Privacy Policy

1. Introduction

Runox Technologies Limited ("Runox", "we", "us", or "our") is committed to protecting your privacy and handling your personal data transparently. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our business intelligence platform and services, including Legal, HR & Payroll, Accounting, and Tax (HMRC MTD) products.

Runox acts as a data processor when processing data on behalf of our clients (law firms, corporate legal departments, and businesses) and as a data controller for data we collect directly from users for account management and service provision.

2. Data Controller Information

3. Information We Collect

3.1 Information You Provide

3.2 Information Collected Automatically

3.3 Information Processed on Behalf of Clients

When you use Runox through your organisation, we process data as instructed by our client (your employer or organisation). This may include:

• • Documents you upload or create
• • Client and matter information you enter
• • Contract and legal document content
• • Communication records within the platform

Note: For this data, your organisation is the data controller. Please refer to your organisation's privacy policy.

3.4 HMRC Tax Data

When you use our Tax (HMRC MTD) product, we process additional data required by HMRC for Making Tax Digital compliance:

• • National Insurance Number (NINO) and Unique Taxpayer Reference (UTR)
• • VAT Registration Number (VRN)
• • Self Assessment income, expenses, and obligations data
• • Fraud prevention headers as mandated by HMRC (device information, IP addresses, browser data)

3.5 Company Secretarial Records (Runox CoSec)

Firms that use Runox CoSec keep their client companies' statutory records in it. For those records the firm is the data controller and Runox is its processor, acting only on the firm's instructions under a data processing agreement. The records may include:

• • Directors, secretaries, shareholders/members, beneficial owners and authorised signatories: names, service addresses, contact details, nationality, occupation, month and year of birth, shareholdings and voting rights
• • Held encrypted: full date of birth, ID and passport numbers, residential addresses, and identity documents collected for client due diligence (KYC/AML)
• • Meeting notices, attendance, votes, minutes and resolutions; signatures with their signing evidence (time, IP address, browser)
• • Documents and messages exchanged between the firm and its clients through the client portal and secure links

The hosted service runs in the European Union (the Netherlands). Firms that need data kept in-country can run Runox CoSec on their own server, in which case none of our hosting providers handle it. If you are named in a firm's records, the firm's own privacy notice applies and requests should go to the firm; we will pass on any request we receive and help the firm answer it.

4. How We Use Your Information

4.1 Lawful Bases for Processing

5. How We Share Your Information

5.1 Service Providers (Sub-processors)

Runox CoSec (cosec.runox.ai) uses its own, smaller set:

All sub-processors are bound by data protection agreements. AI, transcription and video-meeting providers a firm connects to Runox CoSec with its own account are engaged by the firm, not by us.

5.2 Your Organisation

If you access Runox through an organisation:

• • Your organisation's administrators may access your account information
• • Usage data may be reported to your organisation
• • Your organisation controls data retention settings

5.3 Legal Requirements

We may disclose information:

• • To comply with legal obligations
• • In response to lawful requests from authorities
• • To protect our rights, privacy, safety, or property
• • In connection with a merger, acquisition, or sale of assets

6. International Data Transfers

When we transfer personal data outside the UK/EEA, we ensure adequate protection through:

• • Adequacy Decisions: Transfers to countries with equivalent protection
• • Standard Contractual Clauses (SCCs): EU/UK approved contractual safeguards
• • Supplementary Measures: Additional technical and organisational protections

7. Data Retention

8. Your Rights

Under GDPR and UK data protection law, you have the following rights:

How to Exercise Your Rights: Submit a request via your account settings or email dpo@runox.ai. We respond within 30 days.

9. Data Security

Technical Measures

• • Encryption: AES-256-GCM at rest, TLS 1.2+ in transit
• • Access Control: Role-based access, multi-factor authentication
• • Network Security: Firewall, DDoS protection, rate limiting
• • Monitoring: 24/7 security monitoring, anomaly detection

Organisational Measures

• • Staff Training: Regular security and privacy training
• • Access Reviews: Periodic review of access permissions
• • Vendor Management: Security assessment of all sub-processors
• • Incident Response: Documented procedures for security incidents

Breach Notification

In the event of a personal data breach:

• • We will notify the relevant supervisory authority within 72 hours
• • We will notify affected individuals if there is a high risk to rights and freedoms
• • We will document all breaches and responses

10. Cookies and Tracking

In accordance with the Privacy and Electronic Communications Regulations 2003 (PECR) and ePrivacy requirements:

• • Essential cookies are placed without consent as they are strictly necessary
• • Non-essential cookies (functional and analytics) require your consent
• • You can change your preferences at any time via our Cookie Preference Centre

For full details, see our Cookie Policy.

11. Children's Privacy

Runox is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware of such collection, we will delete the data promptly.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will:

• • Post the updated policy on our website
• • Update the "Last Updated" date
• • Notify users of material changes via email or platform notification

13. Contact Us

14. Additional Information for Specific Jurisdictions

California Residents (CCPA)

You have the right to know what personal information is collected, opt-out of sale (we do not sell personal information), and non-discrimination for exercising your rights.

Brazilian Residents (LGPD)

You have rights similar to GDPR rights, enforceable under the Lei Geral de Proteção de Dados.

South African Residents (POPIA)

You have rights under the Protection of Personal Information Act, including access, correction, and deletion rights.

Nigerian Residents (NDPA)

You have rights under the Nigeria Data Protection Act 2023, including access, correction, erasure, objection and portability. You may complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Kenyan Residents

You have rights under the Data Protection Act 2019, including to be informed, to access, correct and delete your data, and to object. You may complain to the Office of the Data Protection Commissioner (odpc.go.ke).

Other African Jurisdictions

Where your data is processed for a company in Ghana (Data Protection Act 2012, Act 843), Uganda (Data Protection and Privacy Act 2019), Tanzania (Personal Data Protection Act 2022), Rwanda (Law No. 058/2021), Zambia (Data Protection Act 2021), Malawi (Data Protection Act 2024) or Botswana (Data Protection Act), you have the rights that law gives you, and you may complain to its data protection authority. Write to privacy@runox.ai and we will help.