The data controller is OneKeyCo — Michele Milazzo (sole proprietorship / ditta individuale), reachable at info@onekeyco.com.
When you use the contact form on this website, we collect:
We also collect technical data automatically: IP address, browser type, pages visited, and timestamps — for security and performance monitoring purposes.
Where our clients choose to connect a bank account through our banking and administrative services, we process bank account information via Stripe Financial Connections, strictly with the account holder's consent. This may include:
Legal basis: the connection is based on the account holder's explicit consent, which can be withdrawn at any time; processing is carried out for the performance of the service contract and, for fraud prevention and reconciliation, our legitimate interest.
We do not use this data for credit scoring or creditworthiness assessment, nor do we share it with unauthorised third parties.
Retention: bank account data is kept only for as long as necessary for the purposes above and is deleted when the connection is revoked or the service ends, unless a longer period is required by law (e.g. accounting obligations).
This data is processed through Stripe, our payment and open-banking provider, under their terms and privacy policy.
Where a client chooses to connect their Google (Gmail) mailbox through our onboarding service, we access it only with the user’s explicit consent granted through Google OAuth, and strictly to:
We request the gmail.modify scope (read and send, excluding permanent deletion of messages). We do not read, send or delete anything beyond the purposes above.
Limited Use. OneKeyCo’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically: we use Google user data only to provide and improve the features described above; we do not transfer it to others except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition; we do not use it for advertising; we do not use it to train generalised or non-personalised AI/ML models; and we do not allow humans to read it unless we have the user’s explicit consent, it is necessary for security or to comply with the law, or the data is aggregated and anonymised.
Legal basis & retention: explicit consent, withdrawable at any time from the user’s Google account or by asking us to disconnect. We store only an OAuth refresh token to keep the connection active; message content is read on demand and is not retained beyond what is needed to display and act on the relevant application. The connection and token are removed when the user revokes access or when the service ends.
Contact form submissions are retained for up to 24 months or until you request deletion. Technical logs are retained for up to 90 days.
We do not sell or share your personal data with third parties for marketing purposes. Data may be shared with:
Under the GDPR and applicable national law, you have the right to:
To exercise your rights, contact us at info@onekeyco.com.
For detailed information on the cookies we use, see our Cookie Policy.
← Back to site