Data Controller
| Data Controller | Expatrict Limited |
|---|---|
| Trading Name | Oxyjyn (oxyjyn.com) |
| Registered Address | England and Wales |
| Contact Email | hello@oxyjyn.com |
| ICO Registration | ZC100678 |
| Governing Law | UK GDPR, Data Protection Act 2018, Data (Use and Access) Act 2025 |
| Last Updated | May 2026 |
1. Who We Are
Oxyjyn is operated by Expatrict Limited, a company incorporated in England and Wales. Oxyjyn is a community platform built for immigrants, providing guides, discussions, and peer support across immigration, housing, finance, jobs, healthcare, education, and family circles.
2. What Data We Collect
| Data Category | What We Collect | Lawful Basis | Retention |
|---|---|---|---|
| Account Data | Name, email, country of origin, UK hub, profile details | Contract | Account lifetime + 12 months after deletion |
| Content Data | Posts, comments, questions, guides read | Contract | Account lifetime; moderation copies up to 6 months |
| Gamification Data | OXY number, rank, points, streak, referrals | Contract | Account lifetime |
| Technical Data | IP address, browser, device and session signals | Legitimate interests (security) | 12 months rolling |
| Usage Data | Aggregate interactions and page usage patterns | Analytics exception (DUAA 2025) | 90 days rolling aggregate |
| Communications & Compliance | Support emails, complaint records, moderation and safety logs | Legal obligation / legitimate interests | Up to 3 years |
We do not intentionally collect special category data under Article 9 UK GDPR and do not run automated decision-making with legal or similarly significant effects.
3. Why We Use Your Data
3.1 To Provide the Platform
We use account data to create and maintain your account, authenticate sessions, display your profile and community rank, and enable posting, commenting, and engagement.
3.2 To Keep the Platform Safe
Under the Online Safety Act 2023, we moderate reports, investigate harmful or illegal content patterns, keep moderation records, and respond to lawful requests.
3.3 To Improve the Platform
We use aggregated analytics to improve performance and usability. Under the Data (Use and Access) Act 2025 analytics exception, this does not require consent where data is aggregate and not used for individual profiling.
3.4 To Communicate With You
We send activity-triggered notifications and optional digest emails. You can manage email preferences from your profile settings.
3.5 To Meet Legal Obligations
We retain and process data where required by law, including cooperation with courts, regulators, and law enforcement.
4. Lawful Bases
- Contract: Necessary to deliver Oxyjyn services.
- Legal obligation: Required by applicable legal duties.
- Legitimate interests: Security, fraud prevention, technical reliability.
- Analytics exception (DUAA 2025): Aggregate analytics without profiling.
- Consent: For any future processing not covered above.
5. Who We Share Data With
We do not sell, rent, or trade personal data. We may share data with vetted processors (e.g., hosting, email delivery, technical monitoring) under data processing agreements, and where legally required.
For international transfers, we apply appropriate safeguards required by UK GDPR.
6. Security
- Encryption in transit (TLS)
- Encryption at rest
- Access control and least-privilege practices
- Security monitoring and incident response
Where required, qualifying breaches are reported to the ICO within statutory timelines.
7. Your Rights
| Right | What It Means |
|---|---|
| Access | Request a copy of personal data we hold. |
| Rectification | Correct inaccurate or incomplete information. |
| Erasure | Request deletion, subject to legal retention obligations. |
| Restriction | Ask us to limit processing in specific cases. |
| Portability | Receive data in a structured, machine-readable format. |
| Object | Object to processing based on legitimate interests. |
| Complain | Complain to the ICO: ico.org.uk. |
To exercise rights, email hello@oxyjyn.com with subject: Data Rights Request.
8. Children
Oxyjyn is not directed at children under 18. If you believe a child account exists, contact us and we will investigate and remove data where appropriate.
9. Retention
- Profile and personal data: deleted after account closure timelines.
- Safety/moderation records: retained as legally required.
- Anonymised aggregate data: may be retained longer where no identification is possible.
10. Changes to This Policy
We review this policy at least annually and update it when legal or operational changes require. Material updates are announced on-platform and/or by email.
11. Contact
Company: Expatrict Limited (trading as Oxyjyn)
Email: hello@oxyjyn.com
ICO: ico.org.uk | 0303 123 1113