Privacy Policy

This policy explains what personal data we process when you use renx-management.com (the "Site"), why, and what rights you have.

26 October 2026: We added §6A about people we contact about our services and replaced provider names with specific categories. The provider-name changes do not change how we process data.

1. Who is responsible

The controller for the Site is RenX Management Ltd, registered with Companies House in England and Wales under company number 12799055. Registered office: 124 City Road, London EC1V 2NX, United Kingdom. ICO registration reference: ZC177426. Business address: Leo-Leistikow-Allee 4, 22081 Hamburg, Germany.

Privacy questions, requests and complaints: privacy@renx-management.com

We apply the UK GDPR and the Data Protection Act 2018, the EU GDPR and, for people in Switzerland, the Swiss Federal Act on Data Protection (FADP).

2. In short

• We process what you choose to send us (a message, a newsletter signup, a conversation with Io, a booking), plus the technical data needed to deliver the Site.
• We sometimes contact people at businesses we think may be interested in our services, one to one, using business details from public sources (§6A).
• With your consent only, we use Google Analytics to understand how the Site is used. It's off unless you agree, and you can change your choice at any time under Cookie settings.
• We don't sell your data or use it for personalised advertising.
• Our application and database are hosted in Frankfurt, and our media storage is kept in the EU. Delivery networks and some service providers process data outside the UK and EEA, including in the United States (§§11–12).

3. Visiting the Site

When you visit the Site, your browser sends technical data: IP address, browser and device type, the page requested, the referring page and the time. Our hosting provider processes it to deliver the Site. Video, media and article PDFs are delivered from our media storage provider. Our hosting provider keeps application runtime logs for no longer than 30 days and may keep limited service and security records as an independent controller. Our media storage provider processes delivery logs on our behalf under its data processing agreement. It keeps that data while needed to perform the agreement and, when the service or agreement ends, must delete or return it, except where the law requires it to be kept. If we need a log to investigate a security incident or a legal claim, we keep a copy only until that need ends.

To limit abuse of our forms and of Io, we count requests against hashed identifiers: your IP address and, for newsletter requests, your email address. The counters apply over short time windows, and older counters are removed during routine cleanup. That can take longer when traffic is low. This counter store doesn't keep the raw identifiers.

Legal basis: our legitimate interest in delivering a secure, working Site and preventing misuse (Art. 6(1)(f)).

4. Cookies and similar technologies

Some technologies store or read information on your device.

Necessary: your cookie choice. A cookie remembers whether you accepted or rejected optional cookies, so we don't ask on every page. It doesn't enable analytics. It lasts 12 months; then we ask again.

Services you use. Services supporting the Site, such as Io when you start a conversation, may use cookies or browser storage where their function needs it. You can manage cookies and browser storage in your browser settings. Blocking storage a service needs may affect how it works.

Optional: Google Analytics. This is off unless you agree:

On your first visit, we ask whether you accept optional cookies. You can accept or reject; rejecting, or closing the banner, leaves analytics off and doesn't affect your use of the Site. You can change or withdraw your choice at any time via Cookie settings at the bottom of every page. If you withdraw, we stop Google Analytics and delete its cookies from your browser. This doesn't delete data already sent; see §5 for how long it's kept, and §14 for your rights. We ask again when your choice expires, or earlier if we change how we use these technologies.

When you make or change a choice, we record it with a random reference number, the choice, the time and the version of the banner and this policy you saw. We use this record only to demonstrate your choice. It contains no name, email address, IP address or browsing data, isn't linked to Google Analytics, is stored in our database (Frankfurt), and is deleted 12 months after that choice expires or is replaced.

Legal basis: the cookie-choice cookie — strictly necessary to respect your choice (PECR reg. 6(4); § 25(2) no. 2 TDDDG) and our legitimate interest in doing so (Art. 6(1)(f)). Google Analytics — your consent (PECR reg. 6; § 25(1) TDDDG; Art. 6(1)(a)). Consent records: our obligation to demonstrate consent (Art. 7(1)) and our legitimate interest in doing so (Art. 6(1)(f)).

5. Analytics

Google Analytics (only with your consent) helps us understand visits, how visitors find the Site, campaigns, and actions such as enquiries, newsletter signup requests and PDF downloads. It records:

• the pages you view, and the website you came from (its address, not the full page)
• campaign codes in links
• your approximate location, which Google estimates from your IP address
• device and browser information
• whether an enquiry submission was accepted, a newsletter signup was requested, or a PDF download link was used

A random identifier in the _ga cookie recognises your browser across visits.

