OXU Identity - Privacy Policy
Last updated
Last updated
When you use our identity services, you trust us with your personal information. We recognize that this is a significant responsibility. Our priority is to protect your data with the highest standards of security and transparency, while giving you full control over your identity.
This Privacy Policy is designed to help you clearly understand:
What information we collect;
Why we collect it;
How we use and protect it;
How you can access, manage, export, or delete your information at any time.
Your trust matters to us. We are committed to building a secure, privacy-first identity platform that empowers individuals and organizations.
Effective August 01, 2026
These Terms are entered into with Oten as the legal service provider. OXU is the registered trademark and commercial brand under which Oten's Identity Platform and related services are offered. Unless otherwise stated, references to "OXU", "the Platform", or "the Services" in these Terms refer to the services provided by Oten.
This Privacy Policy explains how Oten Switzerland GmbH ("OXU", "we", "our", or "us") collects, uses, stores, shares, and protects personal data when organizations and their authorized users access or interact with our cloud-based identity and access management platform ("OXU IDP"). By using our Services, you acknowledge that you have read, understood, and agreed to this Policy.
OXU IDP enables secure authentication, single sign-on (SSO), identity verification, role-based access control, and multi-factor authentication (MFA) using methods such as Passkey (WebAuthn/FIDO2), OTP, or device-based authentication.
This Privacy Policy applies to identity-related services provided by OXU IDP, including:
OXU is the primary provider of identities within OXU IDP. All authentication flows begin with a user-initiated action. When users authenticate to external applications, OXU presents a Consent Screen clearly listing data to be shared. Data is shared only with the user's explicit permission.
Controller/Processor roles: OXU acts as the Data Controller for identities processed within OXU IDP on behalf of organizational tenants. Where an enterprise customer manages its own user directory and instructs OXU to process identity data, OXU acts as a Data Processor under the customer's instructions.
OXU IDP is currently available to organizations and their users across Southeast Asia and the Middle East. Future expansion to other jurisdictions may occur, at which time this Policy will be updated accordingly.
By accessing or using OXU IDP, you agree that your personal data will be collected and processed in accordance with this Policy.
We collect only the information necessary to create and maintain a secure digital identity, perform authentication, protect our services, and enable access management for organizations. We apply principles of data minimization, purpose limitation, and transparency to all data collection.
2.2.1 Account Registration Information
When your organization provisions an OXU account for you, we collect:
For enterprise workspaces, we may also collect organization name, business contact details, and information necessary to configure a workspace and designate administrators.
2.2.2 Authentication and Security Data
2.2.3 Device and Technical Data
2.2.4 Log and Activity Data
2.2.5 Consent and Authorization Data
When you use "Sign in with OXU," you are redirected to OXU to authenticate. Your account may be provisioned via Just-in-Time (JIT) provisioning under your organization's configuration. After sign-in and consent, OXU issues tokens containing only the attributes you have approved.
Developers register applications and declare permission scopes on the OXU Developer Portal, a separate product with its own Terms and Privacy Policy. OXU IDP consumes application metadata to execute authentication and authorization flows.
To be transparent about the boundaries of our data processing, we explicitly do not collect:
See Section 6 for full retention schedules by data category.
Optional profile fields are voluntary and not required for core authentication features. You may update or remove optional data at any time through your account settings.
Personal data may be stored or processed in cloud data centers in various regions. We do not currently offer customer-selectable data residency. Transfers across borders are conducted in compliance with applicable data protection regulations and subject to appropriate safeguards as described in Section 4.5.
We may update this Chapter to reflect service changes or regulatory guidance. We will indicate the effective date and provide a more prominent notice for material changes.
When an organization enables the Biometric Verification and Liveness feature, the following data flow occurs between OXU Pass and OXU IDP:
We process personal data solely to provide, secure, and improve OXU IDP, following principles of transparency, purpose limitation, and data minimization. We will not use your data for purposes incompatible with those stated in this Policy without your prior consent.
We analyze aggregated and/or de-identified metrics to improve reliability, performance, and security of OXU IDP. These analyses do not identify individuals and are not used for advertising.
We may process and preserve data to comply with applicable laws, enforce our Terms of Service, and protect rights, safety, and property of OXU, our users, and third parties.
We do not use personal data for targeted advertising, behavioral profiling, or the creation of marketing profiles. We do not sell, rent, or trade personal data to any third party for their marketing purposes. This applies across all OXU IDP services and all user categories.
