Privacy Policy

The Onyx Grid is the e-commerce software studio of BNB INVEST FZE, a company registered in the United Arab Emirates. BNB INVEST FZE is the data controller for personal data collected through this website. Questions can be sent to support@theonyxgrid.com.

This policy covers theonyxgrid.com only. Our applications (Reportify, Consignly and Revamp) each publish their own privacy notice covering the data they process, because what an app collects depends on what it does.

Where we build or operate an app for a client, the client is normally the data controller for merchant and shopper data, and we act as a processor under a written agreement.

• Enquiry details: the name, email address, company, subject and message you submit through the contact form.
• Anti-abuse data: the IP address and browser user agent attached to a submission, kept to stop form spam.
• Server logs: standard request logs from our hosting provider, for security and reliability.

We do not run advertising cookies or third-party behavioural tracking on this website, and we do not sell personal data.

Our Shopify applications access store data through Shopify's official APIs, under the scopes a merchant approves at install. We apply the following rules across every app we build:

• Request the minimum API scopes the app needs to function.
• Process shopper personal data only as needed to deliver the app's function to the merchant.
• Honour Shopify's mandatory GDPR webhooks for customer data requests, customer redaction and shop redaction.
• Delete store data within 30 days of uninstall, unless a longer period is required by law.

• To answer your enquiry: because you asked us to, and our legitimate interest in responding to business enquiries.
• To keep business records: our legitimate interest in managing client relationships.
• To protect our systems: our legitimate interest in preventing spam and abuse.
• To comply with law: where retention or disclosure is required.

Only service providers processing data on our instructions under contract: our hosting and content delivery provider, our managed database provider, and our transactional email provider. These providers may process data outside the United Arab Emirates, in which case we rely on their contractual data protection commitments, including standard contractual clauses where applicable.

Website enquiries are kept for 24 months from your last contact with us unless a contract, legal claim or statutory obligation requires longer. Anti-abuse data is kept for 12 months. After that, data is deleted or anonymised.

Data is encrypted in transit using TLS and at rest by our providers. Access is limited to personnel who need it, credentials are held in managed vaults, and changes go through code review. We will notify you and the relevant authority of a qualifying personal data breach as required by law.

Subject to applicable law you may request a copy of your personal data, correct it, delete it, restrict or object to our use of it, or receive it in a portable format. Write to support@theonyxgrid.com and we will respond within 30 days. If our response does not satisfy you, you may complain to your national data protection authority.

We may update this policy as our practices or the law change. The date at the top of this page shows when it was last revised.