Legal

Privacy Policy

OD3X

(“OD3X”, “we” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect and use your personal data and which rights and options you have in this respect. Please also refer to our Cookie Policy below which explains the use of cookies and other web tracking devices via this website.

Who is responsible for your personal data?

OD3X is responsible for your personal data.

Which personal data do we collect?

The personal data we collect may include

Contact information, such as your name, address, telephone number and email address;
Payment data, such as data necessary for processing payments and fraud prevention, including credit/debit card numbers, security code numbers and other related billing information;
Further business information necessarily processed in a customer contractual relationship with OD3X or voluntarily provided by you, such as payments made, project details, and business requirements;
Information collected from publicly available resources, integrity databases and credit agencies; and/or
Other personal data regarding your preferences where it is relevant to the products and services that we provide.

How do we collect your personal data?

We may collect personal data about you in a number of circumstances, including:

In some circumstances, we collect personal data about you from a third party source. For example, we may collect personal data from your organisation, other organisations with whom you have dealings, government agencies, a credit reporting agency, an information or service provider or from a publicly available record.

When you or your organisation contact us;
When you or your organisation browse, make an enquiry or otherwise interact on this website;
When you or your organisation engage our fractional CTO services, technology transformation services, or other consulting services;
When you or your organisation offer to provide or provide services to us.

Are you required to provide personal data?

As a general principle, you will provide us with your personal data entirely voluntarily; there are generally no detrimental effects for you if you choose not to consent or to provide personal data. However, there are circumstances in which OD3X cannot take action without certain of your personal data, for example because this personal data is required to process your orders, provide you with access to a newsletter or to carry out a legally required compliance screening. In these cases, it will unfortunately not be possible for us to provide you with what you request without the relevant personal data and we will notify you accordingly.

For which purposes will we use your personal data?

We may use your personal data for the following purposes only (“Permitted Purposes”):

Where you have expressly given us your consent, we may process your personal data also for the following purposes:

With regard to marketing-related communication, we will – where legally required – only provide you with such information after you have opted in and provide you the opportunity to opt out anytime if you do not want to receive further marketing-related communication from us. We will not use your personal data for taking any automated decisions affecting you or creating profiles other than described above.

Depending on for which of the above Permitted Purposes we use your personal data, we may process your personal data on one or more of the following legal grounds:

In addition, the processing may be based on your consent where you have expressly given that to us.

Providing services or things you may have requested;
Managing and administering your or your organisation’s business relationship with OD3X, including processing payments, billing and collection, and support services;
Delivering fractional CTO services, technology transformation consulting, AI implementation, and related professional services;
Compliance with our legal obligations (such as record keeping obligations), compliance screening or recording obligations (e.g. for financial and credit check);
To analyse and improve our services and communications to you;
Protecting the security of and managing access to our IT and communication systems, online platforms, websites and other systems, preventing and detecting security threats, fraud or other criminal or malicious activities;
For insurance purposes;
For monitoring and assessing compliance with our policies and standards;
To comply with our legal and regulatory obligations and requests;
To comply with court orders and exercises and/or defend our legal rights; and
For any purpose related and/or ancillary to any of the above or any other purpose for which your personal data was provided to us.
Communicating with you through the channels you have approved to keep you up to date on the latest developments, announcements, and other information about OD3X products and services;
Customer surveys, marketing campaigns, market analysis or other promotional activities; or
Collecting information about your preferences to create a user profile to personalise and foster the quality of our communication and interaction with you (for example, by way of newsletter tracking or website analytics).
Because processing is necessary for the performance of a contract with you or your organisation;
To comply with our legal obligations (e.g. to keep records for tax purposes); or
Because processing is necessary for purposes of our legitimate interest or those of any third party recipients that receive your personal data, provided that such interests are not overridden by your interests or fundamental rights and freedoms.

Otherwise, we will only disclose your personal data when you direct us or give us permission, when we are required by applicable law or regulations or judicial or official request to do so, or as required to investigate actual or suspected fraudulent or criminal activities.

