Privacy Policy
Important note: This privacy policy applies to visitors from the European Union (EU) and the European Economic Area (EEA) under the General Data Protection Regulation (GDPR). For visitors from other countries, the New Zealand Privacy Act 2020 applies. Further information on the applicable law is in the legal notice.
1. Controller
The controller for the collection, processing and use of your personal data is:
OCENOX LTD
82 The Circle
Manly, Whangaparaoa
0930 New Zealand
Company Number: 9317907
NZBN: 9429052607493
GST: 144-989-368
Limited liability under New Zealand law.
Email: webmaster@ocenox.com
2. Scope
OCENOX LTD is a New Zealand company. As we also provide services to customers in the EU/EEA, we comply with GDPR requirements for EU visitors.
Server location: Our servers are located in Finland (EU). All personal data of EU visitors is processed and stored exclusively within the European Union.
- For EU visitors: GDPR
- For all other visitors: New Zealand Privacy Act 2020
3. Data collected and purpose of processing
When you use this website, we collect the following personal data:
- Technical data: IP address, browser type, operating system, referrer URL, time of access — in the web server logs
- Application data: the details from the Early Access form (see section 5)
- Chat input: your messages to the Onoxia assistant (see section 7)
We do not run web analytics. Neither Google Analytics nor any other audience measurement tool is in use, and there are no advertising or tracking cookies.
4. Legal basis (for EU visitors under GDPR)
Your personal data is processed on the following legal bases:
- Art. 6(1)(b) GDPR (pre-contractual steps and performance): to handle your Early Access application and to provide requested services
- Art. 6(1)(f) GDPR (legitimate interest): for strictly necessary cookies, operational security, spam and abuse prevention
- Art. 6(1)(a) GDPR (consent): for use of the chat assistant, which you trigger yourself by sending a message
For non-EU visitors: New Zealand Privacy Act 2020, based on the Privacy Principles.
5. Early Access application
5.1 Data collected
When you apply for Early Access through the form, we collect:
- Required: salutation, first name, last name, company, country, phone number, email address
- Optional: your message to us
- Automatic: language, IP address, user agent, time of submission
5.2 Purpose
We use this data to review your application, invite you to an introductory call and set up access. IP address, user agent and timestamp additionally serve abuse prevention.
5.3 Spam and abuse prevention
To protect the form we use:
- a limit on submission attempts per IP address
- a security challenge (captcha) generated by us — no third-party service is embedded
- a field invisible to humans that only automated programs fill in
- a check on how long the form took to complete
- an assessment of the content against typical spam patterns
Suspicious submissions are not discarded but flagged with a score and reviewed by hand, so no genuine enquiry is lost.
5.4 Storage and deletion
- Applications are stored while the enquiry is being handled, at most 24 months after the last reply.
- If an application leads to a contract, contractual and statutory retention periods apply.
- Submissions assessed as spam are deleted after 90 days.
- On request we delete your application earlier at any time — an email is enough.
6. Cookies
This website sets strictly necessary cookies only. There are no analytics, advertising or profiling cookies, and therefore no cookie banner.
| Cookie | Purpose | Duration |
|---|---|---|
| noxsphere_one_session | Keeps your session together, such as the chosen language and form input | 2 hours |
| XSRF-TOKEN | Protects forms against forgery by third-party sites | 2 hours |
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation).
7. AI chat assistant (Onoxia)
On this website we use Onoxia, an AI-supported chat assistant by OCENOX. The feature uses language models from Mistral AI (Paris, France) to process your input.
7.1 How it works
Onoxia only becomes active when you start the chat yourself. No data is transmitted to the AI service before your first message. By using the chat you consent to the processing of your input.
7.2 Data processed
- Chat input: your messages in the chat window and the preceding messages of the current conversation
- Language setting: for answers in your language (DE/EN)
- IP address: solely to limit requests per hour, not together with the conversation content
7.3 Processing
- AI provider: Mistral AI, Paris, France (EU) — no data transfer outside the EU
- Storage: conversations are not stored permanently. The history stays in your browser during the conversation and is gone when you close the window.
- Cache: frequently asked questions are cached in shortened form to answer them faster. This cache holds no personal details.
- No profiling: no user profiles are built from chat data.
Note: Onoxia is an AI assistant. Please do not enter sensitive personal data (e.g. passwords, health data, financial data) into the chat.
7.4 Legal basis
Art. 6(1)(a) GDPR (consent through use): processing only takes place through active use of the chat. No cookies are required.
8. Montserrat typeface
This website embeds the Montserrat typeface via Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When a page loads, your browser requests the font file from fonts.gstatic.com, which transmits your IP address to Google.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in consistent presentation). Google may also process data in the USA, on the basis of the EU Standard Contractual Clauses and the EU-US Data Privacy Framework. Google's privacy information: policies.google.com/privacy.
9. Security logging
To defend against attacks we log suspicious requests with IP address, timestamp, requested address and user agent. After repeated failed login attempts, the IP address concerned is temporarily blocked.
- Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the security of our systems)
- Retention: 90 days, then automatic deletion
10. Customer use of the application
This policy covers the website noxsphere.com. For the data that customers process inside the application — contacts, invoices, HR records and so on — the customer is the controller and OCENOX LTD acts as processor. The details are governed by a separate data processing agreement concluded before use.
11. Disclosure to third parties
No disclosure without consent. Exceptions:
- Mistral AI (Onoxia): chat input for AI processing, servers in France (EU)
- Google (typeface): IP address when the font file is requested (see section 8)
- Hosting (Finland): technically necessary
- Email: our own server in Finland (EU)
12. Your rights (EU visitors under GDPR)
- Art. 15 GDPR – access
- Art. 16 GDPR – rectification
- Art. 17 GDPR – erasure ("right to be forgotten")
- Art. 18 GDPR – restriction of processing
- Art. 20 GDPR – data portability
- Art. 21 GDPR – right to object
- Art. 77 GDPR – complaint to a supervisory authority
For non-EU visitors: rights under the New Zealand Privacy Act 2020 (Privacy Principles 6–12).
Contact: webmaster@ocenox.com
13. SSL/TLS encryption
This website uses SSL/TLS encryption, recognisable by "https://" and the padlock symbol in the address bar.
14. Changes
As of: September 2026.
15. Contact
Email: webmaster@ocenox.com
Subject: privacy enquiry