Privacy notice
Last updated 12 October 2026. Applies to oshylabs.eu, to email you receive from Oshy Labs Ltd, and to enquiries you send us. Product apps have their own notices: Repair and ProfileProof.
This page explains what Oshy Labs Ltd does with personal information when you visit this site, when you contact us, and when we contact a business about our services. It is written to be accurate rather than reassuring.
Who we are
OSHY LABS LTD is a company registered in England and Wales under number 16883720, with its registered office at 100 St Pier Court, 549 Green Street, London E13 9GU, United Kingdom. Oshy Labs Ltd is the data controller for the information described here. Contact: arnold.oshenye@oshylabs.eu.
This website
oshylabs.eu is a static site hosted by Vercel. We do not run analytics, advertising pixels, or tracking cookies on it. The only thing stored in your browser is your light or dark theme choice, which stays on your device. Vercel's servers record standard request logs (IP address, browser type, pages requested) to serve the site and defend it against abuse; Vercel holds those under its own terms.
When you contact us
If you email us, we keep your message and our reply for as long as the conversation and any resulting work is live, then for up to six years for business records. We use it only to answer you and to carry out any work you ask for. We do not add you to a mailing list.
When we contact your business
We occasionally write to small businesses about our automation services. Here is exactly how that works.
- Where the address comes from. We write only to business contact addresses that the firm itself has published on its own website, such as an info@ or enquiries@ mailbox. We do not buy lists and we do not scrape directories.
- What we send. One short email about one specific thing we noticed on the firm's public website, and at most one follow-up. There are no attachments and no tracking pixels.
- Our lawful basis. In the UK and EU we rely on legitimate interests (UK GDPR Article 6(1)(f)) for business-to-business contact, together with the rules for corporate subscribers in the Privacy and Electronic Communications Regulations. Elsewhere we follow the local rule for the recipient's country, for example CAN-SPAM in the United States, CASL in Canada, the Unsolicited Electronic Messages Act in New Zealand, and the Spam Control Act in Singapore.
- What we record. The firm's name, website, the published address, the page we found it on, the date, and what we observed on the public site. Nothing about individuals beyond a name and role where the firm publishes them.
- Opting out. Reply with "no thanks" or "unsubscribe" to any message and we stop. We add the address to a suppression list so it is never contacted again, within 10 business days at most and usually the same day.
- Your right to object. You can object to this processing at any time by emailing arnold.oshenye@oshylabs.eu. We will stop and confirm.
When you become a client
If you engage us for an audit or implementation, we handle the information needed to do that work under a written engagement. Where the work touches your customers' or patients' data, we act as your processor under a data processing agreement, work only inside systems you authorise, and never move regulated data to tools that are not approved for it.
Who else is involved
| Provider | What they handle | Where |
|---|---|---|
| Vercel | Hosting this site; request logs | United States |
| Zoho | Our business email | EU data centre |
| Google Workspace | Documents and calendar | EU and US |
Transfers outside the UK rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses in our agreements with these providers.
How long we keep things
- Outreach records: 12 months from last contact, or until you object, whichever is sooner. Suppression list entries are kept indefinitely so we honour your opt-out.
- Enquiries and correspondence: up to six years for business records.
- Client work: for the term of the engagement plus six years, unless the engagement says otherwise.
Your rights
If you are in the UK or EU you have the right to access, correct, erase, or export your personal data, to restrict or object to processing, and to complain to a supervisory authority. In the UK that is the Information Commissioner's Office at ico.org.uk. Email arnold.oshenye@oshylabs.eu and we will respond within 30 days.
If you are in the United States, Canada, Australia, New Zealand, Singapore, Hong Kong or elsewhere, local law may give you similar rights. The same address works for all of them.
Changes
If we change how we handle data we will update this page and the date at the top.