Google Analytics doesn't receive your name, email address, form or Io conversation content, or newsletter links. Google states that it uses IP addresses to estimate location and then discards them, and doesn't log or store them for users in the UK and EU. We use Google Analytics with Google Signals, advertising features and optional data sharing switched off, so it isn't used for personalised advertising. How Google uses information from sites that use its services.

The provider is Google Ireland Limited, which processes Analytics data on our behalf. Google may process data in the United States (§12). User-level and event-level Analytics data is subject to our 2-month retention setting and Google's scheduled deletion process. That setting doesn't govern standard aggregated reports.

Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time under Cookie settings. Withdrawal doesn't affect measurement already carried out.

6. Contacting us

If you use the contact form or email us, we receive your name, email address, organisation (optional), topic and message. The contact form emails your message to our inbox through our email delivery provider; it isn't stored in the Site's database. We use your details to reply and, if a project follows, to prepare and carry out the work.

Legal basis: our legitimate interest in responding to business enquiries (Art. 6(1)(f)). Where you personally are a prospective client, steps you've asked us to take before a contract (Art. 6(1)(b)).

6A. People we contact about our services

Sometimes we contact people at businesses and organisations we think may be interested in our services, before they have contacted us.

Where we get your details: from public sources, such as your organisation's website, professional registers, press coverage, job adverts and your public professional profile. We may also use a business-contact database to find or check a business email address.

What we hold: your name, job title, organisation, business contact details, notes about why we think our services may be relevant to your organisation, and a record of when and how we contacted you and how you responded. We don't collect private or sensitive information.

Why and on what basis: to contact you about services relevant to your role. UK and EU: our legitimate interest in business-to-business marketing (Art. 6(1)(f)). Switzerland: the FADP. We only send individual, personally written messages, never bulk campaigns, and we don't send electronic marketing where the rules require prior consent and we don't have it.

Who processes it for us: our business email provider, our CRM provider, a business-contact database provider and AI assistant providers that help with research and drafting (§11). Some are based in, or process data in, the United States, with the safeguards in §12. If you ask, we'll tell you which specific providers hold your data.

How long we keep it: we review it at least every six months. If there's no ongoing conversation, we delete it. If you ask us not to contact you again, we keep a minimal record so we can respect that.

Your rights: you can object at any time, without giving a reason, and we'll stop contacting you. Just reply "no thanks" or write to privacy@renx-management.com. Your other rights are in §14.

7. Conversations with Io

Io is an AI assistant. Our conversational AI provider processes your messages and, when you choose voice, microphone audio to provide the conversation. An AI language-model provider processes conversation content to generate replies and extract enquiry details. Voice is processed during the session; audio recordings aren't saved. Typing doesn't require microphone access. Please share only the information needed for your enquiry or booking, and avoid confidential or sensitive information.

AI language-model providers process conversation text to generate replies, through our account for Io's primary model and through our conversational AI provider's managed integrations for some booking steps. Through our conversational AI provider, an AI language-model provider processes written conversations after they finish to extract enquiry details for our follow-up. Depending on the conversation step, our conversational AI provider may also send conversation text to configured backup models from AI language-model providers if an integrated model is unavailable.

RenX uses written conversation records to respond to enquiries and review service quality. A business enquiry can generate an internal email briefing for RenX, including the contact details and business context you provide. Our email delivery provider processes that email for delivery. This internal briefing is separate from any optional recap sent to you. A recap to you needs a separate check of your email address and your explicit permission. Agreeing to a booking doesn't authorise a recap or a newsletter subscription.

If you ask to book an introductory conversation, our booking provider and our calendar provider process the agreed name, email address, meeting time, timezone and relevant enquiry details. Our video-meeting provider supplies the meeting link. Io checks availability without exposing other people's appointment details. A recap email isn't a calendar invitation.

Our hosting provider hosts the application and its scheduled processing. Our database stores temporary email-queue content and operational records, and our separate website archive of written Io conversations. The archive contains conversation text, summaries and enquiry analysis; it does not store audio.

Our conversational AI provider is configured to delete written transcripts and associated personal data after 90 days. Our separate website archive is also scheduled for deletion 90 days from the start of each conversation. These are configured deletion schedules, not a claim that every record has already reached its deletion date. Our email queue erases recipient and message content after successful sending, exhausted retries or expiry, with cleanup scheduled within 24 hours. Deleting it from this queue doesn't delete copies held by email providers or already received in an inbox, or calendar records held for your appointment.

We keep content-free operational records to prevent duplicate emails and bookings. They include pseudonymous conversation identifiers or hashes, timestamps and delivery or attempt status. They have no automatic expiry while needed to prevent replay. They're separate from the 90-day transcript schedule and don't keep email bodies, recipient addresses or audio.

