Privacy notice.

Last updated 19 September 2026

Who we are

OFO Group Ltd, trading as OFO. Registered in England and Wales, company no. 17470410. Registered office: 66 Paul Street, London, EC2A 4NA. We are the controller of the personal data described here. You can reach us about anything in this notice at hello@ofogroup.co.uk.

What we collect

Scope form answers. The scope form is the one place we ask for real detail. Its eight questions describe your business: what systems you currently run and roughly what they cost, how big the team is, how your operations work day to day and where the time is going. We ask because honest answers are what let us scope honestly. We treat them as confidential business information, and we never use them for anything except assessing and discussing your build.

Callback requests. Your name, company, phone number and the best time to call. Nothing else — four fields is the lot.

Email enquiries. Whatever you choose to put in an email to us, along with your email address.

Cookieless analytics. Vercel Web Analytics records anonymous counts of pages visited, where visitors came from, approximate location (country, region or town) and what sort of device they used. No cookies are set for this and no profile of you is built — the detail is in our cookie notice.

When you submit a form we also record the time, the page you came from and any campaign tags in the link you followed, so we know which of our own marketing actually works.

Why, and the lawful basis

We use scope form answers, callback requests and email enquiries to respond to you — that is our legitimate interest in answering a business enquiry you chose to send us, and we judge it intrudes on you no further than answering requires.

We only send marketing email with your consent, and you can withdraw it at any time using the unsubscribe link in any message or by emailing us. Withdrawing consent doesn't affect anything done before you withdrew it.

Where your data goes

We name every processor rather than gesturing at "trusted partners":

• Vercel — hosts this website. The site is served from Vercel's London region, and Vercel Web Analytics measures page visits without setting cookies.
• Resend — delivers the emails the site sends, such as the auto-reply confirming what you submitted, from its EU (Ireland) region. We don't track whether you open those emails or click their links.
• Neon — the database your form answers are saved to, hosted in Neon's London region.

Form submissions are saved to that database before any email is sent, so an email failure can't lose your enquiry. We don't sell personal data. Beyond the processors listed here, and the subcontractors each one uses to run its service under its data processing agreement with us, we don't share it with anyone.

International transfers

We run the site and the database in London and send email from the EU, but that doesn't keep everything in the UK. Each processor above is a US company or part of one, and using their services can involve personal data being processed in the United States. UK law allows personal data to go to US companies certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US "data bridge"), and all three are certified. Here is where your data sits with each of them, and what covers it when it leaves the UK.

Vercel. The site is served from London, but Vercel Inc.'s primary processing facilities are in the United States, so data it handles for us can be transferred there. Vercel Inc. is certified under the UK Extension, and its data processing agreement adds the EU Standard Contractual Clauses with the ICO's International Data Transfer Addendum, which cover transfers the data bridge doesn't, such as onward transfers to Vercel's own subprocessors outside the US.

Resend. Emails are sent from Resend's EU (Ireland) region, but Resend (run by Plus Five Five, Inc.) stores everything it handles for us, including the content of those emails and their delivery logs, in the United States. It is certified under the UK Extension, and where that doesn't apply its data processing agreement uses the EU Standard Contractual Clauses with the ICO's International Data Transfer Addendum.

Neon. Your form answers are stored in Neon's London region. Neon is part of Databricks, Inc., a US company, and one of the subprocessors it uses to run its infrastructure is in the US, so we don't assume the data never leaves the UK. Databricks, Inc. and Neon are both covered by a certification under the UK Extension, and Databricks' data processing agreement also includes the EU Standard Contractual Clauses with the ICO's International Data Transfer Addendum.

Certifications can lapse or change, so we check each processor on the Data Privacy Framework list from time to time and will update this notice if anything changes.

How long we keep it

Enquiries — scope form answers, callback requests and email threads — are kept for 24 months from our last contact, then deleted. If you become a client, the information moves into the client relationship and is kept for as long as that requires. Marketing consent lasts until you withdraw it.

Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you
• have inaccurate data rectified
• have your data erased
• restrict how we use it
• object to our use of it, including for direct marketing
• receive it in a portable format

To exercise any of them, email hello@ofogroup.co.uk. We don't charge, and we respond within a month.

Complaints

If you think we've handled your data badly, tell us first and we'll try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.