Onecom Group Privacy Notice

June 2026

Contents
  1. 1Introduction
  2. 2In short
  3. 3Who we are
  4. 4Your rights
  5. 5How the law protects you
  6. 6Types of personal data we collect
  7. 7Where we collect personal data from
  8. 8How we use your data
  9. 9Who and why we may share your personal data
  10. 10International transfers of personal information
  11. 11Keeping you informed about our products and services
  12. 12Automated decision making and AI
  13. 13How long we hold your personal data for
  14. 14Security
  15. 15If things go wrong and you wish to make a complaint
  16. 16Cookies
  17. 17Important Contact Details
  18. 18Our mobile app

1Introduction

  1. 1.1
    Our Privacy Notice explains how Onecom uses your personal data, what we do to ensure the safety and security of it, and who we share it with. It also informs you of your rights and how the law protects you.

2In short

  1. 2.1
    Here are the things we think you’d really want to know about how we manage your personal data.
    1. 2.1.1
      Your personal information is, where appropriate, shared within the Onecom Group.
    2. 2.1.2
      We do use a number of third parties to process your personal information on our behalf and some of them are based outside of the UK and European Economic Area.
    3. 2.1.3
      You have a number of rights over your personal information. How you can exercise these rights is set out in this notice.
    4. 2.1.4
      We do send direct marketing, if we’re allowed to. If you want us to stop, please contact us using the contact form or use the opt-out link in the email.

3Who we are

  1. 3.1
    When we use the expressions “Onecom”, “we”, “us” and “our” we are referring to the companies that make up the Onecom Technology Group. This includes: Onecom Limited, Onecom Partners Limited, Onecom Technology (India) Private Limited, Onecom Technology Group Limited, Solo Bidco Limited, Solo Topco Limited, Gradwell Communications Limited, and Matrix Business IT Limited.
  2. 3.2
    For more information about Onecom: https://www.onecom.co.uk/about.

4Your rights

  1. 4.1
    You have a number of rights under data protection legislation which, in certain circumstances, you may be able to exercise in relation to the personal information we process about you.
  2. 4.2
    These include:
    1. 4.2.1
      The right to access a copy of the personal information we hold about you.
    2. 4.2.2
      The right to correction of inaccurate personal information we hold about you.
    3. 4.2.3
      The right to restrict our use of your personal information.
    4. 4.2.4
      The right to be forgotten.
    5. 4.2.5
      The right of data portability.
    6. 4.2.6
      The right to object to our use of your personal information.
  3. 4.3
    If you are seeking to exercise any of these rights, please contact us using the contact form.

5How the law protects you

  1. 5.1
    Data protection law states that we are allowed to use personal data only if we have a proper reason to do so. The law says we must have one or more of the following reasons:
    1. 5.1.1
      To fulfil a contract we have with you.
    2. 5.1.2
      You have given us your consent.
    3. 5.1.3
      We have a legitimate interest and it is necessary for us to conduct our business, but not where our interests are overridden by your interests or rights.
    4. 5.1.4
      Where we have a legal obligation to do so.
    5. 5.1.5
      When it is necessary to protect your or some else’s life, this is called Vital Interest.

6Types of personal data we collect

  1. 6.1
    Contact Data includes billing address, delivery address, email address and telephone numbers.
  2. 6.2
    Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
  3. 6.3
    Technical Data includes internet protocol (IP) addresses.
  4. 6.4
    Usage Data includes information about how you interact with and use our website, products and services.
  5. 6.5
    Marketing, Market Research and Communications Data includes your preferences in receiving marketing from us.

7Where we collect personal data from

  1. 7.1
    We may collect personal data about you from these sources:
    1. 7.1.1
      Personal data you give us directly.
    2. 7.1.2
      When you use our websites or interact with us through social media.
    3. 7.1.3
      Credit reference agencies.
    4. 7.1.4
      Reputable data suppliers.
    5. 7.1.5
      Personal data from companies/businesses which have been acquired by Onecom.
    6. 7.1.6
      From publicly available sources such as information held in Companies House, and information about you that is openly available on the internet.

