Privacy Policy

Information we collect

We collect information you provide through our contact and newsletter forms, email and business discussions. Relevant information may also come from your employer, authorised representatives, trade counterparties, public company registers and verification providers. Where we receive information indirectly, we provide the required privacy information within the applicable legal period. The categories depend on your interaction with us:

• Identity and business details: Your name, role, company, business address and registration details. If a proposed trade requires further checks, we explain what identity, ownership or verification information is needed and why before requesting it.
• Contact and communications: Your email address, telephone number, enquiry, correspondence and newsletter preferences, including records of consent or objections. Fields marked as required are needed to process that form; without them we may be unable to respond. Other fields are optional.
• Trade information: Information about the goods, suppliers, buyers, orders, destinations, shipment documents and payment terms you ask us to help coordinate, to the extent it identifies an individual. Please provide only information needed for your enquiry. Do not send passwords, card details or identity documents through the general contact form. Provide another person's information only when you have a lawful basis to do so.
• Website and device information: IP address, browser and device information, pages requested, access times, referral information and technical or security logs generated when your browser connects to our website and its supporting providers. See the cookies section for information about browser storage and third-party resources.

How and why we use it

Where UK data protection law applies, we use the lawful bases set out below. When relying on legitimate interests, we assess necessity and the impact on your rights. Where another jurisdiction requires consent, we obtain it unless a lawful exception applies. This website does not itself make automated lending decisions; any financing provider is responsible for explaining its own assessment and use of your information.

• Respond to enquiries and discuss proposed trades: our legitimate interests in communicating with businesses and handling requests. Contractual necessity applies only where we are taking steps at your request to enter a contract with you personally or performing that contract, rather than merely because you represent a company.
• Make requested introductions and coordinate trade activity: our legitimate interests in connecting relevant businesses, managing documents and progressing their instructions; contractual necessity where applicable. We explain any additional data requirements before a financing referral or verification process.
• Operate, secure and troubleshoot the website: our legitimate interests in maintaining a reliable website, preventing misuse and protecting information. Where cookies or similar technologies require consent, that requirement also applies.
• Keep necessary records, carry out relevant checks, respond to lawful requests and handle disputes: compliance with a legal obligation where one applies to the relevant entity; otherwise our legitimate interests in preventing fraud, assessing counterparties and establishing or defending legal claims, subject to applicable law.
• Send ONOFF updates: consent when you subscribe or where marketing law requires it; otherwise a lawful business-marketing basis where permitted. You can object to direct marketing at any time or withdraw consent by using the unsubscribe option or contacting us. We will stop marketing to you. Withdrawing consent does not affect earlier lawful processing or essential replies about your enquiry.

Sharing & overseas transfers

We disclose information only where relevant to the purposes described here and supported by an appropriate legal basis. Recipients may include the following categories, as well as professional advisers, insurers and public authorities where necessary for legal obligations, disputes or lawful requests. A proposed business reorganisation may require limited disclosure under suitable confidentiality protections.

• Website and business providers: Webflow, Inc. provides our website hosting and native form infrastructure. We also use providers supporting content delivery, technical maintenance and business communications. Providers acting on our behalf must process information under appropriate instructions, confidentiality and data protection arrangements. A provider acting for its own purposes is responsible for its own privacy notice.
• Relevant group entities and trade partners: The ONOFF entity handling your request, relevant suppliers or importers, inspection and logistics providers, and independent financing providers where you pursue a financing introduction. We limit disclosure to what is needed and explain the recipient's role. An independent credit provider or funding vehicle makes its own decisions and may act as a separate controller. Its privacy notice will apply to that processing. We do not send every website enquiry to every group entity or financing provider.
• International transfers: Our UK website uses providers, including Webflow, with operations in the United States. A request involving our UAE or Canadian entities or overseas trade partners may involve processing in those countries or the relevant trading country. Overseas authorities may have lawful access under local law. Where a transfer is restricted by applicable data protection law, we use a permitted mechanism, such as a recognised adequacy arrangement or appropriate contractual safeguards, with any required assessment and additional protections. UK safeguards may include the UK International Data Transfer Agreement or UK Addendum; ADGM transfers require safeguards recognised under ADGM rules. You can contact us for details of the mechanism relevant to your information and a copy of applicable safeguards, with confidential material redacted where necessary.

Security & retention

We take reasonable technical and organisational steps proportionate to the information and risks, including limiting access to people who need it. No website or transmission method is completely secure. We retain enquiry records while handling the enquiry and for a reasonable period needed to evidence follow-up, resolve disputes or meet applicable legal obligations. For trade-related records, we consider the relationship, the transaction, statutory retention duties and relevant claim periods. Marketing records are kept while the subscription or other lawful basis remains valid; a minimal suppression record may be retained to respect an opt-out. Technical records are kept for operational and security needs. Information no longer needed is deleted or anonymised, subject to lawful holds and backup cycles. You can ask how these criteria apply to a particular record.

Cookies & website technology

Our website uses Webflow infrastructure and externally delivered website resources. Those providers receive technical connection information when resources load, even where no cookie is stored. Cookies or similar storage may support essential security, form handling or preferences. We will provide details and request consent before using optional tracking where the law requires it. Merely visiting the website or reading this policy is not consent. You can control stored cookies through your browser; blocking essential technologies may affect functionality. External articles and social links lead to websites with their own privacy and cookie practices.

Your rights & complaints

Your rights depend on the applicable law and may be subject to exceptions. Contact us using the details below; we may need proportionate information to verify your identity. We respond within the applicable legal period and explain any permitted extension or refusal. You can raise a concern with us and, where applicable, complain to a regulator without losing other remedies.

• United Kingdom: under the UK GDPR and Data Protection Act 2018, as amended, you may request access, correction, erasure, restriction and, where applicable, portability. You may object to processing based on legitimate interests, and you have an unconditional right to object to direct marketing. You can withdraw consent where relied upon. Additional protections may apply to significant automated decisions. You may complain to the Information Commissioner's Office at ico.org.uk.
• ADGM, UAE: where the ADGM Data Protection Regulations 2021 apply, rights include access, correction, erasure, restriction, portability and objection, subject to their conditions, together with withdrawal of consent and protections concerning qualifying automated decisions. Complaints may be made to the ADGM Office of Data Protection through adgm.com/operating-in-adgm/office-of-data-protection. UAE incorporation does not make these rules apply to every group activity.
• Canada: where British Columbia's Personal Information Protection Act or the federal Personal Information Protection and Electronic Documents Act applies, you may request access, correction and information about our handling of your personal information, withdraw consent subject to applicable restrictions, and challenge compliance. We explain any consequences of withdrawal. Complaints may be made to the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca or the Office of the Privacy Commissioner of Canada at priv.gc.ca, according to jurisdiction.

Changes to this policy

We may update this policy to reflect changes in the website, our activities or applicable law. The date above identifies the latest version. Where a material change affects how we use your information, we will provide an appropriate additional notice and seek fresh consent where required. This website is intended for business users, not children. Please contact us if you believe a child has provided personal information so that we can investigate and take appropriate action.