We only share personal data where necessary to provide our services, comply with legal obligations, or where the user has explicitly consented. We do not sell, rent, or share personal data for advertising purposes.
We may engage third-party sub-processors to host, store, process, or secure data on our behalf. All sub-processors are bound by written Data Processing Agreements (DPAs) that:
A current list of our sub-processors is available upon written request submitted to dpo@oxu.com.
When you use "Sign in with OXU," we share only the authentication assertions and profile attributes you have approved on the Consent Screen. Third-party applications do not receive backend access to your OXU IDP account, credentials, or any data not explicitly authorized.
Personal data may be processed or stored in data centers in different regions to support our operations across Southeast Asia and the Middle East. Where personal data is transferred across international borders, we apply the following safeguards:
We do not currently offer customer-selectable data residency. Organizations with specific residency requirements should contact us at dpo@oxu.com to discuss available options.
We may disclose personal data to comply with valid legal obligations, court orders, or lawful governmental requests. We will:
We do not sell or rent personal data to third parties. We do not share data with data brokers or advertising networks. We do not create marketing or behavioral profiles from OXU IDP user data. This applies without exception to all user categories including end-users, enterprise administrators, and developers.
Certain commercial, billing, or application publishing functions are provided through the OXU Developer Portal, a separate product with its own Terms and Privacy Policy. This Policy applies exclusively to OXU IDP.
We store personal data on reputable cloud infrastructure across various regions, applying consistent privacy and security controls regardless of storage location. All storage infrastructure is subject to the sub-processor requirements described in Section 4.3.
We do not store passwords in plain text. All passwords are stored using strong, salted hashing algorithms. Where Passkeys/WebAuthn are used, we rely on public-key cryptographic proofs and do not receive or store raw biometric data from the device.
Service providers acting as sub-processors operate under written DPAs that prohibit use of personal data for their own purposes, require appropriate technical security measures, and impose confidentiality obligations consistent with this Policy.
We maintain documented processes to identify, assess, contain, and respond to security incidents. In the event of a personal data breach:
When data reaches the end of its retention period or is subject to a deletion request, we follow a secure deletion process to ensure data is removed from active systems. Residual copies may persist in encrypted backups for a limited time before being overwritten in accordance with our backup rotation schedule. See Section 6 for full retention schedules.
You should use strong, unique credentials; enable multi-factor authentication; keep devices and applications up to date; regularly review connected applications and consents; and notify us immediately at contact@oxu.com if you suspect unauthorized access to your account.
When an Organization Administrator archives a member account (available today via the OXU IDP Admin Console), the following sequence applies:
We may retain certain data beyond the standard periods above where required by applicable law, court order, or regulatory requirement. In such cases, retained data is segregated from active systems and access is restricted to personnel with a documented legitimate need.
Upon request, OXU will provide Your Organization with written confirmation that account data purge has been completed in accordance with Section 6.2, subject to the backup timeline described in Section 6.5.
Depending on your jurisdiction, you may have the following rights with respect to your personal data:
You may review and update your profile information at any time via your OXU account dashboard. Certain changes to account configuration, role assignments, or organizational settings must be requested through your organization's administrator.
You may review and revoke previously granted permissions to third-party applications at any time via the Connected Applications section of your account settings. Revocation takes effect immediately and prevents further token issuance to the revoked application.
Because accounts within OXU IDP belong to Your Organization, account archival and deletion must be initiated by Your Organization's Administrator. Members may not unilaterally delete their own OXU IDP account.
When an account is archived by an Org Admin:
See Section 6.2 for the full archival and purge sequence. Members who believe their account has been archived in error should contact their Organization Administrator.
Identity and access configurations, including user provisioning, de-provisioning, and role assignments, are managed by organization administrators. Requests related to these configurations should be directed to your organization's administrator.
To exercise any of the rights listed in Section 7.1, you may:
We may request reasonable verification of your identity before processing a request. We will respond within the timeframe required by applicable law (e.g., 30 days under UAE PDPL, 30 days under Singapore PDPA, 30 days under Thailand PDPA).
All users — including members — may contact OXU for general support inquiries, technical issues, or questions about how data is processed, at contact@oxu.com.
For data rights requests specifically: because member accounts are owned and controlled by Your Organization, requests relating to account data, activity logs, account archival, or account restoration must be directed to Your Organization's administrator. OXU does not override organizational decisions on member accounts.
