A Clear Purpose
Account administration, enquiries, support and security are explained separately from records held for customers.
YOUR INFORMATION
Privacy & Cookie Policy.
What we collect, why we use it and the choices you have.
Effective 29 October 2026
Your Choices
Ask about your information, exercise your rights or object to marketing through hello@omono.co.
Clear Data Roles
Your organisation controls the business records it stores in Omono. We process those records to provide the service.
1. Who We Are
Omono Technologies Limited provides the Omono cloud ERP service for businesses. We are registered in England and Wales under company number 08447591. Our registered office is Odyssey House, Durban Road, Bognor Regis, West Sussex, PO22 9RH, United Kingdom. We are registered with the Information Commissioner’s Office as a data controller, reference ZB296834.
For privacy questions or requests, email hello@omono.co or write to us at that address, marked “Privacy”.
This policy covers visitors to our websites, people who enquire about Omono, customer account contacts and users of the service. It explains our approach under the UK GDPR and the Data Protection Act 2018, as amended.
We are the controller when we decide why and how to use personal information for our own business administration, enquiries, billing and service security. For personal information customers put into their Omono business records, we generally act as a processor on their behalf. Section 4 explains the distinction.
2. Information We Handle
- Enquiries: your name, company, work email, business type, expected number of users, whether you use Xero, and the requirements or message you provide. We also receive information you choose to share by email or chat.
- Accounts and subscriptions: user names, email addresses, organisation details, login credentials, account settings, subscription and billing contacts, invoices, payment status and correspondence. Passwords are stored as one-way hashes. A trial does not require a payment card.
- Support: conversations, attachments and the account or technical details needed to understand an issue. Please only share information relevant to the request.
- Technical information: IP addresses, browser and device information, requests, timestamps, errors and service activity used to deliver, protect and diagnose the service. Cookies and similar technologies are explained in section 8.
- Customer business records: information customers choose to enter or upload, such as names and contact details in customer and supplier records, quotations, orders, documents, notes and tasks.
We receive information directly from you, from your organisation’s administrator or colleagues, and through your use of the service. If your organisation connects Xero, the integration also exchanges the records needed for that connection.
Fields marked as required are needed to handle the relevant enquiry or provide the account. Without necessary contact or account information, we may be unable to reply, create access or provide the requested service. Optional enquiry text can be left blank. Please do not include sensitive personal information that we do not need.
3. Why We Use Information
| Purpose | Information and Lawful Basis |
|---|---|
| Answer enquiries and arrange demos, onboarding or training | Contact details and requirements. Our legitimate interest is to respond to people asking about Omono and help businesses assess the service. Where you personally request steps towards a contract with us, we rely on those pre-contractual steps. |
| Provide and administer accounts and support | User, organisation and support details. Our legitimate interests are to operate the service, manage business relationships and resolve issues. Where you personally are a party to our contract, we rely on performance of that contract. |
| Manage subscriptions, invoices and accounts | Billing contacts, subscription records and payment information. Our legitimate interest is to administer business subscriptions and collect amounts due; legal obligations apply to tax and accounting records. |
| Protect and maintain Omono | Technical, authentication and diagnostic information. Our legitimate interests are to prevent misuse, investigate faults, maintain security and keep the service working. |
| Handle rights requests, complaints and legal matters | Relevant contact details, correspondence and records. We rely on legal obligations where applicable and our legitimate interest in establishing, exercising or defending legal claims. |
| Optional marketing communications | Contact details and communication preferences. Consent where required; otherwise legitimate interests only where the applicable marketing rules permit it. An enquiry is not permission for unrelated marketing. You can object at any time. |
“Legitimate interests” means a specific business reason for using information, balanced against your rights and reasonable expectations.
Reading this policy or using the website does not provide blanket consent. Where we rely on consent, it must be given separately and can be withdrawn.
4. Records Held for Our Customers
A customer organisation decides what business information to put into Omono, why it is needed and who should have access. That organisation is normally the controller of personal information in those records. Omono processes the information to provide the service on the organisation’s instructions.
If your details appear in an Omono customer’s records—for example, as its customer, supplier or employee—contact that organisation about access, correction or deletion. If you contact us, we will help identify the appropriate organisation where possible and support it in handling the request.
This policy does not replace a customer’s own privacy notice or the contractual data-processing terms between Omono and the customer. Those data-processing terms are in Condition 17 of our Terms of Use.
