ONRIGHTS
Solicita una evaluación

Legal

Privacy Policy

Last updated: 26 August 2026 · Version 1.2

1. Data controller

The data controller responsible for processing personal data collected through this website is:

OMNIUS LEGAL, LDA, trading as ONRIGHTS
Rua de Santo Cristo 42, 3020-208 Coimbra, Portugal
NIPC 519462270 · VAT PT519462270
Contact: hello@onrights.com

ONRIGHTS operates as a joint venture with the international law firm Ontier.

2. Personal data we process

We process the following categories of personal data:

  • Contact-form submissions: name, email address, company, subject and the content of the message you send us.
  • Technical data: IP address (temporarily, for security and abuse prevention), user-agent, timestamps of requests, referrer.
  • Measurement data (only with your consent): page views, country of visit, aggregate performance signals, and — via PostHog, processed in the European Union — which steps of the enquiry form you complete, a masked replay of how the page responded to your clicks and scrolling, and aggregated heatmaps. Everything you type is masked before it leaves your browser, and the free-text fields of the enquiry form are excluded from recording entirely.

We do not collect special-category data (health, political opinions, etc.).

3. Purposes and legal bases

  • Responding to your enquiry — legal basis: legitimate interest of the controller in replying to a request initiated by you (Art. 6(1)(f) GDPR).
  • Security and abuse prevention — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
  • Analytics — legal basis: your consent (Art. 6(1)(a) GDPR), collected via the cookie banner. You may withdraw consent at any time.

4. Data recipients (processors)

We rely on the following processors, each bound by a Data Processing Agreement under Art. 28 GDPR:

  • Vercel Inc. — hosting and CDN. All servers pinned to the EU region (Frankfurt, fra1).
  • Resend — transactional email delivery of contact-form submissions to our team inbox.
  • PostHog — product analytics, session replay, heatmaps, surveys and error reporting, in the European Union, once measurement consent is granted.

We do not transfer personal data outside the European Economic Area.

5. Retention

  • Contact-form messages: 24 months from the last exchange, then deleted.
  • Server access logs: 30 days.
  • Analytics data: retained by Vercel Analytics per its retention policy (13 months).

6. Your rights

Under the GDPR you have the right to:

  • Access your personal data (Art. 15).
  • Request rectification (Art. 16) or erasure (Art. 17).
  • Restrict processing (Art. 18) or object to it (Art. 21).
  • Data portability where applicable (Art. 20).
  • Withdraw consent at any time (Art. 7(3)).

To exercise any of these rights, write to hello@onrights.com. We will respond within one month.

You also have the right to lodge a complaint with a supervisory authority — in particular the Garante per la protezione dei dati personali (Italy), Comissão Nacional de Proteção de Dados (Portugal), or the authority of your habitual residence.

7. Changes to this policy

We may update this policy from time to time. Material changes will be signalled at the top of this page with a new version number and date.