Version 1.0 — Effective Date: [DD Month 2026] Registered in England & Wales | Company No. [XXXXXXXX] | www.onvaa.com
SUMMARY: Onvaa Ltd is the data controller for personal data you give us when you use the Onvaa platform. We collect what we need to run the platform — your contact details, the content of your Service Requests, your messages with Suppliers, and basic usage data. We use it to operate the platform, match you with Suppliers, prevent fraud, and improve our service. We do not sell your personal data. You have rights under UK GDPR — see clause 8.
This Privacy Policy explains how Onvaa Ltd (“Onvaa”, “we”, “us”) collects and uses your personal data when you use the Onvaa website at www.onvaa.com and our mobile applications (together, the “Platform”). It applies to Customers, Suppliers, prospective users, and visitors to our Platform.
This policy is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The data controller responsible for your personal data is:
| Company | Onvaa Ltd |
| Company No. | [XXXXXXXX] |
| Registered office | [Address], England |
| Privacy contact | privacy@onvaa.com |
| General support | support@onvaa.com |
If you have any question about how we use your personal data or want to exercise any of your rights under this policy, email privacy@onvaa.com.
We collect the following categories of personal data:
We use your personal data for the purposes set out below. The lawful basis under UK GDPR Article 6 is shown alongside.
| Purpose | Lawful basis |
|---|---|
| Create and manage your account, authenticate you, and deliver core Platform features (Service Requests, Quotes, chat, wallet). | Performance of a contract (Art.6(1)(b)) |
| Match Service Requests to relevant Suppliers using AI categorisation and location-based filtering. | Performance of a contract; legitimate interests in operating an effective marketplace (Art.6(1)(b), (f)) |
| Process Vendor top-ups and apply referral bonuses to wallets. | Performance of a contract (Art.6(1)(b)) |
| Send transactional emails, SMS, and push notifications (e.g. new quote received, message received). | Performance of a contract (Art.6(1)(b)) |
| Send marketing about new features and offers (only with your consent or where permitted under the soft opt-in for similar services). | Consent (Art.6(1)(a)); legitimate interests with opt-out (Art.6(1)(f)) |
| Provide customer support and respond to your enquiries. | Performance of a contract; legitimate interests (Art.6(1)(b), (f)) |
| Prevent fraud, abuse, spam, and protect the safety and integrity of the Platform and other users. | Legitimate interests; legal obligations (Art.6(1)(c), (f)) |
| Comply with legal obligations including tax, accounting, and lawful requests from regulators or law enforcement. | Legal obligation (Art.6(1)(c)) |
| Improve the Platform: bug-fixing, performance monitoring, product analytics, training of automated and AI systems on anonymised data. | Legitimate interests in improving our service (Art.6(1)(f)) |
| Establish, exercise, or defend legal claims. | Legitimate interests (Art.6(1)(f)) |
We do not use your personal data for automated decisions that produce legal or similarly significant effects on you within the meaning of Article 22 UK GDPR.
We share your personal data only with the categories of recipient listed below, and only to the extent necessary.
When you post a Service Request, the content of that request (description, category, approximate area, attachments) is shared with relevant registered Suppliers so they can respond. Your name and avatar are visible to Suppliers who are in conversation with you. Your phone number and email are not automatically shared with Suppliers; you decide whether to share them in chat.
When a Vendor responds, their business name, service area, service categories, and Quote content are shared with the Customer who posted the Request.
We use third-party service providers to operate the Platform. They process personal data on our behalf under written contracts that comply with UK GDPR Article 28. The categories include:
For the current list of named processors, email privacy@onvaa.com.
We may share your personal data with our auditors, lawyers, and other professional advisers where necessary, and with potential buyers in the event of a sale or restructuring of Onvaa, under appropriate confidentiality terms.
We may disclose personal data to law enforcement, regulators, courts, or other public authorities where required by law or where we believe disclosure is necessary to protect our rights, your safety, or that of others.
We do not sell, rent, or trade your personal data to third-party advertisers or data brokers.
