§ 01

Controller

OMNEXIS GROUP LLC is the controller of personal data processed in connection with the Website and the Company’s Services. The Company is subject to the GDPR pursuant to Article 3(2) GDPR, as it offers services to organisations in the European Union.

Questions concerning personal data may be sent to office@omnexis.biz.

§ 02

Scope of this Policy

This Policy describes the processing of personal data concerning three groups of people:

• visitors to the Website and persons who contact the Company;
• Clients and their representatives and employees;
• individuals whose data is processed in the course of research performed for Clients, such as directors, shareholders, beneficial owners and persons in other business roles.

§ 03

Website Visitors and Enquiries

When you submit the contact form or write to the Company, we process your name, company, email address, the area of interest selected and the content of your message, in order to respond to your enquiry and to prepare a Scope of Work.

Legal basis: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Article 6(1)(f) GDPR (the Company’s legitimate interest in responding to business enquiries).

Enquiries that do not lead to an engagement are deleted within 12 months of the last contact.

§ 04

Clients and Their Representatives

In connection with an engagement, we process the names, roles, contact details and correspondence of the Client’s representatives and employees, together with information necessary for invoicing.

Legal basis: Article 6(1)(b) GDPR (performance of a contract), Article 6(1)(c) GDPR (compliance with legal obligations, including accounting and tax obligations) and Article 6(1)(f) GDPR (the Company’s legitimate interest in managing its business relationships).

This data is retained for 5 years from the end of the engagement, or longer where required by law.

§ 05

Individuals Concerned by Research

In the course of open-source research, due diligence and counterparty identification, the Company may process data concerning individuals in business roles, obtained not from those individuals but from public and lawfully accessible sources. This section provides the information required by Article 14 GDPR.

Categories of data

• name, business roles, positions and dates of appointment;
• shareholdings, ownership and control of organisations;
• business connections and professional history;
• entries in public registers, including court, insolvency and enforcement records;
• presence on sanctions lists and status as a politically exposed person;
• published media reports concerning business activity.

Sources

Company and business registers, court and insolvency registers, official gazettes, regulatory databases, sanctions lists, annual reports and company disclosures, and published media.

Purposes and legal basis

The data is processed to assess a business relationship, transaction or market on behalf of a Client, on the basis of Article 6(1)(f) GDPR: the legitimate interest of the Client and of the Company in verifying counterparties, preventing fraud and making informed commercial decisions. Research is limited to business roles and activity and to what is necessary for the agreed purpose, and does not extend to private life.

Information relating to criminal convictions and offences is processed only where permitted under Article 10 GDPR and the applicable national law.

Recipients

The findings are provided to the Client that commissioned the research, which becomes a separate controller of the data it receives.

Retention

Working materials are deleted or anonymised within 12 months of delivery of the Deliverable, unless a longer period is necessary to establish, exercise or defend legal claims.

Right to object

You have the right to object at any time to processing based on Article 6(1)(f) GDPR, on grounds relating to your particular situation. The Company will then cease processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for legal claims.

§ 06

Recipients and Processors

Personal data may be disclosed to:

• hosting, email and IT service providers acting as processors under data processing agreements;
• payment and accounting service providers, to the extent necessary for invoicing;
• Law27, the Company’s document drafting practice, where documentation is prepared as part of an engagement;
• professional advisers, where necessary;
• public authorities, where required by law.

Personal data is not sold and is not used for marketing by third parties.

§ 07

International Transfers

The Website is hosted on servers located in the European Union. As the Company is established in the United States, certain data may be accessed from or transferred to the United States or other third countries. Such transfers take place on the basis of an adequacy decision, including the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) where the recipient is certified, or Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914.

§ 08

Your Rights

Subject to the conditions set out in the GDPR, you have the right to:

• access your personal data (Article 15);
• rectification of inaccurate data (Article 16);
• erasure (Article 17);
• restriction of processing (Article 18);
• data portability, where processing is based on consent or contract (Article 20);
• object to processing based on legitimate interests (Article 21);
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of prior processing.

Requests may be sent to office@omnexis.biz. The Company responds within one month of receipt, which may be extended in accordance with Article 12(3) GDPR.

You also have the right to lodge a complaint with the supervisory authority in the member state of your habitual residence, place of work or place of the alleged infringement.

§ 09

Cookies

Information on the cookies used by the Website is set out in the Cookie Policy.

§ 10

Changes to this Policy

The Company may update this Policy. The current version, with its effective date, is always available on this page.