Legal basis: our legitimate interests in responding to enquiries, arranging calls and improving our responses (Art. 6(1)(f)). Where you personally are a prospective client, steps you've asked us to take before a contract, including booking a call (Art. 6(1)(b)). Your consent for the recap email (Art. 6(1)(a)), which you can withdraw at any time.

8. Newsletter

If you subscribe, we store your email address and a record of your consent: the wording you agreed to, the version of this policy shown to you, where on the Site you subscribed and when, and records of the confirmation email. Your subscription starts only after you click the link in that email (double opt-in). Our email delivery provider sends our emails.

You can unsubscribe using the link in each newsletter, or by emailing privacy@renx-management.com. If an unsubscribe link doesn't work, email us at that address.

After you unsubscribe, we keep your opt-out record and the evidence of your subscription and consent, so we can respect your choice and show how we handled it. Retention periods are in §13.

Legal basis: your consent (Art. 6(1)(a)). Keeping consent and opt-out records: our obligation to be able to demonstrate consent (Art. 7(1)) and our legitimate interest in respecting your opt-out and handling any claims (Art. 6(1)(f)).

9. What you need to provide

You don't have to send an enquiry, use Io, subscribe or accept optional cookies. To submit the contact form, we need the fields marked as required; organisation is optional. We need an email address to send you a newsletter or recap, and your name, email address and the agreed appointment details to arrange a booking. Without them we can't complete that request. None of these details is required by law.

10. Our LinkedIn and X profiles

The Site links to our profiles on LinkedIn and X. These are plain links: nothing is loaded from those platforms until you click. On the platforms, their own privacy policies apply.

For our LinkedIn company page, LinkedIn provides us with aggregated statistics about visitors ("Page Insights"). We use them to understand our audience, based on our legitimate interest (Art. 6(1)(f)). LinkedIn Ireland and RenX are joint controllers for this processing under LinkedIn's Page Insights Joint Controller Addendum, which gives LinkedIn primary responsibility. You can exercise your rights with LinkedIn or with us.

11. Who receives your data

We share personal data where needed for the purposes described here, including with the following service providers. They process it on our behalf, either directly or through another provider such as our conversational AI provider. Some also process limited data, such as account and security data, as independent controllers under their own terms.

We may also share data with professional advisers bound by confidentiality, with authorities where the law requires it, and with a buyer or successor if our business is reorganised or sold. If you'd like to know which specific providers process your data, email privacy@renx-management.com and we'll tell you.

12. Transfers outside the UK and EEA

Our service providers may process personal data outside the UK and European Economic Area, including in the United States. Their published processing terms describe safeguards for international transfers, including Standard Contractual Clauses and, where applicable, the UK Addendum or other applicable UK transfer provisions. Our booking provider states that its international processing relies on Standard Contractual Clauses or an applicable adequacy mechanism. Contact privacy@renx-management.com for information about the arrangements that apply to your data and how to get a copy of the safeguards.

13. How long we keep data

We keep personal data only as long as needed for the purposes described here or to meet legal obligations.

14. Your rights

You have the right to:

• access the personal data we hold about you
• have it corrected
• have it deleted, or its use restricted, in certain circumstances
• receive it in a portable format (data portability)
• withdraw consent at any time, where we rely on consent (for cookies, via Cookie settings). This doesn't affect processing before you withdrew.

To use your rights, email privacy@renx-management.com. We'll respond within one month, and may first ask you to confirm your identity.

Your right to object. Where we rely on our legitimate interests (Art. 6(1)(f)), you can object at any time for reasons arising from your particular situation. We'll then stop, unless we have compelling legitimate grounds that override your interests, or need the data for legal claims. You can object to direct marketing at any time, without giving reasons.

15. Complaints

To complain about how we handle your personal data, email privacy@renx-management.com. We'll acknowledge your complaint within 30 days, investigate it, keep you informed and tell you the outcome without undue delay.

You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority where you live, work, or where the alleged infringement took place; in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC/EDÖB). You don't have to contact us first.

16. Children

The Site and our services aren't directed at anyone under 16. If you think we've collected a child's data inappropriately, contact us so we can review it and take appropriate action.

17. Automated decisions

We don't make decisions with legal or similarly significant effects on you based solely on automated processing, including profiling. Io answers questions and helps arrange calls; it doesn't make decisions about you.

18. Security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections, access controls and data minimisation. No system is completely secure.

19. Changes to this policy

We update this policy when the Site or the law changes, and the date at the top shows the current version. We'll tell you about material changes to how we use your data, and seek fresh consent where required.