The Office Management Operating System by The Office Management Group

PRIVACY POLICY

Version 1.0  ·  3 September 2026

1. Who We Are

The Office Management Group Limited ("we", "us", "our") is committed to protecting and respecting your privacy.

This Privacy Policy explains how we collect, use, store and protect personal data in connection with OMOS - the Office Management Operating System - including useomos.com, app.useomos.com and associated OMOS public forms and pages.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller for our own account, billing, support, service and marketing data is:

The Office Management Group Limited
Company number: 10284254
Victoria House, 50 Alexandra Street, Southend-on-Sea, Essex, SS1 1BN
Email: [email protected]
Website: useomos.com

2. What Data We Collect

2.1 Account and registration data

When you create an OMOS account or are added as a user by your organisation, we may collect:

·       Full name

·       Work email address

·       Job title and department

·       Organisation name

·       Authentication credentials managed securely by our authentication provider

·       Account access level and permissions

·       Date of account creation

2.2 Data you enter into the platform

OMOS is an operational platform. Information entered into the system by a customer organisation may include:

·       Staff records - names, job titles, departments, start dates and employment information

·       Visitor records - names, companies, visit times and host details

·       Health and safety records - compliance items, training records, inspections and related records

·       Asset records - asset details, locations, values and related information

·       Supplier and contractor records - company and contact details, contract terms and compliance documents

·       Facilities management records - maintenance schedules, tickets and workplace records

·       Lease and premises data - lease terms, costs and notice periods

·       Budget and financial data - budget categories, actual spend and variance

·       Time-tracking records - activities, categories and hours logged

·       Projects, tasks, comments and related operational records

·       Document uploads - including PDFs, certificates, RAMS documents and images

Where this information is personal data for which the customer organisation determines the purposes and means of processing, the customer is normally the data controller and The Office Management Group Limited processes that data on its behalf as a data processor, subject to the applicable Data Processing Agreement.

2.3 Technical and usage data

When you use OMOS, we may process technical information such as:

·       IP address and browser information

·       Login timestamps and authentication/session information

·       Device and operating-system information

·       Security, error and performance logs

·       Information about use of platform features where generated by the service

2.4 Communications, onboarding and enquiry data

If you contact us, complete an OMOS onboarding/readiness form, make an enquiry or communicate with us about the service, we may collect:

·       Your name and contact details

·       Job title, department and organisation

·       The content of your message or enquiry and any attachments

·       Information supplied in onboarding/readiness responses, including operational requirements and readiness information

2.5 Payment and subscription data

Payments and subscriptions are processed using Stripe. Depending on the checkout or billing process, information may include your name, email address, company, telephone number, billing information, subscription details, payment status and checkout or subscription references.

OMOS does not directly receive or store your complete payment-card details. Stripe processes those details.

2.6 Optional AI-assisted features

OMOS may provide optional AI-assisted features. For the project-breakdown feature, the project title and selected operational area are processed through Replit's AI integration and Anthropic when you choose to use the feature.

Because a project title could contain personal or confidential information, users should not enter special-category personal data or unnecessary personal data into AI-assisted fields or prompts.

3. How We Use Your Data

We use personal data only for legitimate business and service purposes. We do not sell personal data.

4. Data Controller and Data Processor

OMOS can involve different data-protection roles depending on the information being processed:

Where a Data Processing Agreement applies, it governs our processing of customer operational personal data on behalf of the subscribing organisation.

5. Data Storage and Security

5.1 Where data is stored and processed

OMOS uses Supabase and Replit-hosted PostgreSQL infrastructure to store and process account and operational data. Supabase is used for authentication and certain organisation, membership, audit, support and intake records. Replit-hosted PostgreSQL is used for parts of the application's operational data, including projects, tasks, comments, sharing records and account-lifecycle information.

Stripe holds relevant billing and subscription information.

We select service providers and infrastructure with the needs of UK and European customers in mind. Some providers may process personal data outside the UK or EEA. Where this occurs, we use an applicable lawful transfer mechanism or other appropriate safeguards as required by data-protection law.

5.2 Data isolation

Customer data is logically separated by organisation. OMOS uses organisation identifiers, authenticated access controls and role-based permissions designed to prevent one customer from accessing another customer's data.

5.3 Access controls

Access within OMOS is controlled through user accounts and permissions. Customer administrators are responsible for managing access granted to their organisation's users. Access by The Office Management Group personnel is restricted to authorised purposes such as support, security, maintenance and legal obligations, and should be limited to what is necessary.

5.4 Encryption and credentials

Data transmitted to and from OMOS is protected using HTTPS/TLS. Our infrastructure providers apply security controls to stored data in accordance with their service configurations. Authentication credentials are handled through our authentication provider; we do not need to read a user's password in order to provide the service.

