Privacy Policy

1. Who is responsible for your data

The data controller for OX9.APP is SCOTT&YOUNG LTD, trading as OX9.APP.

For any question about this policy or your personal data, contact beetge31@gmail.com.

2. Scope

This policy explains what personal data we collect through the OX9.APP website and progressive web app (the "Service"), why we collect it, the legal bases we rely on, who we share it with, how long we keep it, and your rights. It applies to consumers, business members, and event organisers.

Read this policy together with our Cookie Policy (how we use cookies and similar technologies) and our Data Policy (how we govern and secure data operationally).

3. The personal data we collect

a. Account and identity data. Your email address (used for magic-link sign-in), and any name or profile details you provide.

b. Business and organiser data. For business members and event organisers: business/organiser name, contact details, address and location, category, listing content, offers, event details, and images you upload.

c. Payment data. When you pay, our payment processor Stripe collects and processes your card/payment details. We do not store your full card number. If you take out an optional OX9 Gold consumer membership, Stripe also processes your recurring subscription (renewals and cancellations) on our behalf. We receive limited payment metadata (for example a customer/subscription reference, amount, status and the fact of payment) to manage memberships, event listings and invoices.

d. Invoice and transaction data. Records of payments, invoices/receipts issued, and membership/listing status.

e. Usage and analytics data. We operate our own in-house analytics. We record events such as listing views using a hashed (pseudonymised) reference rather than your name, together with technical information such as approximate interactions with the Service. We do not currently use third-party advertising trackers.

f. Location data. We use approximate location relevant to the Service (for example the town/postcode area OX9 and business locations). Maps are displayed using OpenStreetMap tiles; loading map tiles involves your device requesting them from the map provider.

g. Communications. In-app notifications, and any messages you send us (for example support enquiries). When our email/messaging provider (Brevo) is connected, email and push communications will be handled through it.

h. Cookies and local storage. See our Cookie Policy. This includes essential sign-in/session data needed to keep you logged in and to run the progressive web app.

4. How and why we use your data, and our legal bases

Where we rely on legitimate interests, our interest is in operating, securing, improving and promoting a community marketplace; we balance this against your rights and you can object (see section 9). Where we rely on consent (for example non-essential cookies or marketing), you can withdraw it at any time without affecting prior processing.

5. Who we share your data with

We do not sell your personal data. We share it with:

• Public visibility of listings. Business and event listings (including business/organiser name, location, category, offers, event details and images you provide) are displayed publicly within the Service — that is the purpose of a listing.

• Service providers (processors) acting on our instructions:

  Provider	Role	Where
  Supabase	Database, authentication and file storage	EU (London / eu-west-2)
  Stripe	Payment processing	UK/EU/US (as payment processor)
  Hetzner	Server hosting (jis-v4)	EU (Helsinki)
  Brevo	Email/push messaging (once connected)	EU
  OpenStreetMap	Map tiles	EU
  GitHub	Source-code hosting (operational; not a store of user personal data by design)	US

• Professional advisers, and authorities, where required by law, to establish or defend legal claims, or to prevent harm or fraud.

• A successor, if the business is reorganised, sold or merged, subject to this policy.

6. International transfers

We aim to keep personal data within the UK/EEA. Where a provider processes data outside the UK/EEA (for example certain Stripe or GitHub operations in the US), we rely on appropriate safeguards such as UK adequacy regulations, the UK Addendum to the EU Standard Contractual Clauses, or an equivalent approved transfer mechanism. You can ask us for more detail at beetge31@gmail.com.

7. How long we keep your data

We keep personal data only as long as needed for the purposes above:

• Account data — while your account is active, then deleted or anonymised within a reasonable period after closure, unless we must keep it longer.
• Invoices and financial records — retained for at least 6 years to meet UK tax/accounting obligations.
• Analytics — kept in pseudonymised form; aggregated/anonymised data may be kept indefinitely.
• Support communications — kept for as long as needed to handle the matter and any follow-up.

See the retention schedule in our Data Policy for more detail.

8. How we protect your data

We use technical and organisational measures including encrypted connections (HTTPS), row-level security in the database, access restricted to authorised operators, pseudonymisation of analytics identifiers, and regular backups. No system is perfectly secure, but we take reasonable steps to protect your data and have a process for handling data breaches (see the Data Policy).

9. Your rights

Under UK data-protection law you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten") in certain circumstances;
• Restrict or object to certain processing, including processing based on legitimate interests and any direct marketing;
• Data portability for data you provided, where processing is by consent or contract and automated;
• Withdraw consent at any time where we rely on consent; and
• Complain to the Information Commissioner's Office (ICO).

To exercise any right, contact beetge31@gmail.com. We will respond within one month (extendable for complex requests, in which case we will tell you). We may need to verify your identity. Exercising your rights is free unless a request is manifestly unfounded or excessive.

You can complain to the ICO at ico.org.uk, by phone on 0303 123 1113, or by post to: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would appreciate the chance to resolve your concern first.

10. Children

The Service is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact beetge31@gmail.com and we will delete it.

11. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

12. Changes to this policy

We may update this policy. We will post the new version with an updated effective date and, for material changes, take reasonable steps to notify you.

13. Contact

Data-protection point of contact: beetge31@gmail.com.

SCOTT&YOUNG LTD trading as OX9.APP · Company Registration No. 16697821 · Registered in England and Wales · Registered office: 29 Grenville Way, Thame, OX9 3YN.