We may disclose your contact details on a confidential basis to third parties for the purposes of collecting your feedback on our product and service provision, to help us measure our performance and to improve and promote our product and services;
We may share your personal data with companies providing services for credit risk reduction and other fraud and crime prevention purposes and companies providing similar services, including financial institutions, credit reference agencies and regulatory bodies with whom such personal data is shared;
We may share your personal data with any third party to whom we assign or novate any of our rights or obligations;
We may share your personal data with courts, law enforcement authorities, regulators or attorneys or other parties where it is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim, or for the purposes of a confidential alternative dispute resolution process;
We may also instruct service providers within or outside of OD3X, domestically or abroad, e.g. shared service centres, development partners, to process personal data for the Permitted Purposes on our behalf and in accordance with our instructions only. OD3X will retain control over and will remain fully responsible for your personal data and will use appropriate safeguards as required by applicable law to ensure the integrity and security of your personal data when engaging such service providers;
We may also use aggregated personal data and statistics for the purpose of monitoring website usage in order to help us develop our website and our services.

Personal data about other people which you provide to us

If you provide personal data to us about someone else you must ensure that you are entitled to disclose that personal data to us and that, without our taking any further steps, we may collect, use and disclose that personal data as described in this Privacy Policy. In particular, you must ensure the individual concerned is aware of the various matters detailed in this Privacy Policy, as those matters relate to that individual, including our identity, how to contact us, our purposes of collection, our personal data disclosure practices (including disclosure to overseas recipients), the individual’s right to obtain access to the personal data and make complaints about the handling of the personal data, and the consequences if the personal data is not provided (such as our inability to provide products and services).

Keeping personal data about you secure

We will take appropriate technical and organisational measures to keep your personal data confidential and secure in accordance with our internal procedures covering the storage, disclosure of and access to personal data. Personal data may be kept on our personal data technology systems, those of our contractors or in paper files.

Transferring your personal data abroad

We may transfer your personal data abroad if required for the Permitted Purposes as described above. We will ensure that any such international transfers are made subject to appropriate or suitable safeguards as required by the General Data Protection Regulation (EU) 2016/679 or other relevant laws. You may contact us anytime using the contact details below if you would like further information on such safeguards.

We will also require our agents, consultants and sub-contractors and others who are outside the European Economic Area and to whom we transfer your personal data to ensure a similar level of data protection.

When doing so we will comply with applicable data protection requirements and take appropriate safeguards to ensure the security and integrity of your personal data.

Updating personal data about you

If any of the personal data that you have provided to us changes, for example if you change your email address or if you wish to cancel any request you have made of us, or if you become aware we have any inaccurate personal data about you, please let us know by sending an email to

[email protected]

. We will not be responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete personal data that you provide to us.

For how long do we retain your personal data?

Your personal data will be deleted when it is no longer reasonably required for the Permitted Purposes or you withdraw your consent (where applicable) and we are not legally required or otherwise permitted to continue storing such data. We will, in particular, retain your personal data where required for OD3X to assert or defend against legal claims until the end of the relevant retention period or until the claims in question have been settled.

Your rights

Subject to certain legal conditions, you have the right to request a copy of the personal data about you which we hold, to have any inaccurate personal data corrected and to object to or restrict our using your personal data. You may also make a complaint if you have a concern about our handling of your personal data.

If you wish to do any of the above please send an email to

. We may request that you prove your identity by providing us with a copy of a valid means of identification in order for us to comply with our security obligations and to prevent unauthorised disclosure of data. We reserve the right to charge you a reasonable administrative fee for any manifestly unfounded or excessive requests concerning your access to your data, and for any additional copies of the personal data you request from us.

We will consider any requests or complaints which we receive and provide you with a response in a timely manner. If you are not satisfied with our response, you may take your complaint to the relevant privacy regulator. We will provide you with details of your relevant regulator upon request.

