Privacy notice
Version 2026-09-21-v1 · Last updated 21 September 2026
This notice explains how personal information is handled when you contact Oclas, use the website, request the Oclas advisory profile, request access to an Oclas prototype or provide prototype feedback.
Sheyi N. Lisk-Carew, trading as Oclas
Spitfire Place, Swaislands Drive, Dartford DA1 4HS, United Kingdom
Email: onliskcarew@oclasgroup.com
Information collected
- Contact and professional information, such as your name, work email, role, organisation and region.
- Information you provide about your reason for contacting Oclas or requesting prototype access.
- Prototype administration information, including approval status, sign-in times, confidentiality-term acceptance and security records.
- Feedback you choose to provide about the prototype.
- Synthetic or anonymised evaluation problem records you submit, including problem, evidence, working-diagnosis, proposed-next-action and demonstration job-role fields.
- Basic technical information needed to secure the service, such as a cryptographic hash derived from an IP address. Oclas does not use this to profile testers.
Advisory-profile requests
To download the Oclas advisory profile, you are asked for an email address and can also provide your first name, last name, organisation and country. Country is the information you choose to provide; the profile-download service does not infer your location from your IP address.
Oclas records your submitted details, the request time, the profile version and the source label associated with the link you used. It also records each authorised PDF download request, including repeat requests, the original source label and whether you used the initial page or an emailed return link. These records are held in HubSpot, Oclas’s customer relationship management service, so Oclas can fulfil your request, maintain a proportionate record of requests and downloads and understand which shared links generate interest. The lawful basis is legitimate interests in responding to requests for information about the advisory practice, understanding that interest and protecting the download service.
Requesting the profile does not subscribe you to marketing emails or automatically create a qualified sales opportunity. A request or download is not proof that you have read the profile, and it does not commit you to an engagement. Oclas will respond if you make a separate enquiry.
The website sends the form information to HubSpot from the server. The profile-download page does not load HubSpot’s marketing tracking script. It uses a strictly necessary, secure session cookie to protect the form against forged requests and enable the requested download. The download permission and session expire after 30 minutes.
A confirmation email contains a private return link valid for seven days. Opening that link displays a download page; it does not itself count as a PDF download. To fulfil return visits, the hosting server temporarily keeps your submitted details, the source and edition, the expiry time and a one-way hash of the return token in private storage outside the website directory. Expired records are removed on the next fulfilment request. The email is sent only to the address you provide and does not enrol you in marketing. Keep your private link to yourself: a forwarded link can be used by its recipient, and a forwarded PDF cannot be tracked by this service.
To limit automated misuse, the download service keeps request counts against a keyed hash derived from the requesting IP address. Counts are valid only for the current UTC day and are replaced when the service receives its first form request on a later day. The download service does not store full IP addresses; the website hosting provider may keep standard access and security logs for operating and protecting the hosting service.
Profile-request records in HubSpot are reviewed periodically and deleted when they are no longer needed for these purposes, unless an ongoing relationship or legal requirement justifies keeping them. You can ask about your record, request deletion or object to this use of your information by emailing onliskcarew@oclasgroup.com. See “Your rights” below.
Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and assessing prototype-access requests | Legitimate interests in operating and developing the Oclas practice and, where relevant, taking steps at your request before an engagement. |
| Administering approved access and recording confidentiality/evaluation terms | Performance of the evaluation agreement and legitimate interests in protecting the prototype and intellectual property. |
| Securing the website, detecting misuse and revoking access | Legitimate interests and compliance with applicable data-protection security obligations. |
| Reviewing prototype feedback and contacting testers who request follow-up | Legitimate interests in improving the prototype. Where you ask for follow-up, Oclas uses the information to respond to that request. |
| Capturing evaluation problem records, assigning them to a demonstration job-role queue and sending confirmations to the raiser and Oclas administrator | Performance of the evaluation agreement and legitimate interests in testing the workflow, maintaining an audit trail and assessing the prototype. |
Providing information is voluntary, but required fields are necessary to assess access or operate the requested prototype workflow. Oclas does not use prototype data for solely automated decisions that produce legal or similarly significant effects.
How the information is protected
The Oclas prototype uses HTTPS to encrypt information in transit. Tester contact details, professional details, intended-use information and written feedback are encrypted in the portal database. Access codes and first-visit tokens are stored as one-way hashes. Administrative access is restricted and approved-user status is checked on each visit so access can be withdrawn immediately.
Submitted problem records are encrypted in the portal database. Confirmation emails to the raiser and Oclas administrator may contain the submitted evaluation fields. Assignment to a job role is illustrative and is recorded in the demonstration workflow; it does not email, instruct or legally assign work to another person. Email delivery is handled by Oclas’s email provider, so no confidential, client-identifying or commercially sensitive information should be submitted.
Before submission, the “New problem” screen creates a preview in your browser. If you submit the record, the problem, evidence, working hypothesis, proposed next action and demonstration role are stored in the encrypted prototype database so that Oclas can administer the evaluation and review how the workflow is used.
You must use only synthetic or fully anonymised information. Do not enter confidential, personal, client-identifying, safety-critical or commercially sensitive information. The prototype is an evaluation environment and is not a production record system.
Sharing and international processing
Oclas uses service providers for website hosting, email and meeting scheduling, and HubSpot for managing contact and advisory-profile request records. They process information only where needed to provide those services. Some providers may process information outside the United Kingdom. Where required, Oclas will use an appropriate transfer mechanism or other safeguard.
Personal information is not sold. It may be disclosed where required by law or where reasonably necessary to establish, exercise or defend legal rights.
Retention
- Unapproved prototype-access requests are normally retained for no longer than six months.
- Approved tester profiles and feedback are normally retained for up to 24 months after the last relevant activity, unless a longer period is needed for an active relationship or legal requirement.
- Evaluation problem records and associated routing details are normally retained for up to 24 months after submission.
- Records evidencing acceptance of confidentiality and evaluation terms may be retained for up to six years after access ends where reasonably necessary to establish, exercise or defend legal rights.
- Security records are kept only for as long as reasonably necessary to protect the service.
Cookies
The prototype uses strictly necessary, secure cookies to keep approved testers and administrators signed in. These cookies are not used for advertising. If you choose an external meeting-booking link, the external provider’s own privacy and cookie information applies.
The advisory-profile download service also uses a strictly necessary, secure session cookie for form security and download permission, as explained in Advisory-profile requests. This session expires after 30 minutes and is not used for advertising or tracking visits across websites.
Your rights
Depending on the circumstances, you may have rights to access, correct, erase or restrict use of your information, object to processing, or receive information in a portable format. To exercise a right, contact onliskcarew@oclasgroup.com. Oclas may need to verify your identity before acting on a request.
If you are outside the United Kingdom, local data-protection law may provide additional rights. Oclas will consider any applicable requirement when responding to a request.
You may complain to the UK Information Commissioner’s Office at ico.org.uk. Please contact Oclas first where possible so the concern can be addressed promptly.
Changes to this notice
This notice may be updated as the prototype and Oclas systems develop. The current version and date will always appear at the top of this page. A material change affecting approved testers may require a renewed acknowledgement.