If you have submitted a data rights request to Your Organization's administrator and have not received a response within 30 days, you may notify OXU at dpo@oxu.com. OXU will follow up with Your Organization on your behalf. OXU cannot override Your Organization's authority as Data Controller, but will work to ensure your request is addressed appropriately.
You have the right to lodge a complaint with the competent data protection supervisory authority in your jurisdiction. See Section 10 for jurisdiction-specific authority contact information. We encourage you to contact us first at dpo@oxu.com to attempt to resolve any concerns directly.
Requests may be limited where: fulfilling the request would violate the rights of a third party; we are required by law to retain the data; the request would interfere with security measures or an ongoing security investigation; or the request is manifestly unfounded or excessive.
OXU IDP uses cookies and similar tracking technologies on its web interface to support operation, security, and functionality. We do not use cookies for advertising or behavioral profiling.
Session cookies expire when you close your browser. Persistent cookies remain for the period specified at the time of setting or until deleted by the user. You can manage cookie preferences through your browser settings.
We do not permit third-party advertising networks to place cookies through our Services. Infrastructure provider cookies, where used, are strictly necessary and governed by sub-processor agreements described in Section 4.3.
Disabling strictly necessary cookies will impair your ability to use OXU IDP Services. Non-essential functional and analytics cookies may be managed or opted out of through your browser settings without affecting core authentication functionality.
Our Services are not intended for individuals under the age of 13 (or a higher minimum age where required by applicable local law, such as 16 in certain jurisdictions). We do not knowingly collect personal data from children below the applicable minimum age.
If we discover or are notified that we have unintentionally collected personal data from a child below the applicable minimum age, we will: immediately suspend access to the relevant account; take prompt steps to securely delete all associated personal data; notify the relevant organization administrator; and, where required by law, notify the relevant supervisory authority.
Organizations using OXU IDP are responsible for: ensuring compliance with child data protection regulations applicable in their jurisdiction; ensuring that only users meeting the minimum age requirement are provisioned accounts on OXU IDP; and obtaining any parental or guardian consent required under applicable law before provisioning accounts for minors above the minimum age threshold.
This Chapter provides additional privacy information and rights specific to users in regions with applicable data protection legislation. In the event of any conflict between a regional disclosure in this Chapter and the general provisions of this Policy, the regional disclosure shall prevail to the extent required by applicable law.
We may update this Privacy Policy to reflect changes in our services, business practices, or applicable legal requirements. We are committed to the following principles when making changes:
For material changes — meaning changes that significantly affect your rights or the way we process your data — we will provide advance notice by at least one of the following methods:
For non-material changes (e.g., clarifications, corrections, or administrative updates), we will update the effective date and publish the revised Policy without individual notice.
These Pricing, Billing & Payment Terms govern how Oten charges subscription fees, issues invoices, manages billing cycles, records payments, processes cryptocurrency payments, handles cancellations, refunds, overdue invoices, and subscription restoration for Organization-based subscriptions.
By purchasing, paying for, renewing, or continuing to use a paid Oten subscription, Customer agrees to these Terms.
Oten provides Organization-based subscriptions that grant access to Oten software, bundled applications, platform features, and related user entitlements based on the selected subscription plan and purchased licenses.
Each license permits one user to access the applications and features included in the applicable subscription plan.
Customers may purchase, assign, reassign, or remove licenses through supported Oten administration features.
Removing a license from a user may restrict that user's access but does not create a refund or reduce fees already incurred during the current Billing Cycle.
Purchased licenses remain billable regardless of whether they are currently assigned to users.
Oten may update subscription pricing from time to time. Updated pricing may apply to new purchases, renewals, or future Billing Cycles after reasonable notice or as otherwise agreed in writing with Customer.
Paid subscriptions are billed on a monthly Billing Cycle.
Each Billing Cycle begins on the applicable billing start date and ends on the day immediately preceding the same calendar date in the following month.
OTEN Switzerland GmbH
Blegistrasse 15, 6340 Baar, Zug, Switzerland
General enquiries: contact@oxu.com
Phone: +41 77 291 61 22
For account-related issues or data rights requests under organizational control, please also contact your Organization's IT administrator.
You also have the right to lodge a complaint with the competent data protection supervisory authority in your jurisdiction. See Section 10 for jurisdiction-specific authority information.
OXU IDP operates as a cloud-based Identity-as-a-Service (IDaaS) platform serving enterprise organizations across Southeast Asia and the Middle East. All user accounts, provisioned by organizational administrators, are registered and managed directly on OXU IDP. When users authenticate to external applications using "Sign in with OXU," they are redirected to OXU IDP to sign in and their identity is confirmed under OXU's control.
