B2B Privacy Policy & Data Notice

1. Controller Identity & How To Contact Us

The controller for website and pilot-qualification data is OmitPII Ltd, a company registered in Jersey, Channel Islands (Company No. 167349). Because we are established in Jersey and offer services to organisations in the United Kingdom and the European Union, we treat ourselves as subject to the Jersey DPL 2018 in respect of our own establishment and to the UK GDPR and EU GDPR to the extent Article 3(2) applies to our offering of services into those territories.

Data protection enquiries and all statutory rights requests: hello@omitpii.com. General enquiries: hello@omitpii.com. We have not appointed a statutory Data Protection Officer, as our processing does not meet the mandatory appointment thresholds; responsibility sits directly with our founding engineering team.

Corporate Independence: OmitPII Ltd is a wholly independent, privately held enterprise incorporated under Jersey company law (Registration No. 167349) and solely owned by founder Nat Winston-Jones. OmitPII Ltd has no parent corporation, holding company, subsidiaries, or shared corporate ownership with any third-party software organization.

2. Commercial Lead & Pilot Processing

When you submit a corporate email address or qualification information on omitpii.com, we collect your business contact details (including corporate email, organisation name, practice department, jurisdiction, and pilot fleet size) exclusively to evaluate sandbox qualification, provision a 14-day evaluation license, calculate your statutory penalty exposure scorecard, and provide dedicated technical and commercial onboarding support.

We do not ask for, and ask that you do not submit, any special category data, criminal offence data, or client confidential information through this website. The assessment form is designed for corporate contact data only.

Lawful Basis: Processing is conducted on the basis of legitimate commercial interests under Jersey DPL 2018 (Schedule 2, Part 1, paragraph 6), UK GDPR Art. 6(1)(f), and EU GDPR Art. 6(1)(f), as well as taking preliminary steps at your request prior to entering into a pilot agreement (Jersey DPL 2018 Schedule 2, Part 1, paragraph 2; UK/EU GDPR Art. 6(1)(b)). Where we rely on legitimate interests we have carried out a balancing assessment, and you may object at any time under Art. 21 GDPR / Art. 35 Jersey DPL.

Retention: Qualification submissions that do not proceed to a trial are deleted within 12 months of last contact. Records relating to an actual trial deployment are retained for 6 years from the end of the engagement to meet contractual, tax and limitation-period requirements, then deleted. Direct marketing suppression records are kept indefinitely, because we must remember that you asked us to stop. This reflects the storage limitation principle under the Jersey DPL 2018 and Art. 5(1)(e) UK/EU GDPR.

3. Website Infrastructure, Processors & Honest Transfer Disclosure

We hold our own supply chain to the standard we ask of yours, so we disclose it plainly rather than in general terms. The data sovereignty guarantee described in section 4 applies to the OmitPII desktop software. It does not, and cannot, apply to this marketing website, which relies on third-party infrastructure:

• Website hosting and form capture: omitpii.com is hosted on Netlify, and assessment form submissions are captured and stored by Netlify's form service. Netlify, Inc. is established in the United States, so a submission you make through this website involves a transfer of your corporate contact data to a US-based processor.
• Email and CRM follow-up: qualification notifications and onboarding correspondence are handled through our corporate Microsoft 365 tenant.
• Front-end assets: this page loads a CSS framework from cdn.tailwindcss.com and web fonts from fonts.googleapis.com and fonts.gstatic.com. These requests are not analytics, set no identifying cookies and are not used to profile you, but your browser does disclose your IP address and user-agent to those providers in order to fetch the files. We consider this a technical necessity of page rendering rather than surveillance.

Transfer safeguards: Transfers to processors outside Jersey, the UK and the EEA are made under contractual protections equivalent to the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, supplemented by a transfer risk assessment, consistent with Part 4 (Articles 66-69) of the Jersey DPL 2018 and Chapter V of the UK/EU GDPR. A current list of our processors is available on request from hello@omitpii.com. We do not sell, rent, or share your data with advertising networks or data brokers.

4. Local Software Guarantee & Channel Islands Data Sovereignty

OmitPII desktop software operates strictly on your local workstations or within your private corporate network perimeter. All entity scanning, regular expression matching, tokenization, contextual placeholder replacement, and local rehydration occur entirely within active machine memory.

Zero Server Interception: Customer prompts, deed drafts, client trust records, and personal identifiers processed through the local desktop proxy are never stored, logged, or intercepted on our servers.

Jersey DPL Cross-Border Sovereignty: Under Part 4 (Articles 66-69) of the Jersey DPL 2018 and Chapter V of the UK/EU GDPR, transfers of personal data outside Jersey, the UK, or the EEA to unapproved third countries are strictly controlled. Because OmitPII cleans and sanitizes data locally on your device before dispatch, the payload that reaches an external model provider is designed to contain no identifiable personal data, which materially reduces your restricted-transfer and processor-disclosure exposure.

Scope of the guarantee: redaction reduces the personal data in an outbound prompt; it does not convert a third-party model provider into a non-processor, and it does not by itself render data irreversibly anonymous in the hands of your own firm, which retains the re-identification mapping locally. You remain responsible for the lawfulness of the underlying AI use, as described in section 6.

