Privacy

Effective date: 16 October 2026

OENA LTD (“we”, “us”, or “our”) operates the www.oena.co website (the “Service”).

Company Number: 14171826

VAT Number: 472524588

This Privacy Policy explains how we collect, use, store, and protect personal data when you interact with our website or services. By accessing or using the Service, you acknowledge the practices described below.

Introduction

We take data protection seriously. Personal data is collected and processed only where necessary, lawfully, and transparently.

This policy explains:

  • What information we collect
  • Why we collect it
  • The legal basis for processing
  • How long we retain it
  • Your rights under UK data protection law

For the purposes of UK GDPR and the Data Protection Act 2018, OENA LTD acts as the Data Controller of your personal data.

If you have questions regarding this policy or your personal information, please contact us at: hello@oena.co.

Definitions

  • Personal data: Information relating to an identified or identifiable individual.
  • Usage data: Information collected automatically through interaction with the Service, including browser type, device information, pages visited, time spent, and referring URLs.
  • Cookies: Small data files stored on your device that support website functionality and, with your consent, analytics and advertising measurement.
  • Data controller: The organisation that determines how and why personal data is processed. OENA LTD is the data controller.
  • Data processor: A third party that processes personal data on behalf of the data controller.

Information we collect

We collect information in two primary ways.

Information you provide directly

We may collect personal data when you:

  • Submit a contact form.
  • Book a call.
  • Subscribe to updates.
  • Enquire about our services.
  • Enter into a contractual relationship with us.

This may include:

  • Name
  • Email address
  • Company name
  • Telephone number
  • Billing and contractual information
  • Any information voluntarily submitted

Providing this information is voluntary, but failure to provide certain data may prevent us from delivering services.

Information collected automatically

When you access the Service, we may automatically collect:

  • IP address.
  • Device and browser type.
  • Operating system.
  • Pages viewed.
  • Time and date of visits.
  • Time spent on pages.
  • Referral source.
  • Interaction and navigation behaviour.

This information helps us understand performance, improve user experience, and measure marketing effectiveness.

How we use your data

We process personal data only where necessary to operate our business and deliver our services.

We use information to:

  • Respond to enquiries and provide requested services.
  • Enter into and manage contracts.
  • Deliver strategic and digital marketing services.
  • Improve website functionality and performance.
  • Analyse traffic and user behaviour.
  • Communicate updates where consent has been provided.
  • Measure and optimise advertising campaigns.

We do not sell or trade personal data.

Under UK GDPR, we rely on the following lawful bases:

  • Consent: For email marketing communications and non-essential cookies.
  • Contract: Where processing is necessary to perform a contract or take steps prior to entering into a contract.
  • Legitimate interests: To improve our services, analyse website performance, and operate our business effectively — provided those interests are not overridden by your rights.
  • Legal obligation: Where required to comply with applicable law.

You may withdraw consent at any time.

Cookies and third-party services

Cookies

We use cookies and similar technologies to keep the Service working and, only with your consent, to understand how it is used and to measure our advertising.

When you first visit, a cookie notice asks for your choice, and nothing non-essential is set until you make one. You can accept all, reject all, or use Manage to choose category by category. You can change your choice at any time using Cookie settings in the footer of every page.

We use the following categories:

  • Necessary: needed for the Service to work, including remembering your cookie choice (the userConsent cookie, kept for 12 months). These cannot be switched off.
  • Functional: would remember preferences you set on the Service. We do not currently set any functional cookies.
  • Analytics: Google Analytics 4, which sets cookies such as _ga and _ga_<ID> (kept for up to 2 years) to show us how the Service is used, in aggregate. It only loads after you consent to Analytics.
  • Marketing: the Meta Pixel, which sets cookies such as _fbp and _fbc (usually kept for up to 90 days) to measure and improve our advertising on Facebook and Instagram. It only loads after you consent to Marketing.

If you withdraw consent, these cookies stop being used from your next page view. You can also delete cookies already stored on your device through your browser settings.

Third-party services

We use trusted providers to support website operation and marketing activities, including:

  • Google Analytics (GA4): used to analyse website usage and performance, only where you have consented to Analytics cookies.
  • Meta (Facebook & Instagram Ads): used for advertising, conversion tracking and remarketing, only where you have consented to Marketing cookies.
  • Klaviyo: used to manage email communications and subscriber lists where consent has been given.

These providers may process data outside the United Kingdom. Where international transfers occur, appropriate safeguards — including Standard Contractual Clauses — are implemented.

Data retention and security

We retain personal data only for as long as necessary to:

  • Fulfil contractual obligations.
  • Comply with legal requirements.
  • Maintain business records.
  • Resolve disputes.

Retention periods vary depending on the nature of the data and legal obligations attached.

We implement appropriate technical and organisational measures to safeguard personal data against unauthorised access, alteration, disclosure, or destruction. However, no internet transmission or storage system is entirely secure.

Your rights

Under UK GDPR, you have the right to:

  • Access your personal data.
  • Request correction of inaccurate or incomplete data.
  • Request deletion.
  • Restrict or object to processing.
  • Request data portability.
  • Withdraw consent at any time.

Requests can be submitted by contacting us via email.

We aim to respond within one month, as required by law.

We may request verification of identity before fulfilling a request.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO): https://ico.org.uk.