8How we use your data

  1. 8.1
    To provide our products and services.
  2. 8.2
    For safety and security.
  3. 8.3
    Analytics and profiling.
  4. 8.4
    Marketing and advertising.

9Who and why we may share your personal data

  1. 9.1
    If we are required to by law, under any code of practice by which we are bound or where we are asked to do so by a public or regulatory authority.
  2. 9.2
    Companies within the Onecom Group so that we can provide you with a high-quality service.
  3. 9.3
    Our service providers so that they can help us provide the products and services you require from us, or we think you might be interested in. These third parties include:
    1. 9.3.1
      Advertising companies, who help us place adverts online and on other media.
    2. 9.3.2
      Social media providers, such as Facebook, Instagram and Twitter.
    3. 9.3.3
      Market research partners, who help us analyse customer behaviour.
    4. 9.3.4
      Companies that deploy our email campaigns because they need to know your email address to carry out these services.
    5. 9.3.5
      Credit reference agencies.
    6. 9.3.6
      Third party vendors who help us manage and maintain our IT infrastructure.
    7. 9.3.7
      Security and fraud prevention companies to ensure the safety and security of our customers, colleagues and business.
    8. 9.3.8
      Companies that enable us to collect your reviews and comments, both online and offline.
    9. 9.3.9
      Professional advisors including lawyers, bankers, accountants, auditors, and insurers who provide consultancy, banking, legal, and accounting services.

10International transfers of personal information

  1. 10.1
    From time to time, we transfer your personal information to Onecom Group companies, suppliers or service providers based outside of the UK and EEA for the purposes described in this privacy policy. When we do this, your personal information will continue to be subject to one or more appropriate safeguards set out in the law, including the use of model contracts in a form approved by regulators.

11Keeping you informed about our products and services

  1. 11.1
    We would like to tell you about our products and services that we think you might be interested in. We will only ever do this with your consent or where there is a legitimate interest.
  2. 11.2
    We won't send you marketing messages, if you tell us not to, but if you receive a service from us, we will still need to send you occasional service-related messages and may still send surveys (you can always opt out of these via the survey email itself).
  3. 11.3
    Please note that it can take a little while for all marketing to stop once you either withdraw your consent or tell us you’d like to opt out of marketing.
  4. 11.4
    You may opt out of these calls or emails at any time, either verbally whilst on the phone or by using the contact form.

12Automated decision making and AI

  1. 12.1
    We sometimes use automated decision-making. For instance, we use automated decision-making for credit assessments when you apply for a contract with us. The outcome can determine your eligibility for a contract or the payment terms we can offer you. You have the right to request human intervention or contest a decision by contacting us via the ‘Your rights’ section above.
  2. 12.2
    We use AI within some of our internal operational processes. Where we do so, your personal data may be processed by AI tools as part of those operations. We assess the use of AI involving personal data to ensure that your rights are protected and that we comply with ICO guidance and applicable data protection law.

13How long we hold your personal data for

  1. 13.1
    We will only keep your personal data for as long as necessary for our business or legal requirements. To determine the appropriate retention period, we always consider the amount and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure and the applicable legal and/or regulatory requirements.
  2. 13.2
    We also have processes in place to securely dispose of personal data we no longer require.

14Security

  1. 14.1
    We take protecting your personal information seriously and are continuously developing our security systems and processes. Some of the controls we have in place are:
    1. 14.1.1
      We use technology controls for our information systems, such as firewalls, user verification, strong data encryption and multiple verification access protocols.
    2. 14.1.2
      Systems are proactively monitored through a “detect and respond” information security function.
    3. 14.1.3
      We utilise industry “good practice” standards to support the maintenance of a robust information security management system.
    4. 14.1.4
      We enforce a “need to know” policy, for access to any data or systems.

15If things go wrong and you wish to make a complaint

  1. 15.1
    You have the right to make a complaint at any time to the Information Commissioner’s Office (www.ico.org.uk), the UK regulator for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact our Data Protection Officer in the first instance using the below details.

16Cookies

  1. 16.1
    Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. For detailed information on the cookies we use and the purposes for which we use them, please see our Cookies Policy.

