1. Data Controller
UXON AI, ABN 82 658 055 997, with registered office located in Queensland and principal office at Unit 142, 53 Vernon Terrace, Teneriffe QLD 4005, in its capacity as Data Controller, referred to as the “Controller”, hereby provides this privacy policy pursuant to Articles 13 and 14 of EU Regulation 2016/679, referred to as “GDPR”.
The Data Controller can be contacted at ops@uxon.ai.
2. Collected Data, Purposes and Data Provision
Please refer to Annex 1 attached.
3. Processing Methods
The collected data are processed using paper and electronic means.
The Data Controller processes the Users’ Personal Data in accordance with the GDPR, adopting appropriate security measures to prevent unauthorised access, disclosure, modification or loss of Personal Data.
The collected data, limited to personal data, may be communicated to countries outside the EU for the purposes indicated above. In such case, the Data Controller undertakes to guarantee adequate levels of protection and safeguarding in accordance with the applicable regulations.
4. Persons Involved in the Processing
The collected data are processed by persons designated as data processors or persons in charge of processing, in accordance with Articles 28 and 29 of the GDPR. The collected data may be processed, exclusively for the indicated purposes, by personnel of the data controller or by third parties, such as:
- companies that provide IT system maintenance services;
- associations, consultants, professional firms, companies that provide assistance and advice to the Data Controller;
- customers and/or suppliers with whom the data subject interacts in the course and for the performance of the relevant tasks, limited to non-sensitive personal data;
- social security, welfare and insurance institutions, the financial administration, other authorised public entities, within the limits provided under legislative, regulatory and contractual provisions.
5. Rights of the Data Subject
You are entitled to exercise your rights as set forth under Articles 15 to 21 of the GDPR, and, as a result:
- in addition to the data portability right, to obtain access to your personal data and to rectify or erase such data, as well as to obtain the restriction of the processing concerning you or to oppose to the processing of said data;
- to withdraw consent, where processing is based on Article 6(1)(a), at any time and without prejudice to the lawfulness of the processing based on consent given prior to the withdrawal;
- to lodge a complaint with a supervisory authority.
To exercise your rights, please send your request to the email address above by using the form for exercising data subject rights available on the website.
Annex 1
| Purpose | Processed Data | Legal Basis | Nature of Data Provision | Storage Period |
|---|---|---|---|---|
| Management of relations and contracts with customer | Contact and details of legal representatives, contractors and/or employees of customers: name, surname, contact details, residence details, details provided in requests |
| Mandatory: the provision is necessary for the management of the relationship/contract | Without prejudice to legal obligations, personal data will be stored for the time necessary to achieve the purposes for which it was collected, and in any case for no longer than 10 years from the termination of the contract/relationship/contact with the data subject. However, the Data Controller may continue to store the data for a longer period to manage any disputes relating to the relationship established. |
| Management of purchases of goods and services and related practices; management of relations with supplier |
|
| Mandatory: the provision is necessary to manage the supplier relationship, purchases of goods and services, and related practices. | Without prejudice to legal obligations, personal data will be stored for the time necessary to achieve the purposes for which it was collected, and in any case for no longer than 10 years from the termination of the contract/relationship/contact with the data subject. However, the Data Controller may continue to store the data for a longer period in order to manage any disputes relating to the relationship established. |
| Management of the website related to customers | Website registered user: name, surname, contact details, website logs, browsing data, IP address, browser type, device information, referrer URL, session timestamps, and usage logs | Performance of a contract to which the data subject is a party or performance of pre-contractual measures taken following a request of the data subject | Mandatory: the provision is necessary for the management of the relationship/contract | Unless otherwise specified in this document, Personal Data is processed and stored for the time required for the purposes for which it was collected and may be stored for a longer period due to any legal obligations or based on the consent of Users. |
| Cookies and website tracking tools | Website registered user and visitor: IP or other data collected by the activated cookie | Express consent. For further information, please refer to the Cookie Policy available on the website at the following link: Cookie Policy. | Optional for non-essential cookies and tracking tools: refusal or withdrawal may limit analytics and advertising attribution but does not prevent access to the website. Essential technologies may still be required to provide the website or requested service. | Unless otherwise specified in this document, Personal Data is processed and stored for the time required for the purposes for which it was collected and may be stored for a longer period due to any legal obligations or based on the consent of Users. |
| To provide assistance to requests from data subjects | Users/visitors who make requests via email or website: personal details, contact details, data provided by users |
| Mandatory where a request is submitted: the provision is necessary to respond to the request and provide assistance. Failure to provide the data may prevent UXON AI from handling the request. | Without prejudice to legal obligations, personal data will be stored for the time necessary to achieve the purposes for which it was collected, and in any case for no longer than 10 years from the termination of the contract/relationship/contact with the data subject. However, the Data Controller may continue to store the data for a longer period in order to manage any disputes relating to the relationship established. |