When a customer leaves, a full export of its data is free on request. Arrange it with the team before closing the account. See the data export provisions in our Terms of Use. This organisation-level export is separate from an individual’s data-protection rights.
6. International Processing
Core Omono application data, documents and backups are held in Ireland. That does not mean all processing is limited to the UK or EU: Cloudflare has a global network, Mandrill processes app emails in the USA, and other supporting providers may process information in additional countries.
When personal information goes outside the UK, we make sure a transfer mechanism that UK law accepts applies. For the European Economic Area, and for US organisations certified to the UK Extension to the EU-US Data Privacy Framework, UK adequacy regulations apply. Otherwise we rely on contractual safeguards in the provider’s data-processing terms, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for more information about the safeguards for a particular provider.
7. Retention, Export and Deletion
Retention depends on the purpose of the information, the account relationship, legal requirements and any unresolved issue. We do not treat a closed account as a reason to retain everything indefinitely.
| Information | Retention Approach |
|---|---|
| Enquiries and support correspondence | Keep what is needed to answer the request, provide follow-up and resolve related issues. If an enquiry does not lead to a customer relationship, we delete it within 24 months of our last contact. Any legal requirement or dispute can extend this. The website keeps its own copy of a form submission for 30 days so that delivery can be retried. |
| Account and customer business records | Keep records needed to provide the account and arrange any requested return or deletion. Trial expiry and subscription cancellation do not delete data at once; the deletion periods are below. Contact the team to arrange export and closure. |
| Invoices and accounting records | Keep records for the applicable tax and accounting requirements, and where necessary for outstanding payments or legal claims. Closing an account does not remove those obligations. |
| Technical records and backup copies | The current system configuration retains database backup copies for up to four weeks, old document versions for up to 90 days and server logs for up to 180 days. These are separate from the date that active account data is deleted. |
| Marketing preferences | Keep the minimum preference information needed to honour an opt-out, rather than adding the contact back to a marketing list. |
Deletion of an account is currently arranged by the Omono team. Backup and versioned copies can remain until their separate retention periods expire. When an account is closed, we delete its account data and business records within 90 days, after providing any export you asked for. If a free trial ends without a subscription, we delete the account within 12 months of the trial ending, or sooner if you ask. Invoices and accounting records are kept for as long as tax and accounting law requires.
9. Protecting Information
Omono encrypts data travelling over public networks and data stored in its core systems. Passwords are held as one-way hashes, stored files are private, and organisation checks control access to customer records. Two-factor authentication is available for users and can be required by an organisation’s administrator.
Read our Security & Data page for the current technical summary. These measures do not amount to a guarantee that a service can never experience a security incident.
Automated anti-abuse checks help protect registration and access. If a check prevents you from using the service, contact the team. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing, and we do not use your information for profiling.
10. Your Choices and Rights
Depending on the circumstances and the legal basis, you may have rights to access your personal information, correct inaccuracies, request erasure, restrict processing or receive certain information in a portable format. These rights are subject to the conditions and exceptions in data-protection law.
If we rely on your consent, you can withdraw it at any time by contacting us or using the relevant preference control. Withdrawal does not affect processing that was lawful before it was withdrawn.
Send a request to hello@omono.co, or contact us by another available route. You do not need special wording. We may ask for proportionate information to verify identity or clarify the request.
Subject access requests are normally free and answered without undue delay, usually within one month. The law permits extensions in certain cases, such as complex or multiple requests, and limited exceptions to free handling. We will explain any applicable extension, lawful fee or refusal.
For records held on behalf of an Omono customer, contact that organisation as explained in section 4.
11. Questions and Complaints
If you are concerned about how information has been handled, contact hello@omono.co and explain the issue. We will investigate and respond. Please avoid sending unnecessary sensitive information with the initial message.
You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator. Visit the ICO’s complaints page for its current process. If another data-protection authority has jurisdiction, you may also be able to complain to that authority.
12. Changes to This Policy
We will update this page when our services, processing arrangements or legal requirements change, and show the revision date. Where a change materially affects how personal information is used, we will provide appropriate notice. If new consent is required, we will request it rather than treating continued use as consent.
This version takes effect on 29 October 2026.
Questions About Your Information
Email hello@omono.co, or write to us at our registered office marked “Privacy”. Omono Technologies Limited is registered with the Information Commissioner’s Office, reference ZB296834.