LoopOnyx

Data Processing Addendum

Last updated 17 October 2026

This addendum sets out how we process personal data for business customers.

  1. When this addendum applies

    This addendum applies if you are a business and we process personal data on your behalf. If you use LoopOnyx only for yourself as a consumer, the Privacy Policy applies and this addendum does not. If this addendum conflicts with the Terms of Service on a point of data processing, this addendum wins.

  2. Roles

    You are the controller of personal data in the material you submit for the service, such as targets you monitor and personal data inside DMARC reports. We are the processor of that data. We are the controller of account, billing, and security data about you and your users on the account. That data is covered by the Privacy Policy, not by this addendum.

  3. Instructions

    We process personal data as your processor only on your instructions. Those instructions are these terms, this addendum, and the settings you choose in the app. We will tell you if we think an instruction breaks UK data protection law. You confirm that you have a lawful basis for the data you ask us to process. Do not submit special category data. The service is not built for it.

  4. Sub-processors

    We may use the sub-processors listed in the Privacy Policy. We will update that list before a new sub-processor starts this work, and we will change the last updated date. If you object, you may close the account before the change takes effect. We remain responsible for a sub-processor's work under this addendum.

  5. Security

    We use measures appropriate to the service: encryption in transit, encrypted backups, passwords stored as hashes, optional two-factor authentication, and access to the systems that run LoopOnyx limited to what is needed to operate it. The app is hosted by a provider in the United Kingdom. Anyone who handles the data for us is under a duty to keep it confidential. We do not claim a named security certificate on this page.

  6. Breach notice

    If we become aware of a personal data breach that affects personal data we process for you, we will tell you without undue delay and within 72 hours. We will include what we know about what happened, the likely consequences, and the measures we have taken or propose. Where we are the controller, we will also notify the ICO when the law requires it.

  7. Helping you with requests

    We will help you respond to a request from a person about their data, taking into account the export and deletion tools in the app. You can export a JSON copy from the Privacy page. A wider request can be sent to [email protected].

  8. International transfers

    Transfers outside the UK follow the international transfers clause in the Privacy Policy. Where a safeguard is required, it is the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

  9. Deletion at the end

    When the account closes, or when you ask us to stop this processing, you may export a JSON copy first. We then delete the live copy of personal data we hold as your processor, after the 7-day cooling period described in the Privacy Policy. An encrypted backup may still hold a copy until it ages out: 7 daily, 4 weekly, and 6 monthly copies. We may keep a record where the law tells us to.

  10. Information you may ask for

    You may ask once in a 12-month period for a written description of the measures in clause 5. We do not promise an on-site visit. Questions go to [email protected].

  11. Law

    This addendum is governed by the law of England and Wales, and the courts of England and Wales will hear disputes about it.