| To provide the service to Clients - Lead data collection and storage through forms or user-generated events | Website registered user of landing page of the Controller created by UXON: name, email, phone, any fields submitted through forms | Appointment as Processor by the Controller Client | Mandatory where the Client uses lead collection features: the provision is necessary to collect, store and manage lead submissions on behalf of the Client. Failure to provide the data may prevent lead capture and related service functionality. | Without prejudice to legal obligations, personal data will be stored for the time necessary to achieve the purposes for which it was collected, and in any case for no longer than 90 days as from the termination of the contract/relationship/contact with the Controller Client. However, UXON may continue to store the data for a longer period in order to manage any disputes relating to the relationship established. |
| To provide the service to Clients - Event tracking and analytics via UXON proprietary pixel for session tracking, conversion tracking and A/B testing | Website visitors of landing pages of the Controller created by UXON: session ID, visitor ID, timestamp, event data, currency, URL, referrer, UTM parameters, device type; non-personal unless provided by the user | Appointment as Processor by the Controller Client | Mandatory where the Client enables analytics, event tracking or experiments: the provision is necessary to provide reporting, attribution and testing functionality. Failure to provide the data may prevent those features from operating. | Without prejudice to legal obligations, personal data will be stored for the time necessary to achieve the purposes for which it was collected, and in any case for no longer than 90 days as from the termination of the contract/relationship/contact with the Controller Client. However, UXON may continue to store the data for a longer period in order to manage any disputes relating to the relationship established. |
| To provide the service to Clients, including hosting and storage of Customer Data and Lead Data, deployment, domain management and SSL | Website visitors of landing pages of the Controller created by UXON: account data including email and organisation name, lead data, log data and technical data | Appointment as Processor by the Controller Client | Mandatory: the provision is necessary to host, store, deploy, secure and operate the Service for the Client. | Without prejudice to legal obligations, personal data will be stored for the time necessary to achieve the purposes for which it was collected, and in any case for no longer than 90 days as from the termination of the contract/relationship/contact with the Controller Client. However, UXON may continue to store the data for a longer period in order to manage any disputes relating to the relationship established. |
| To provide the service to Clients - AI content generation via OpenAI: processing prompts and outputs solely to provide the service; no training of external models | Individuals whose data may be included in user prompts: any text voluntarily provided by the Controller in prompts | Appointment as Processor by the Controller Client | Optional: the provision occurs only when the Client submits prompts or content for AI generation. Failure to provide the data means AI-assisted generation cannot be provided for that request. | Without prejudice to legal obligations, personal data will be stored for the time necessary to achieve the purposes for which it was collected, and in any case for no longer than 90 days as from the termination of the contract/relationship/contact with the Controller Client. However, UXON may continue to store the data for a longer period in order to manage any disputes relating to the relationship established. |
| To provide the service to Clients - Call tracking: association of calls with leads; processing caller number and call metadata | Callers related to the landing page of the Controller created by UXON: phone number, call duration, call metadata; transcription | Appointment as Processor by the Controller Client | Optional: the provision occurs only where call tracking is enabled. Failure to provide the data may prevent call routing, call attribution and call reporting. | Without prejudice to legal obligations, personal data will be stored for the time necessary to achieve the purposes for which it was collected, and in any case for no longer than 90 days as from the termination of the contract/relationship/contact with the Controller Client. However, UXON may continue to store the data for a longer period in order to manage any disputes relating to the relationship established. |
Annex 2 - Processors and Sub-processors
| Appointment | Scope of Processing | Name / Company Name | Personal Data Processed | Appointed Until |
|---|---|---|---|---|
| Sub-processor | Database hosting for account and application data | Neon / AWS Sydney region | Account data; application-level technical data | Termination of the agreement |
| Sub-processor | Application hosting and deployment infrastructure | Vercel | Technical and log data required for service delivery | Termination of the agreement |
| Sub-processor | Software development and version control infrastructure | GitHub | Application source code, repository metadata, developer account identifiers, commit metadata, deployment metadata and security logs. Customer personal data is not intentionally stored in source repositories. | Termination of the agreement |
| Sub-processor | Payment processing and billing | Stripe | Billing data. Card processing is handled by Stripe and UXON does not store card details. | Termination of the agreement |
| Sub-processor | AI text and content generation | OpenAI | Prompts and outputs. These are not used to train external models. | Termination of the agreement |
| Sub-processor | E-commerce integration | Shopify | Shop domain, access token, product and variant catalogue data, product images, pricing, currency, inventory status, order ID, purchase currency and purchase value where revenue capture is enabled. | Termination of the agreement |
| Sub-processor | CRM and marketing automation event capture | HubSpot | Form ID, submission ID, portal ID, form instance ID and related conversion event metadata captured after successful HubSpot form submission. | Termination of the agreement |
| Sub-processor | Call tracking number provisioning and call routing | Twilio | Tracking number, forwarding number, caller phone number, call duration, call status, call metadata and Twilio phone number identifiers. | Termination of the agreement |
| Sub-processor | Custom domain and DNS/SSL management | saascustomdomains.com | Domain, subdomain, DNS validation records, SSL certificate status, routing metadata and instruction recipient email address where domain instructions are sent. | Termination of the agreement |
| Processor | Audit on annual accounts | Accountant | Invoices, agreements, names, addresses, and contact details | Termination of the agreement |
.png)