5.5 Security incidents

If a personal-data breach occurs, we will assess it in accordance with applicable data-protection law. Where we are required to notify the Information Commissioner's Office or affected individuals, we will do so within the applicable legal timescales. Where we act as a processor, we will notify the relevant customer controller without undue delay in accordance with our contractual obligations.

6. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including contractual, legal, accounting, security and dispute-resolution requirements.

Cancelling a subscription stops renewal at the end of the current billing period but does not by itself immediately delete the workspace. If an authorised account administrator closes the workspace, routine access is revoked and deletion is scheduled after a 30-day safety period. Certain billing, security, fraud-prevention and legal records may be retained for longer where necessary. Encrypted backups expire according to the relevant provider's normal backup-rotation schedule.

Customers should export any information they require before closing a workspace.

7. Sharing Your Data

We do not sell personal data. We share or make data available only where necessary to provide OMOS, operate our business, comply with the law or protect legitimate interests.

7.1 Service providers and sub-processors

The providers relevant to the current OMOS implementation include:

 The precise locations and transfer mechanisms used by providers may change as their infrastructure and our configurations develop. We review material providers and use lawful transfer mechanisms where required.

7.2 Legal requirements

We may disclose personal data where required by law, regulation or court order, or where necessary to establish, exercise or defend legal claims or protect the rights, property or safety of The Office Management Group Limited, our customers or others.

7.3 Business transfer

If The Office Management Group Limited or OMOS is involved in a merger, acquisition, restructuring or sale, relevant personal data may be transferred as part of that transaction subject to appropriate confidentiality and data-protection safeguards.

7.4 Change of purpose

We will normally use personal data only for the purposes for which it was collected. If we need to use personal data for another purpose, we will consider whether that purpose is compatible with the original purpose and, where required, provide further information or identify an appropriate lawful basis.

8. Your Rights

Under UK data-protection law, you may have the following rights in relation to your personal data, where applicable. To exercise a right, contact [email protected]. We normally respond within one month, subject to the circumstances permitted by law.

We may ask for information needed to verify your identity before acting on a request. A fee is not normally charged, although the law permits a reasonable fee or refusal in certain cases involving manifestly unfounded or excessive requests.

If you are dissatisfied with how we handle your personal data or a rights request, you may complain to the UK Information Commissioner's Office (ICO).

9. Cookies and Similar Technologies

OMOS uses cookies and similar browser technologies for authentication, security and application functionality. OMOS does not currently use advertising or behavioural tracking cookies on its public website and does not currently display a cookie consent banner.

The application uses browser local storage for Supabase authentication session state and may use local storage for language, onboarding, interface and housekeeping-related state. A first-party sidebar_state cookie is used to remember the application sidebar display preference for seven days.

Cloudflare Turnstile is used on public forms for bot and abuse protection. Stripe may use its own cookies or similar technologies when a user visits Stripe-hosted checkout or billing pages.

If OMOS introduces non-essential analytics, advertising, conversion tracking, remarketing or other technologies requiring consent, we will implement an appropriate consent mechanism before those technologies are activated.

Further information is provided in our Cookie Policy at useomos.com/cookies.

10. International Data Transfers

Some OMOS service providers operate internationally, including in the United States. Personal data may therefore be processed outside the UK or EEA.

Where personal data is transferred outside the UK or EEA, we use an applicable lawful transfer mechanism or appropriate safeguard as required, which may include UK adequacy regulations, the UK Extension to an applicable data privacy framework, the UK International Data Transfer Agreement or Addendum, or approved contractual safeguards, depending on the provider and transfer.

Customers with specific data-residency or jurisdictional requirements should contact [email protected] before subscribing so that we can determine whether OMOS can meet those requirements.

11. Children's Data

OMOS is a professional business platform intended for use by adults in a workplace setting and is not designed or offered as a service for use by children. OMOS user accounts are intended for users aged 18 or over.

However, organisations using OMOS may occasionally enter limited personal data relating to someone under the age of 18 where this is appropriate for legitimate workplace purposes. For example, this may include a young person undertaking work experience or attending a workplace as a visitor or as part of a workplace event.

Where children's personal data is entered into OMOS, customers are responsible for ensuring that they have an appropriate lawful basis for processing that information, that only information reasonably necessary for the relevant purpose is recorded, and that appropriate safeguards are applied.

OMOS does not knowingly use children's personal data for marketing or profiling purposes.

If you have concerns about children's personal data being held within OMOS, please contact us at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to OMOS, our practices, technology or legal requirements. When we make material changes, we will update the version number and date and, where appropriate, notify affected users. The current version will be made available through the OMOS website.

13. Contact Us

For questions, requests or concerns about this Privacy Policy or how we handle personal data, please contact:

The Office Management Group Limited
Victoria House
50 Alexandra Street
Southend-on-Sea
Essex
SS1 1BN

Email: [email protected]

We aim to respond to data-protection requests within one calendar month, subject to any extensions permitted by law.