Some of our processors (notably US-based providers) process personal data outside the UK. When this happens we rely on one of the following safeguards under UK GDPR Chapter V:
Where you would like more information about the safeguards used for a specific transfer, contact privacy@onvaa.com.
| Category | Retention |
|---|---|
| Account data (while account is active) | For as long as the account is open |
| Account data (after deletion) | Deleted within 30 days of account closure, except where retention is required by law or to defend legal claims |
| Service Requests, Quotes, and chat messages | For the lifetime of the related account, or 6 years from the last activity on the request (whichever is shorter), to support dispute resolution |
| Transaction records and invoices | 6 years from the end of the tax year (HMRC requirement) |
| Marketing preferences and consent records | For as long as the account exists, plus 3 years |
| Support correspondence | 3 years |
| Server logs (IP, user agent, error logs) | Up to 90 days |
| Anonymised / aggregated data | Indefinitely — not personal data after anonymisation |
If you would like to request earlier deletion, email privacy@onvaa.com (subject to clause 8.1(c) below).
We use appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), password hashing, role-based access controls, secure cloud hosting, and regular software patching. No system is fully secure: please use a strong, unique password and report any suspected unauthorised access to support@onvaa.com immediately.
You have the following rights in relation to your personal data:
| Right | What it means |
|---|---|
| (a) Access (Art.15) | Ask for a copy of the personal data we hold about you. |
| (b) Rectification (Art.16) | Ask us to correct inaccurate or incomplete data. |
| (c) Erasure (Art.17) | Ask us to delete your personal data (subject to legal retention requirements). |
| (d) Restriction (Art.18) | Ask us to stop or limit processing in defined circumstances. |
| (e) Portability (Art.20) | Receive your data in a structured, commonly used, machine-readable format. |
| (f) Object (Art.21) | Object to processing based on legitimate interests or direct marketing. |
| (g) Withdraw consent (Art.7(3)) | Withdraw consent at any time where consent is the lawful basis, without affecting the lawfulness of prior processing. |
| (h) Complain to the ICO | Lodge a complaint with the Information Commissioner’s Office at www.ico.org.uk or on 0303 123 1113. |
To exercise any of these rights, email privacy@onvaa.com. We will respond within one month (extendable by a further two months for complex requests). We may need to verify your identity before acting on a request.
We will only send you marketing about our own products and services where we have a lawful basis — either your consent (e.g. via a sign-up checkbox) or the soft opt-in for existing customers receiving information about similar services. Every marketing email contains an unsubscribe link, and you can also opt out at any time by emailing privacy@onvaa.com. Opting out of marketing does not affect transactional communications that we need to send to operate the Platform (e.g. quote notifications, password resets).
The Onvaa marketing website may use a small number of strictly necessary cookies to remember your preferences (e.g. cookie consent state). Detailed information is available in our Cookie Policy (where published). The Onvaa mobile app does not use browser cookies.
The Platform is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you become aware that a child has provided personal data to us, please email privacy@onvaa.com and we will delete it.
The Platform uses AI and automated systems for tasks including:
These systems assist our operations but do not make legally significant or similarly significant decisions about you without human involvement within the meaning of Article 22 UK GDPR. We may use anonymised content to evaluate and improve our AI systems; we do not train third-party AI models on your identifiable personal data without your consent.
We may update this Privacy Policy from time to time. The version number and effective date at the top of this page will change when we do. For material changes we will notify you by email or in-app banner before the change takes effect.
| Purpose | Contact |
|---|---|
| Privacy enquiries, data-subject requests | privacy@onvaa.com |
| General support & account issues | support@onvaa.com |
| Formal complaints & legal notices | legal@onvaa.com |
| Reporting unlawful content | report@onvaa.com |
| Independent regulator (UK) | Information Commissioner’s Office — www.ico.org.uk — 0303 123 1113 |
You can lodge a complaint with the ICO at any time, but we would appreciate the chance to address your concerns first — please contact privacy@onvaa.com.
Onvaa Ltd — Privacy Policy — Version 1.0 — Company No. [XXXXXXXX] — www.onvaa.com — privacy@onvaa.com