REONEX Referral Portal Privacy Notice
Version: 0.1
Effective date: TODO(JAMIE) — set on approval
Status: ⚠️ DRAFT — NOT APPROVED. Rebranded from the inherited document on 30 October 2026.
Not reviewed by a solicitor or a data-protection adviser. PORTAL_DOCUMENTS_APPROVED remains
false, so partner registration is rejected until this is approved.
TODO(JAMIE): confirm REONEX's ICO registration. This notice describes a controller processing partner and referred-contact personal data at scale, including financial records. Most UK organisations doing that owe the ICO data protection fee and must be on the register. No registration number is published on reonex.co.uk and none could be verified here. If REONEX is registered, add the number below. If it isn't, that needs sorting before this portal collects a single partner record.
1. Who we are
Reo Group Ltd, trading as REONEX (REONEX, we, us or our), is the controller of personal information handled through the referral programme and referral portal.
Company number: 14840484
Registered office: 521 Thornton Road, Bradford, West Yorkshire, BD8 9RB, England
VAT number: 441639200
ICO registration number: TODO(JAMIE)
Email: enquiry@reonex.co.uk
Telephone: 0333 344 9588
This notice explains how we use information about:
- people who apply to become referral partners;
- approved, rejected, suspended and former referral partners;
- people and business contacts referred to us;
- REONEX staff and authorised users who administer the programme; and
- people who communicate with us about a referral, commission or payment.
It supplements the main REONEX website privacy policy at https://reonex.co.uk/privacy-policy/ where you use the referral portal. TODO(JAMIE): the two should be read together and kept consistent — the website policy was last updated 6 May 2025 and does not mention the referral portal, partner commission records or partner bank details.
2. Information we collect
Depending on your relationship with us, we may collect:
Partner and applicant information
- name, business name, address, email address and telephone number;
- account status, email-verification status and login history;
- information supplied for partner vetting and approval;
- relevant publicly available business or professional information checked during vetting;
- accepted Terms version, acknowledged Privacy Notice version, timestamps and related evidence;
- referral submissions, communications, support requests and portal notifications;
- commission, statement, invoice, VAT and payout records;
- invoices containing bank-transfer details;
- security information such as IP address, device/browser information, session records, MFA status and security events; and
- audit records of important account and financial actions.
Referred contact information
- name, job title and organisation;
- business contact details;
- information about the contact's relationship with the partner;
- the business services or problems relevant to the introduction;
- referral status, communications and appropriate progress notes; and
- information generated if the referral becomes a customer relationship.
Partners must not submit passwords, credentials, unnecessary financial information, special-category information, criminal-offence information or unrelated personal details about a referred person.
Staff-user information
- identity and work contact details;
- role and permissions;
- invitation, verification and MFA status;
- login and security history; and
- actions recorded in operational and audit logs.
3. Where information comes from
We obtain information:
- directly from partners, applicants, referred contacts and staff users;
- from a referral partner who introduces a business contact;
- from portal activity and the systems used to operate and secure it;
- from REONEX's existing customer, sales and finance records;
- from publicly available business sources used for proportionate partner vetting or duplicate checks; and
- from service providers that deliver hosting, email, security and related functionality.
Where we receive a referred person's information from a partner, we will provide appropriate privacy information within a reasonable period and, where we contact that person, no later than our first communication unless a lawful exception applies.
4. Why we use information and our lawful bases
We use personal information only where we have an identified purpose and lawful basis.
| Purpose | Typical lawful basis |
|---|---|
| Create an account, consider an application and administer programme membership | Taking steps at your request before entering a contract; performance of the Referral Programme Terms; and legitimate interests in operating a trustworthy referral programme |
| Verify applicants and prevent duplicate, fraudulent or abusive accounts | Legitimate interests in protecting REONEX, partners, prospects and the programme |
| Receive, assess and progress referrals | Performance of the partner agreement for partner data; legitimate interests of REONEX, the partner and the referred business in considering a relevant business introduction for referred-contact data |
| Contact a referred business about the stated business requirement | Legitimate interests, following a proportionate assessment of the introduction, relationship and likely expectations of the contact |
| Calculate commission and manage invoices and bank-transfer payouts | Performance of the partner agreement and compliance with accounting, tax and other legal obligations |
| Send verification, security, referral, commission and payment messages | Performance of the partner agreement and legitimate interests in operating and securing the programme |
| Maintain audit, security and fraud-prevention records | Legitimate interests in security, accountability, dispute handling and protection of legal rights; legal obligation where applicable |
| Respond to rights requests, regulators, courts or law enforcement | Legal obligation and the establishment, exercise or defence of legal claims |
| Use non-essential analytics or similar technologies | Consent where required; essential portal security and session technologies are used because they are necessary to provide and secure the service |
We do not use portal registration or referral information for unrelated electronic marketing without identifying an appropriate lawful basis and meeting applicable electronic-marketing rules.
5. Our legitimate interests
Where we rely on legitimate interests, those interests include:
- operating and improving a commercially viable referral programme;
- enabling relevant business introductions requested or reasonably expected by the parties;
- assessing partner suitability and maintaining programme integrity;
- preventing fraud, duplicate claims, misuse and security incidents;
- keeping accurate operational, financial and audit records; and
- establishing, exercising or defending legal rights.
We must balance these interests against the rights and reasonable expectations of the people affected. We do not rely on legitimate interests where our interests are overridden by those rights. We document the assessment for material processing involving referred contacts and partner vetting.
