What we collect
- Account / application data you submit (name, work email, organisation, seat intent) when you apply or subscribe.
- Named-seat details (name and work email) supplied by your organisation when it applies for seats or administers them. If your organisation has given us your details, it is responsible for telling you so; we also link to this notice in the seat activation email.
- Billing correspondence needed to issue invoices and NatWest payment requests (names, work emails, organisation details, payment references). Payment card data is processed directly by NatWest and is not received, stored, or processed by FXRI.
- Technical logs ordinary for hosting (IP, user agent, request path) to keep the service secure and available.
- Cookies / similar storage as described in the cookie notice. Non-essential analytics (Google Analytics 4) run only after you opt in via PlainConsent.
Why we use it (and lawful bases)
- Contract — to review applications, manage named seats, provide the service, and handle billing correspondence.
- Legitimate interests — security, fraud prevention, service reliability, administering named seats for Authorised Users who are not themselves our customer, and product improvement without advertising profiling.
- Legal obligation — tax, accounting, and regulatory record-keeping where applicable.
- Consent — non-essential cookies / analytics, where required.
Who we share with
We do not sell personal data. Recipients / processors include:
- Contabo GmbH — hosting and infrastructure provider for the FXRI application and database (server logs and application data stored on Contabo infrastructure in the EEA). Contabo acts as our processor under UK GDPR Article 28 (under a data processing agreement with Contabo).
- NatWest — bank / payment provider that receives bank transfers and collects card payments via NatWest payment requests. FXRI does not receive or store card numbers. NatWest handles payment data as an independent controller under its own privacy notice, not as our processor.
- Brevo (Sendinblue SAS, France) — email delivery provider for operational email generated by the service (application receipts, seat activation and payment notices), processed in the EEA.
- Google — analytics (Google Analytics 4), which loads only after you accept analytics via PlainConsent. Google processes analytics data on our behalf and may do so outside the UK and the EEA, including in the United States, under the transfer safeguards in its data processing terms.
- Data Protection Representative Limited (DataRep) — our EU/EEA and Swiss data protection representative. They receive data-subject and authority requests and the contact details needed to pass those to us. They do not host the FXRI application or subscriber database.
The research tools we use to prepare content run on our own servers for editorial research only (discovery search, validation, and second-line review). Where a language model is used, the primary model is Anthropic Claude Haiku via the Team API, with OpenAI as a fallback. Those calls send research text we supply (titles, excerpts, fetched public pages) — not visitor or subscriber personal data — and play no part in analytics or consent.
Retention
- Application and account records — kept while the subscription or application is active, then for up to six years after closure for ordinary UK limitation / accounting purposes, unless a longer period is required by law or a dispute.
- Billing / payment correspondence — kept for up to six years after the relevant tax year / transaction.
- Server logs — rotated on a short operational cycle (typically days to weeks).
- Cookie consent choices — stay in your browser until you clear them or change them under Cookie settings.
International transfers
Primary hosting is with Contabo in the EEA. The UK treats EEA destinations as adequate for UK GDPR international-transfer purposes. Our email provider, Brevo, is also in the EEA. Google may process analytics data outside the UK and the EEA, including in the United States, under the transfer safeguards in its data processing terms. If we use any other provider outside the UK and the EEA, we will use an appropriate transfer mechanism and update this notice.
EU/EEA and Switzerland representative
Rondanini Publishing Ltd is established in the United Kingdom. For individuals in the European Union, the rest of the EEA (Iceland, Liechtenstein and Norway) and Switzerland, we have appointed Data Protection Representative Limited (trading as DataRep) as our data protection representative under GDPR Article 27 and the Swiss FADP. DataRep is an Irish company (number 616588). This appointment is not a UK GDPR Article 27 appointment — UK queries stay with us at info@rondanini.com.
If we have processed or are processing your personal data, you may be entitled to exercise your rights under GDPR or the FADP. You can contact DataRep by:
- email to datarequest@datarep.com, quoting “Rondanini FX Risk Intelligence; 0dB Labs; Orbaos” in the subject line;
- their online form at www.datarep.com/data-request; or
- post to DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland. DataRep also maintains contact locations in each EU member state, Norway, Iceland and Switzerland. Mark postal correspondence “DataRep”, not our trading names, or it may not reach them.
Please do not use DataRep for ordinary service, billing or product questions — those go to info@rondanini.com. How DataRep handles data-subject requests is described in DataRep’s privacy notice.
Your rights
Under UK GDPR / GDPR you may request access, correction, erasure, restriction, portability, and objection where applicable, and you may withdraw cookie consent at any time via Cookie settings. You may complain to the ICO (UK) or your local supervisory authority. EEA and Swiss individuals may also contact DataRep as set out above.
Related
Cookie notice · Legal & source disclaimer · B2B Subscription Terms