Home → Privacy
Privacy policy
How ONAY Chemical Regulations Consulting Ltd handles personal data on this website.
Who we are
ONAY Chemical Regulations Consulting Ltd, registered in England & Wales under company number 14714435, at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. We are the data controller for personal data collected through ukreach.org.
For any privacy question, contact info@ukreach.org.
What we collect
Only what you send us. If you complete the enquiry form, we receive your name, company, email address, country, the role and tonnage you select, and the message you write. We do not ask for and do not want special category data.
This site does not use advertising cookies, analytics profiling cookies or third-party trackers. Our web server keeps standard access logs, which include IP addresses, for security and troubleshooting.
Why we use it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Replying to your enquiry and providing a scope or quote | Legitimate interests, and steps taken at your request prior to entering a contract |
| Delivering consultancy services you engage us for | Performance of a contract |
| Keeping records required by law | Legal obligation |
| Securing the website and preventing abuse | Legitimate interests |
How long we keep it
Enquiries that do not become engagements are deleted within 24 months. Where you become a client, we retain records for the period required by UK company and tax law, and for the period necessary to evidence regulatory work — which for UK REACH purposes can be at least ten years after the substance was last supplied.
Who we share it with
We do not sell personal data and we do not share it for marketing. We disclose it only to:
- Service providers who host our website and email, acting on our instructions.
- Regulators, including the Health and Safety Executive, where a submission we make on your behalf requires it.
- Our sister practices, where you have asked us to coordinate work across UK REACH, EU REACH and Turkish KKDIK.
- Professional advisers, or authorities where we are legally required to.
Where data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law.
Your rights
Under UK GDPR you may request access to your personal data, correction of inaccuracies, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. To exercise any of these, email info@ukreach.org. We respond within one month.
If you are not satisfied with our response, you may complain to the Information Commissioner's Office, the UK supervisory authority for data protection.
Changes
We update this policy when our practices change. The version published here is the current one.