Privacy policy
Last updated: 12 November 2026. This document applies to the website axionyx.one. The version in force is always available at https://atlas.onekeyco.com/legale/axionyx.one/privacy; previous versions remain available from the same page.
1. Data controller
Axionyx AB, Kungsbro Strand 29, 112 26 Stockholm, Sweden, VAT SE559559384801, Org. nr 559559-3848. Privacy contact: email info@axionyx.one.
The controller has not appointed a data protection officer (DPO), as none of the cases in Article 37 GDPR applies; for any privacy request please use the contact details above.
Processing is governed by the GDPR and the Swedish Data Protection Act, Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning.
The website is built, hosted and technically managed by OneKeyCo di Michele Milazzo (Contrada Tabaccaro 210, 91025 Marsala (TP), Italy, VAT IT01425370531), which processes data on behalf of the controller as a processor under Article 28 GDPR.
2. Data we process
- Browsing data: IP address, date and time of the request, page requested, browser and operating system, response code. They are needed for the website to work and stay secure; they are not used to identify visitors, except to investigate unlawful acts at the request of the authorities.
- Data you send us: name, email address, phone number and the content of messages sent through contact forms or by email.
- Cookies and similar technologies: described in the cookie policy (https://atlas.onekeyco.com/legale/axionyx.one/cookie).
3. Purposes and legal bases
- Operation, security and abuse prevention of the website: legitimate interest of the controller (Article 6(1)(f) GDPR).
- Replying to requests for information or quotes: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
- Compliance with legal, accounting and tax obligations: legal obligation (Article 6(1)(c) GDPR).
- Establishment, exercise or defence of legal claims: legitimate interest (Article 6(1)(f) GDPR).
The controller does not send marketing messages without consent and does not use the data for profiling or automated decisions with legal effects (Article 22 GDPR).
4. Whether you must provide the data
Browsing data are necessary to use the website. Providing data in forms is optional, but without the data marked as required we cannot reply.
5. How we process the data
Data are processed electronically by authorised and instructed persons (Article 29 GDPR), with technical and organisational measures appropriate to the risk (Article 32 GDPR). The measures are aligned with the controls of ISO/IEC 27001, 27002, 27701, 27017 and 27018 (information security, privacy management, cloud services and protection of personal data in the cloud). Main measures:
- servers in data centres in the European Union, with encrypted private networking between servers;
- administrative access restricted to authorised persons, with strong authentication and access logs;
- encryption of web traffic (HTTPS/TLS) and of email in transit;
- encrypted daily backups on a separate system, with periodic restore tests;
- separation of each customer's data;
- continuous security monitoring and a documented procedure for handling personal data breaches;
- regular security updates of systems and applications.
6. Who receives the data
- OneKeyCo di Michele Milazzo, processor for building, hosting and technically managing the website, which uses the following sub-processors:
- Hetzner Online GmbH (Germany): servers, private network, backup and archive storage, mail servers. Place of processing: EU (Germany, Finland).
- Cloudflare, Inc. (USA): DNS, certificates, protection and routing of web traffic. Place of processing: USA — EU-US Data Privacy Framework and standard contractual clauses.
Some resources of the website are provided by third parties, which receive the visitor's IP address when the resource is loaded:
- Google Fonts (Google Ireland Ltd).
- Tax and legal advisers, authorities and public bodies, where required by law. Data are not published or sold.
7. International transfers
Some providers are based in the United States; transfers take place with the safeguards of Chapter V GDPR:
- Cloudflare, Inc.: EU-US Data Privacy Framework and standard contractual clauses.
8. How long we keep the data
- Browsing data in server logs: normally 14 days; copies in security systems for no more than 6 months, unless needed to investigate unlawful acts.
- Contact requests: as long as needed to reply and follow up; if a contract follows, for the duration of the contract and then as required by law (accounting records 7 years (Swedish Bookkeeping Act, Bokföringslagen 1999:1078)).
At the end of the period the data are deleted or anonymised.
9. Your rights
You may at any time request access to your data, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interest (Articles 15-22 GDPR). Where processing is based on consent, you may withdraw it at any time without affecting earlier processing.
To exercise your rights, write to: email info@axionyx.one. We will reply within one month (Article 12(3) GDPR).
You also have the right to lodge a complaint with the supervisory authority: Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden, www.imy.se.
10. Children
The website is not directed at children under 13.
11. Changes
This policy is updated when the processing, the providers or the services used by the website change. Each version is dated; superseded versions remain available and are marked as such.