ORDINEX AUTOMATION

1. Introduction

Datum Flair Ltd ("we", "us", or "our") is a company registered in the United Kingdom, trading as Ordinex Automation. We operate the website ordinexautomation.com and provide B2B automation services (the "Services").

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website or use our Services. It applies to all users globally and is designed to comply with:

• UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018
• EU General Data Protection Regulation (EU GDPR) for users in the European Economic Area
• California Consumer Privacy Act (CCPA) / CPRA for California residents
• Other applicable data protection laws

2. Information We Collect

We collect the following categories of personal information:

2.1 Information You Provide Directly

• Name and job title
• Business email address
• Company name and website
• Phone number (if provided)
• Payment and billing details (processed via Stripe)
• Messages and enquiries submitted via contact or onboarding forms

2.2 Information Collected Automatically

• IP address and approximate location
• Browser type, device type, and operating system
• Pages visited, time on site, and referral source (via Google Analytics)
• Cookie identifiers and session data

2.3 Information from Third Parties

• CRM data processed via HubSpot (e.g. contact interactions, lead status)
• Email engagement data via Mailchimp (e.g. opens, clicks)

3. How We Use Your Information

We use your personal information for the following purposes:

• To provide, operate, and improve our Services
• To process payments and manage billing (via Stripe)
• To send transactional and service-related communications
• To send marketing and promotional emails (with your consent, via Mailchimp)
• To manage our customer relationships (via HubSpot)
• To analyse website usage and improve user experience (via Google Analytics)
• To comply with legal obligations and enforce our terms
• To respond to enquiries and provide customer support

4. Legal Basis for Processing

4.1 UK & EU (UK GDPR / EU GDPR)

For users in the UK and EEA, we process your personal data under the following legal bases:

• Contract: Processing necessary to deliver our Services to you
• Legitimate Interests: Analytics, fraud prevention, and service improvement
• Consent: Marketing communications and non-essential cookies
• Legal Obligation: Compliance with applicable laws and regulations

4.2 California, USA (CCPA / CPRA)

For California residents, we collect and process personal information as described in this Policy. We do not sell personal information. You have the right to know, delete, correct, and opt out of sharing. See Section 9.2 for how to exercise these rights.

4.3 Canada (PIPEDA / Quebec Law 25)

For Canadian users, we collect, use, and disclose personal information only with your knowledge and consent, or as permitted by law, in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec's Law 25. You may withdraw consent at any time, subject to legal or contractual restrictions.

4.4 Australia (Privacy Act 1988 / APPs)

For Australian users, we handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). We collect only information reasonably necessary for our functions. You have the right to access and correct your personal information and may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

5. Cookies

We use cookies and similar tracking technologies on our website. These include:

• Essential cookies: Required for the website to function
• Analytics cookies: Used by Google Analytics to understand how visitors use our site
• Marketing cookies: Used to track the effectiveness of campaigns

You can control cookies through your browser settings or our cookie consent banner. Withdrawing consent for non-essential cookies will not affect your ability to use core Services.

6. How We Share Your Information

We do not sell your personal information. We share data only with the following categories of recipients:

6.1 Service Providers (Data Processors)

All third-party service providers acting as data processors are contractually bound by Data Processing Agreements (DPAs), requiring them to process personal data only on our instructions and in compliance with applicable data protection laws.

• Stripe Inc. — Payment processing (US-based; certified under EU-US Data Privacy Framework)
• Google LLC — Analytics (Google Analytics 4; data anonymisation enabled)
• Mailchimp (Intuit Inc.) — Email marketing and communications
• HubSpot Inc. — CRM and customer relationship management

6.2 Other Disclosures

• Legal authorities, where required by law or to protect our legal rights
• Acquirers in the event of a merger, acquisition, or sale of assets (with prior notice to you)

7. International Data Transfers

As a UK-registered company serving a global audience, your data may be transferred to and processed in countries outside the UK or EEA, including the United States. Where such transfers occur, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the UK ICO or European Commission
• Transfers to providers certified under applicable data transfer frameworks

8. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes described in this Policy, or as required by law. Typical retention periods:

• Customer account data: Duration of contract plus 6 years (UK statutory limitation period)
• Marketing contact data: Until you unsubscribe or withdraw consent
• Analytics data: 26 months (Google Analytics default)
• Payment records: 7 years (UK HMRC requirement)

9. Your Rights

9.1 UK & EU Rights (UK/EU GDPR)

If you are based in the UK or EEA, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request erasure of your data ("right to be forgotten")
• Restrict or object to certain processing activities
• Data portability — receive your data in a structured, machine-readable format
• Withdraw consent at any time (where processing is based on consent)
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or your local EEA supervisory authority

9.2 California Rights (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, or sell
• Delete your personal information (subject to certain exceptions)
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information (we do not sell personal data)
• Non-discrimination for exercising your privacy rights

9.3 Canada Rights (PIPEDA / Law 25)

If you are based in Canada, you have the right to:

• Access the personal information we hold about you
• Challenge the accuracy and completeness of your information and have it amended
• Withdraw consent to collection, use, or disclosure (subject to legal or contractual restrictions)
• Know how your personal information is being used and to whom it has been disclosed
• Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

9.4 Australia Rights (Privacy Act 1988)

If you are based in Australia, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate, incomplete, or out-of-date information
• Make a complaint about a breach of the Australian Privacy Principles (APPs)
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

To exercise any of your rights, please contact us at: privacy@ordinexautomation.com

We will respond to verified requests within 30 days (UK/EU GDPR) or 45 days (CCPA/Canada/Australia).

10. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or disclosure. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

11. Children's Privacy

Our Services are directed exclusively at businesses and professionals. We do not knowingly collect personal data from individuals under the age of 16. If you believe we have inadvertently collected such data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or by posting a prominent notice on our website. The "Effective Date" at the top of this page indicates when the policy was last revised.

13. Contact Us

For any questions, requests, or complaints relating to this Privacy Policy or our data practices, please contact our Data Privacy team:

If you are based in the EEA and have concerns about our data handling, you also have the right to contact your local data protection supervisory authority.