Updates to this Privacy Policy

This Privacy Policy was last updated in January 2026. We reserve the right to update and change this Privacy Policy from time to time in order to reflect any changes to the way in which we process your personal data or changing legal requirements. In case of any such changes, we will post the changed Privacy Policy on our website or publish it otherwise. The changes will take effect as soon as they are posted on this website.

Our use of cookies and other information-gathering technologies

A ‘cookie’ is a small text file which is stored on the user’s hard drive or mobile device. Cookies perform a number of functions associated with browsing websites and are used for a variety of different purposes, such as tracing users from page to page on an internet site, thereby enhancing a user’s browsing experience. They are generated by web servers when the user enters an internet page, and are passed to the user’s computer or mobile device and stored for subsequent future access.

We only use cookies in certain areas of this website and the purposes for which they are used are detailed below. You are not obliged to accept a cookie and you can modify your browser so that it will not accept cookies. However, if you do so this may affect your browsing experience and certain functions within this website may not work.

This website uses the following cookies

Session cookies

Session cookies are used to temporarily store information about logged in users. These cookies do not collect information from the user’s computer, and do not identify the user.

Permanent cookies

Permanent cookies are used to enhance a user’s browsing experience by ‘remembering’ that user on subsequent visits.

Acceptance of cookies

We record whether a user has accepted the cookie policy. The cookies expire one year after the last page was requested.

Generic Google Analytics cookies

These cookies are used by Google Analytics, which monitors traffic levels, search queries and visits to this website. Google Analytics stores internet protocol (“IP”) addresses on its servers in the US. An IP address is a unique number assigned to each device (such as your computer) that allows it to communicate with other devices on a computer network (such as modems, printers or other computers). Neither OD3X nor Google associate your IP address with any information that can identify the user personally.

These cookies enable Google to determine whether you are a return visitor to the site, and to track the pages that you visit during your session.

Telephone

+44 2079 234 949

Unit 1113, 11/F, Peninsula Centre

67 Mody Road, Tsim Sha Tsui

Kowloon, Hong Kong

UK Office

Suite 626, 60 Tottenham Court Road

Fitzrovia, London W1T 2EW

United Kingdom

ANALYSIS: Key Changes Made from Okra to OD3X

Changes Beyond Names/Emails/Links

Service Description Updates

Added references to “fractional CTO services, technology transformation consulting, AI implementation” to reflect OD3X’s actual service offerings (Section: “How do we collect your personal data?” and “For which purposes will we use your personal data?”)

Business Model Differences

OD3X is a consultancy/professional services firm, not a traditional datacom provider. The language around “customer contractual relationship” remains appropriate but context is different.

Development Partners

Added “development partners” to the data sharing section since OD3X works with development teams in Asia (mentioned on their website).

Contact Information

Changed email from

[email protected] to

[email protected] . Physical address section left as placeholder [brackets] for you to fill in.

Date Updated

Changed from April 2019 to January 2026.

Company References

All instances of “Okra Datacom” changed to “OD3X” throughout the document.

Sections That May Need Review

Payment Processing

The privacy policy includes language about credit/debit card processing. Confirm if OD3X processes payments directly or uses third-party systems (e.g., Stripe, PayPal). If using third parties, you may want to reference their privacy policies.

Credit Checks & Financial Screening

The policy mentions “compliance screening or recording obligations (e.g. for financial and credit check)”. This may be less relevant for a consultancy business. Consider if this applies to OD3X or should be removed.

Physical Address

Okra had a Hong Kong address. You need to provide OD3X’s registered business address for the contact section.

Legal Entity Name

The contact section needs the full legal entity name (e.g., “OD3X Limited”, “OD3X LLC”, etc.).

The policy references GDPR (EU regulation). Confirm this is appropriate for OD3X’s jurisdiction and customer base. If OD3X operates primarily in other regions, you may need to reference additional regulations (e.g., CCPA for California, UK GDPR, etc.).

Data Retention Periods

Consider specifying more concrete retention periods based on OD3X’s actual business practices and legal requirements.