Privacy Policy

Last updated: 15 October 2026

This policy explains how OneDocx collects and uses personal information when you visit onedocx.com, contact us, book a call, ask for a quote, download our checklist, receive a message from us, or become a client. It also explains how we handle information we may see when we work inside your Microsoft 365.

Who we are

OneDocx is a trading name of Momin Solutions Ltd, a company registered in England and Wales, 1 Hartley Avenue, East Ham, London E6 1NU, United Kingdom, and Momin Sol LLC, a Texas limited liability company, 5900 Balcones Drive #STE 100, Austin, TX 78731, United States (“we”, “us”).

UK and European visitors, prospects and clients: Momin Solutions Ltd is the controller of your personal data.
US, Canadian and all other visitors, prospects and clients: Momin Sol LLC is responsible for your information.
The two companies share information with each other where needed to answer your enquiry or deliver our services, and both follow this policy.

Two different roles

We handle personal information in two ways:

As a business in our own right (controller): information about visitors to our website, people who contact us or whom we contact, and the people who work at our client businesses. Most of this policy is about this role.
On behalf of our clients (processor or service provider): files, lists, emails and other information stored in a client’s Microsoft 365 that we may see while we work on it. See “When we work in your Microsoft 365” below.

What we collect

Information you give us: your name, business name, role, email, phone number, country, website, your Microsoft 365 plan and number of users, and anything you write or upload in our forms, chat, WhatsApp, email or during a call.
Booking information: the time you choose for a call or Health Check and the answers you give when booking.
Communication records: emails, messages, call notes and your marketing preferences, including any opt-out.
Client information: if you become a client, contract, billing and support details. Card and bank details are entered on our payment provider’s secure page, and we do not store full card numbers.
Technical information: your IP address, browser, device, the pages you visit, and information stored in your browser (see “Cookies” below).

Where we get information from

Most information comes from you. We may also collect business contact details about people who work at businesses we think could benefit from our services, from public and professional sources such as business websites, business directories, LinkedIn and public help forums where someone has asked for SharePoint or Microsoft 365 help. This is typically a name, job title, business email or phone number and the business’s website. We use it only to send a short, relevant introduction, always with a clear way to opt out.

How we use it

To reply to your enquiry, hold calls, run Health Checks and send quotes.
To send you the checklist or information you asked for and, where you have agreed or the law allows, occasional emails about SharePoint and Microsoft 365.
To contact businesses that may benefit from our services, as described above.
To provide our services if you become a client, including project work, billing and support.
To keep our website and systems secure, understand how they are used and improve them.
To meet legal, tax and accounting obligations, and to handle disputes.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Legal bases (UK and European visitors)

Under UK GDPR (and the EU GDPR where it applies) we rely on:

Consent: for marketing emails to personal or sole-trader addresses, marketing text and WhatsApp messages, and any analytics or other non-essential cookies. You can withdraw consent at any time.
Contract: to take steps you ask for before becoming a client (such as a Health Check or quote) and to deliver our services.
Legitimate interests: to reply to business enquiries, keep our website secure, and contact businesses about services relevant to them. We only send unsolicited marketing emails to corporate business addresses, as the Privacy and Electronic Communications Regulations allow, and every email lets you opt out. You can object at any time.
Legal obligation: for accounting, tax and similar records.

Text messages and calls

If you give us your mobile number and agree to be contacted, we may call or text you about your enquiry or booking. Message frequency varies. Message and data rates may apply. Reply STOP to any text to opt out, or HELP for help. You can also email [email protected].

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the sharing described in this policy excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Who we share it with

We do not sell your personal information. We share it only with service providers who help us run our business, under contracts that require them to protect it, and only as much as they need:

HighLevel, Inc. and its affiliate LeadConnector LLC (GoHighLevel): our CRM, forms, booking calendar, chat and email platform. HighLevel uses its own sub-processors, including cloud hosting, calling, SMS, email and payment providers, and publishes its list at gohighlevel.com/sub-processors.
Microsoft: for our email, Microsoft Teams calls and files.
Meta (WhatsApp), if you message us on WhatsApp.
[Website host] and Cloudflare, which host and protect this website.
Google: Google Fonts loads the fonts on this website (Google receives your IP address when fonts load), and Google Analytics, only if you accept analytics cookies.
Stripe and our banks, to invoice and take payments from clients.
Our accountants, lawyers and insurers, where needed.
Our two companies, Momin Solutions Ltd and Momin Sol LLC, and our staff and contractors, including members of our delivery team outside the UK and US, all under confidentiality obligations.

We may also share information if the law requires it, to protect our rights, or with a buyer if our business is sold (in which case this policy will continue to apply).

International transfers

We work across the UK and the US, our delivery team includes people in other countries, and some of our providers store data in the United States. When personal data leaves the UK or Europe, we make sure an appropriate safeguard is in place, such as the UK International Data Transfer Agreement or Addendum and EU Standard Contractual Clauses, or the EU–US Data Privacy Framework and its UK Extension where the recipient is certified. You can ask us for details.

How long we keep it

Enquiries, quotes and prospect details: up to 24 months after our last contact with you, unless you ask us to delete them sooner.
Checklist and email subscribers: until you unsubscribe.
Opt-outs: if you ask us not to contact you, we keep a minimal record (such as your email or number) on a suppression list so that we do not contact you again.
Client and financial records: for as long as the law requires, usually 6 years after the end of the financial year in the UK, and similar periods in the US.

Your rights

Depending on where you live, you can ask to access, correct or delete your information, receive a copy of it, object to or restrict how we use it (including objecting to direct marketing at any time), and withdraw consent. Residents of some US states and of Canada have similar rights, including the right to know what we hold and to ask us to delete it. We do not sell personal information or share it for cross-context behavioural advertising.

Email [email protected]. We will respond within one month (or the time your local law allows), and we may need to confirm your identity first.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. If you are in the UK you can also complain to the Information Commissioner’s Office (ico.org.uk), and in the EU to your local data protection authority.

When we work in your Microsoft 365

When a client gives us access to its Microsoft 365, the client is responsible for the information stored there (it is the controller), and we act on its behalf and only on its instructions, under our written agreement. We:

use a named account the client creates for us, with the least access the work needs and multi-factor sign-in;
look at settings and access rather than the content of documents, unless the work needs it and the client agrees;
do not copy client files outside the client’s Microsoft 365;
tell the client without delay, and within 48 hours at most, if we suspect a problem affecting its data;
remind the client to remove our access when the work is done.

If you are an employee or customer of one of our clients, please contact that business about your information. If you contact us instead, we will pass your request to it.

Cookies and similar technologies

Our website picks a currency (US $ or UK £) from your device’s time zone. This happens in your browser and is not sent to us. If you switch currency, we store your choice in your browser so the prices you see stay the same. This is needed for the feature you asked for, so it does not need your consent.

Our booking calendar, forms and chat are provided by HighLevel and may store small amounts of information in your browser to make them work. We use analytics cookies (Google Analytics) only if you accept them in our cookie banner, and you can change your choice at any time from the cookie settings link on every page.

Security

We protect your information with access controls, strong passwords and two-factor authentication, least-privilege access for staff, and the security controls of our providers. No system is completely secure, so if we become aware of a breach that affects you, we will tell you and the regulator where the law requires.

Children

Our website and services are for businesses. They are not aimed at children, and we do not knowingly collect information from anyone under 16.

Changes

We may update this policy. The date at the top shows when it last changed, and we will tell clients about significant changes by email.