5. Third-Party Tracking & Cookie Policy

We deploy zero third-party advertising, profiling, or cross-site tracking cookies, and we operate no analytics or session-recording product on this domain. Standard browser storage (such as HTML5 localStorage) is used exclusively to maintain form state progression and UI preferences during your visit; it stays on your device, is not transmitted to us, and can be cleared at any time through your browser. Because we set no non-essential cookies, no consent banner is required under the UK PECR, the EU ePrivacy Directive, or Jersey guidance.

6. EU AI Act Position (Regulation (EU) 2024/1689, as amended)

This website deploys no AI system. The compliance assessment and statutory exposure calculator are deterministic, rules-based scripts that apply fixed arithmetic to the figures you enter. They do not infer, learn, adapt, or generate outputs within the meaning of Art. 3(1), and are not an AI system for the purposes of the Regulation. Nothing you submit here is used to train, fine-tune, or evaluate any model.

Our software: OmitPII performs deterministic pattern detection and tokenization. It is not a general-purpose AI model, is not listed in Annex III, and is not marketed as a safety component of a regulated product. Where OmitPII incorporates machine-learning-assisted entity recognition, it operates as an upstream data governance control that supports your obligations under Art. 10 (data and data governance) rather than replacing them.

Your role: when you send a sanitized prompt to an external model, you are ordinarily the deployer of that third-party AI system and remain subject to the deployer duties in Art. 26, the human-oversight expectations in Art. 14, the AI literacy duty in Art. 4, and the transparency duties in Art. 50. OmitPII assists with these obligations; it does not assume them.

Applicability dates, as amended: the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026) revised the timetable. Art. 5 prohibited practices and the Art. 4 AI literacy duty have applied since 2 February 2025, with Art. 4 amended to require measures that support the development of AI literacy rather than guarantee a sufficient level of it. General-purpose AI model obligations have applied since 2 August 2025. Art. 50 transparency obligations apply from 2 August 2026, with Art. 50(2) extending to systems already on the market from 2 December 2026, which is also when the new prohibition on AI systems used to create non-consensual intimate imagery and CSAM takes effect. High-risk obligations were deferred to 2 December 2027 for stand-alone Annex III systems and 2 August 2028 for AI embedded in products under Annex I.

7. Automated Decision-Making & Profiling

We take no decision producing legal effects or otherwise significantly affecting you by automated means alone. The compliance scorecard is an indicative, non-binding illustration; every pilot qualification decision is reviewed by a human being before any outcome is communicated. Accordingly the prohibition on solely automated decisions in Art. 22 UK/EU GDPR and Art. 38 of the Jersey DPL 2018 is not engaged.

8. Security & Personal Data Breaches

We maintain technical and organisational measures appropriate to the risk, in line with the security obligations of the Jersey DPL 2018 and Art. 32 UK/EU GDPR: encryption of data in transit and at rest, least-privilege and role-based access control, multi-factor authentication on administrative accounts, and a minimised data footprint.

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours, and will inform affected individuals without undue delay where the risk is high, consistent with the breach notification duties under the Jersey DPL 2018 and Art. 33-34 UK/EU GDPR.

9. Data Subject Rights (Jersey DPL 2018, UK GDPR & EU GDPR)

Under Part 6 of the Jersey DPL 2018 and Chapter III of the UK/EU GDPR, individuals whose corporate business contact data we hold are entitled to enforce statutory rights:

• Right of Access (Art. 28 Jersey DPL / Art. 15 GDPR): Confirm whether personal data is being processed and obtain a copy of held records.
• Right to Rectification (Art. 31 Jersey DPL / Art. 16 GDPR): Request rectification of inaccurate or incomplete corporate contact data.
• Right to Erasure / Deletion (Art. 32 Jersey DPL / Art. 17 GDPR): Request the permanent deletion of your contact records where no overriding legal obligation applies.
• Right to Restriction of Processing (Art. 33 Jersey DPL / Art. 18 GDPR): Request the restriction of processing under specified statutory grounds.
• Right to Data Portability (Art. 34 Jersey DPL / Art. 20 GDPR): Request transmission of your provided contact records in a structured, machine-readable format.
• Right to Object & Direct Marketing Opt-Out (Art. 35 & 36 Jersey DPL / Art. 21 GDPR): Object to processing based on legitimate interests or opt out unconditionally from direct commercial communications.

To exercise any statutory right, contact our team directly at hello@omitpii.com. We respond to all verified requests within one month.

10. Regulatory Oversight & Supervisory Authorities

You have the statutory right to lodge a complaint with your competent supervisory authority:

11. Changes To This Policy

We review this policy at least annually and whenever our processing, our processors, or the applicable law changes materially. The version number and effective date at the top of this notice always reflect the current text. Where a change materially reduces your rights or expands our processing, we will notify pilot contacts directly rather than relying on a silent update.

This notice describes our own processing and is provided for information. It is not legal advice, and it is not a substitute for your firm's own data protection impact assessment, transfer risk assessment, or professional-conduct analysis.