17Important Contact Details

  1. 17.1

    Data Protection Officer

    Address
    Onecom House, 4400 Parkway, Solent Business Park, Fareham, Hampshire, PO15 7FJ
    Email
    dpo@onecom.co.uk
  2. 17.2

    Supervisory Authority

    Name
    Information Commissioners Office
    Website
    https://ico.org.uk/
    Email
    casework@ico.org.uk or the contact form at: https://ico.org.uk/global/contact-us
    Telephone
    0303 123 1113

18Our mobile app

  1. 18.1
    This section explains how the OneCloud app for iOS and Android (“the app”) uses your personal data. It applies in addition to the rest of this notice. The app is for existing Onecom customers. You cannot create an account in the app; you sign in with your existing Onecom portal details.
  2. 18.2
    Information the app uses:
    1. 18.2.1
      Sign-in details. Your email address or username, your password and, if you use two-step sign-in, your verification code. These are sent securely to Onecom to sign you in. Your password is not stored on your device. A secure session token, and the email address or username you last signed in with, are kept in your device’s protected storage so that you stay signed in.
    2. 18.2.2
      Your account information. Details of your organisation’s services, orders, support requests, invoices and billing, as held in your Onecom account. What you can see depends on the access your organisation has given you. The app keeps a copy of the most recent information on your device so that you can read it offline. This copy is deleted when you sign out.
    3. 18.2.3
      Support requests and photos. When you raise or reply to a support request, the details you enter and any photos you choose to attach are sent to Onecom and added to that request. The app only accesses the photos you select.
    4. 18.2.4
      Camera (Onecom Beam). If you join a Beam remote support session, the app asks for permission to use your camera and shares your live camera view with a Onecom agent. The agent sees your camera view only and cannot control your phone. The session is not recorded, the camera is used only during the session you join, and you can stop at any time.
    5. 18.2.5
      Face ID, fingerprint or passcode. If you turn on app lock, your device checks that it is you. This check happens on your device. Your biometric data is never sent to Onecom.
    6. 18.2.6
      Notifications. If you allow notifications, we store a notification token for your device, together with its platform (iOS or Android) and time zone, so that we can send you updates about your support requests, orders, services and billing. This is removed when you sign out, and you can turn notifications off at any time in your device settings.
    7. 18.2.7
      Security checks. To protect your account, the app uses Apple App Attest and Google Play Integrity to confirm that it is the genuine OneCloud app running on a genuine device. This uses a random identifier created by the app when it is installed.
    8. 18.2.8
      Crash reports and usage statistics. We use Google Firebase Crashlytics and Google Analytics for Firebase to find out whether the app is working properly and which features are used. Crash reports contain technical information such as the device model, operating system, app version and details of the error. Usage statistics record events such as signing in, joining a Beam session or opening a notification. We do not attach your name, email address, account or organisation to this information, and it never includes anything you type. Google processes technical information such as an app instance identifier and an approximate location (country) derived from your IP address to provide these services.
  3. 18.3
    The app does not show adverts, does not use your device’s advertising identifier, and does not track you across other companies’ apps or websites. Information collected by the app is not used for advertising.
  4. 18.4
    In addition to the companies in section 9, the app uses the following service providers:
    1. 18.4.1
      Google, for crash reports, usage statistics, notifications on Android and iOS (Firebase Cloud Messaging) and security checks on Android (Play Integrity).
    2. 18.4.2
      Apple, for notifications on iOS (Apple Push Notification service) and security checks on iOS (App Attest).

    Some of this processing may take place outside the UK, as described in section 10.

  5. 18.5
    We use your information in the app to provide our services to you under our contract with your organisation. We use security checks, crash reports and usage statistics because we have a legitimate interest in keeping the app secure and working well. We only access your camera, photos and notifications with your permission, which you can withdraw at any time in your device settings.
  6. 18.6
    Information stored on your device is deleted when you sign out or remove the app. Crash reports are kept for 90 days. Usage statistics are kept for 2 months. Information you send to us through the app, such as support requests and photos, is kept in line with section 13.
  7. 18.7
    You can exercise your rights over information collected through the app in the same way as set out in section 4. Your OneCloud account is managed by your organisation; to close it, please speak to your organisation’s administrator or your Onecom account manager.