6. Partner responsibilities when submitting a referral
The partner must confirm that they have a genuine business or professional relationship with the referred person, or another lawful and reasonable basis for making the introduction. The partner must tell the person that their details will be shared with REONEX, or obtain permission where permission is required.
This declaration does not remove REONEX's responsibility to identify and document its own lawful basis. We review referrals before using the information and provide the referred person with this notice as required.
7. Automated decisions
We may use automated matching to flag possible duplicate referrals or unusual activity. Automated flags do not by themselves approve, reject or penalise a partner or referral. An authorised person makes the substantive decision.
We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects.
8. Who we share information with
We may share information, only where necessary, with:
- authorised REONEX staff according to their roles;
- hosting, infrastructure, backup and security providers, including the provider used to host the portal;
- SMTP2GO and related providers used to deliver and monitor transactional email;
- banks and payment providers involved in bank transfers;
- accountants, auditors, insurers, solicitors and other professional advisers;
- suppliers supporting the portal under appropriate contractual obligations;
- a referred organisation or partner where necessary to administer the specific referral, without revealing another partner's confidential information; and
- courts, regulators, tax authorities, law-enforcement bodies or other recipients where disclosure is required or permitted by law.
We do not sell personal information. We do not allow service providers to use portal information for their own unrelated purposes.
9. International transfers
Some suppliers or their support operations may process information outside the United Kingdom. Before permitting a restricted transfer, we will use an applicable UK adequacy regulation or approved safeguards, such as the UK International Data Transfer Agreement or UK Addendum, and carry out any required risk assessment.
You may contact us for further information about the safeguards relevant to your information.
10. How long we keep information
We keep information only for as long as necessary for the relevant purpose, legal requirements, disputes and security. Our intended baseline periods are:
| Record | Intended retention |
|---|---|
| Incomplete/unverified signup | Up to 90 days after the verification opportunity expires |
| Rejected partner application and vetting decision | 12 months after the final decision, unless needed longer for an active complaint, fraud prevention or legal claim |
| Active partner account and programme records | For the life of the account and ordinarily 6 years after closure or the final programme transaction |
| Unsuccessful or closed referral that does not become a customer | Ordinarily 3 years after closure, subject to dispute, suppression and legal requirements |
| Successful referral and associated contract/commission history | For the support-contract relationship and ordinarily 6 years after the final related transaction or end of the relevant financial year, whichever requires the longer period |
| Invoices, VAT records, commission and payout records | At least 6 years, or longer where tax, accounting, investigation or legal requirements apply |
| Routine security and access logs | Ordinarily 12 months; relevant extracts may be retained longer where connected with an incident, investigation or claim |
| Audit records | For the period needed to demonstrate programme, security and financial accountability, aligned with the underlying record and applicable legal limitation periods |
These periods may be extended where records cover multiple accounting periods, a regulator or authority requires preservation, litigation is anticipated or active, or another legal requirement applies. When identifiable information is no longer needed, we delete it securely or anonymise it.
11. Invoices and bank details
Partners provide bank-transfer details on their invoices. Invoices are financial records and are stored in private, access-controlled storage rather than public web storage.
Access is limited to authorised Finance and administrative users with a business need. Bank details must not be placed in referral notes, public links or ordinary portal messages. We may verify new or changed payment information before using it.
12. Security
We use proportionate technical and organisational safeguards, including access controls, individual staff accounts, mandatory administrator MFA, encryption in transit, secure password hashing, role-based permissions, logging, protected backups, patching and review of privileged and financial actions.
No internet service can guarantee absolute security. If you believe your account or personal information may be at risk, contact us promptly at enquiry@reonex.co.uk.
13. Your data-protection rights
Depending on the circumstances and lawful basis, you may have rights to:
- be informed about how we use your information;
- request access to your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information;
- ask us to restrict processing;
- receive certain information in a portable form;
- object to processing based on legitimate interests; and
- withdraw consent where we rely on consent.
These rights are not absolute. For example, we may need to retain invoices, commission records, audit evidence or information required for legal claims.
Your right to object
You have the right to object to processing based on legitimate interests. Tell us about your particular situation and we will stop unless we have compelling legitimate grounds to continue or the information is needed for legal claims. You have an absolute right to object to direct marketing.
To exercise a right, contact enquiry@reonex.co.uk. We may need to verify your identity before acting, but we will not request more information than is reasonably necessary.
14. Complaints
Please contact us first so we can investigate and address your concern.
You may also complain to the UK Information Commissioner's Office:
- Website:
https://ico.org.uk/make-a-complaint/ - Telephone: 0303 123 1113
You may have the right to complain to another relevant supervisory authority depending on where you live or work.
15. Cookies and local storage
The portal uses essential cookies or similar storage for authentication, security, preferences and session continuity. Essential technologies cannot be disabled through the portal because the service cannot operate securely without them.
We will not activate non-essential analytics or marketing technologies until the required information and consent controls are in place.
16. Children
The referral programme is intended for adults acting in a business or professional context. People under 18 must not register or submit referrals.
17. Changes to this notice
We version this notice and record the version accepted or acknowledged by portal users. If a change materially affects how we use information, we will provide an appropriate notice and, where necessary, request a new acknowledgement or consent.
18. Contact us
For privacy questions or rights requests:
Reo Group Ltd, trading as REONEX
521 Thornton Road
Bradford
West Yorkshire
BD8 9RB
England
Email: enquiry@reonex.co.uk
Telephone: 0333 344 9588