue, contact enrichment data is processed under the lawful basis of legitimate interests for B2B marketing purposes, consistent with Recital 47 of the GDPR. We apply strict data minimisation: only professional contact details relevant to a business context are stored, and all contact records expire automatically (default 12 months).
We maintain a suppression list. Any contact who opts out of communication is immediately suppressed and will not appear in future discovery results.
We do not sell personal data. We integrate with third-party platforms (LinkedIn, Google, Bing, HubSpot) on your behalf using OAuth 2.0 or API credentials that you provide; data retrieved from these platforms is used solely within your ONX dashboard. We share data only with the following infrastructure processors:
All processors are GDPR-compliant and operate under Data Processing Agreements.
Some of our processors operate outside the UK/EEA. Where data is transferred, we ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions).
Under UK GDPR and EU GDPR you have the right to:
To exercise any right, email compliance@optimalnexus.com or use the Data & Privacy controls in your account settings. We respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
We use essential session cookies required for authentication. We do not use third-party advertising or tracking cookies.
We may update this policy from time to time. Material changes will be communicated by email or an in-app notice at least 14 days before taking effect.
Data protection enquiries: compliance@optimalnexus.com