Last updated: 25 September 2026
Who is responsible
ONFO LTD is the controller of personal information described in this notice. We are registered in England and Wales, company number 16920128. Our registered office is 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
Contact us about privacy by emailing support@onfo.co.uk or writing to “Privacy enquiries, ONFO LTD” at our registered office.
What this notice covers
This notice covers www.onfo.co.uk and correspondence about ONFO. It does not describe the processing carried out by any separate application or digital product; those services require their own privacy information.
Information we handle and why
Visiting the website
Our hosting provider, Vercel, processes connection and request information to deliver pages and protect the website. This can include your IP address, browser and device information, requested URL, request time, referring page and security-event information.
Our legal basis is our legitimate interest in running a reliable, secure company website, preventing misuse and investigating technical problems.
Contacting us
If you contact us, we receive the details you provide, such as your name, email address, organisation, message and attachments. We use these to respond, manage the enquiry and keep a relevant record of the correspondence. Our legal basis for ordinary enquiries is our legitimate interest in communicating with people who contact the company.
If you ask us to take steps towards a contract with you personally, we may process information as necessary for those steps or for performing that contract. Where a specific legal duty requires processing, such as responding to a valid data-rights request, we rely on compliance with that legal obligation.
You choose whether to contact us. Without relevant contact details or information, we may be unable to answer your enquiry. Please avoid sending sensitive information or details about other people unless necessary.
Cookies, tracking and automated decisions
We use optional, cookieless Vercel Web Analytics only with your consent, to measure page visits and improve the website. It reports page, referral, approximate location and browser/device information. We remove page-URL query strings and fragments before sending events. We store your analytics preference in first-party local storage for 180 days. We do not use advertising trackers, embedded social-media widgets or marketing cookies. Fonts are served from our own website. See our Cookie policy for details and use Cookie settings in the footer to withdraw consent at any time without affecting earlier lawful processing. Our standard Vercel Pro plan provides a 12-month reporting window for analytics reports. This is the period Vercel guarantees the data will be stored and available for analysis, not a guaranteed deletion deadline: Vercel states that it may retain analytics data longer to support plan upgrades. We do not export analytics to separate storage. See Vercel’s reporting-window documentation. The temporary visitor hash is discarded after 24 hours; that is separate from aggregate-report retention.
The hosting service may use strictly necessary security measures to distinguish legitimate requests from abusive traffic. These are for protection, not advertising. We do not use your information for automated decisions producing legal or similarly significant effects, or for advertising profiling.
Who receives information
Information is accessed only where needed for the purposes above. Recipients may include our website hosting and security provider (Vercel), Microsoft, which provides Microsoft 365 company email and related IT services and processes correspondence on our behalf, and professional advisers where necessary. We may also disclose information to a regulator, court or other authority where legally required, or where necessary to establish, exercise or defend legal claims. We do not sell personal information.
International processing
We use Microsoft 365 for company email. Microsoft and its subprocessors may process correspondence outside the UK, including in the United States. Microsoft’s Products and Services Data Protection Addendum provides contractual safeguards for international transfers, including the European Commission’s 2021 Standard Contractual Clauses and, for UK transfers, the UK International Data Transfer Addendum. Microsoft also states that it is certified under the UK Extension to the EU–US Data Privacy Framework. The applicable protections depend on the transfer and service. These safeguards do not mean that all correspondence is stored or processed in the UK; we do not specify a tenant data location in this notice. Contact us using the details above for information about the safeguards or a copy, subject to necessary redactions.
Vercel operates internationally, so website request information may be processed outside the UK, including in the United States. Where a transfer is restricted by UK data-protection law, it requires an applicable UK adequacy arrangement or appropriate safeguards, such as approved contractual terms with the UK transfer provisions. Vercel describes its arrangements in its Data Processing Addendum. Contact us for information about the safeguards applicable to your information or to request a copy, subject to necessary redactions.
How long we keep information
- Routine enquiries: we review and delete correspondence manually within 12 months after the enquiry is resolved, unless retention is needed for the contractual, legal or complaint purposes below.
- Contractual, legal or complaint records: we keep only the information needed for the relevant obligation or dispute. The period depends on the applicable record-keeping requirement, the duration of the matter and any relevant time limit for legal claims. We review the need for retention when the matter closes and delete records when they are no longer needed.
- Technical and security records: retention depends on the hosting service’s log lifecycle and whether a record is needed to investigate an incident. We do not create a separate visitor-history database. Any incident evidence we retain is reviewed when the investigation ends and deleted when no longer needed for security or legal purposes.
Your rights
Depending on the circumstances, you can request access to your information, correction of inaccurate information, deletion, restriction of processing and, where applicable, a portable copy. These rights are subject to the conditions and exceptions in data-protection law.
You have the right to object to processing based on legitimate interests for reasons relating to your particular situation. We will consider your objection and stop that processing unless we have a lawful reason to continue.
Contact us using the details above. We may ask for information reasonably needed to confirm your identity. We normally respond without undue delay and within one month. If the law permits extra time, we will explain why and tell you the revised deadline. Requests are normally free of charge.
Questions and complaints
You can make a data-protection complaint by email or post using the contact details above. Please explain the concern and how we can contact you. We will acknowledge the complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome.
You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Changes to this notice
We will update this notice if the website or our handling of information changes. The date above identifies the latest version. Where required, we will bring significant changes to your attention separately.