Account registration and identity management;
Authentication, Single Sign-On (SSO), and token issuance;
Multi-Factor Authentication (MFA) via Passkey, WebAuthn, OTP;
Role, authorization, and access policy management;
Activity logs, session tracking, and security monitoring;
API and SDK-based authentication services for integrated applications.
Note: The OXU Developer Portal, which allows developers to register applications, declare permission scopes, and publish integrations, operates as a separate product with its own Terms of Service and Privacy Policy. This Privacy Policy applies only to OXU IDP.
Enterprise users, including Organization Administrators and Workspace Administrators, who manage access for business environments;
End-users of third-party applications authenticated via OXU SSO, whose accounts are provisioned by their organization;
Developers who integrate their applications with OXU IDP through OAuth, OIDC, or other supported protocols (authentication operations only; app registration is handled via the OXU Developer Portal).
OXU acts as a Data Controller for identity data processed within OXU IDP on behalf of organizational tenants;
OXU acts as a Data Processor when issuing identity tokens or sharing user data with third-party applications upon user consent, or when processing under enterprise customer instructions.
We are committed to complying with applicable data protection laws in all jurisdictions where we operate, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, Singapore Personal Data Protection Act (PDPA) 2012, Thailand Personal Data Protection Act B.E. 2562 (2019), Indonesia Personal Data Protection Law (UU PDP 2022), Malaysia Personal Data Protection Act (PDPA 2010), Philippines Data Privacy Act of 2012 (Republic Act 10173), and other applicable regional data protection regulations.
Full name;
Email address and/or mobile phone number;
Username or display name;
Password (stored as a salted, hashed value; never in plain text);
Optional profile information (e.g., avatar, preferred language, time zone, gender — all voluntary and not required for authentication).
Public keys and cryptographic material produced during Passkey/WebAuthn registration and use;
Multi-factor authentication artifacts (e.g., OTP codes, authenticator app secrets, device trust status);
OAuth 2.0 / OpenID Connect artifacts, including authorization codes, access tokens, ID tokens (JWT), and refresh tokens;
Session identifiers, authorization scopes, nonce and state values, and anti-abuse signals.
Biometric handling: We do not collect raw, unwatermarked biometric templates. For the Biometric Verification and Liveness feature via OXU Pass, OXU IDP securely receives and stores the watermarked liveness video for administrative review, and processes derived, non-reversible Biometric Templates (Biometric Vectors) for future verification. See Section 2.13 for the full biometric data flow.
Device type, operating system, and browser version;
IP address and approximate geolocation derived from IP (no GPS-level location);
Timestamps, session duration, error codes, and login indicators;
Limited identifiers used for threat detection and rate limiting.
Authentication attempts and outcomes;
Session creation and termination;
Token issuance, revocation, and API calls;
Administrator actions (e.g., role assignments, policy changes);
Alerts related to anomalies or suspected abuse.
The application authorized and scopes requested;
Attributes agreed to share;
Timestamp of consent and whether consent was remembered;
Subsequent revocation events.
Organization and workspace configuration (tenant name, domains, SSO settings);
Administrator identities, roles, and actions taken in the admin console;
Membership lists and role assignments;
Billing contact details and subscription tier (for paid plans).
Unwatermarked raw biometric templates;
National ID numbers or passport scans;
Personal communications unrelated to identity operations;
Financial transaction histories unrelated to billing;
Behavioral tracking data for advertising or profiling;
Sensitive categories of personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation. Note: gender may be collected as an optional profile field where provided voluntarily by the user (see Section 2.2.1).
Consent – for sharing identity attributes with third-party applications and for processing special categories of data where applicable;
Performance of Contract – to provide authentication, SSO, and account management;
Legitimate Interests – to secure our platform, prevent fraud, and improve service reliability, where such interests are not overridden by data subject rights;
Legal Obligation – to comply with applicable laws in jurisdictions where we operate.
Our services are not intended for individuals under the age of 13 (or a higher minimum age where required by applicable local law). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us immediately at dpo@oxu.com and we will take immediate steps to delete such data. Organizations using OXU IDP are responsible for ensuring compliance with child data protection regulations applicable in their jurisdiction and for ensuring only eligible users are enrolled.
Step 1 — Capture and On-Device Processing (OXU Pass): The user explicitly initiates a liveness verification flow. OXU Pass records a short video using the device camera and applies a secure, permanent digital watermark at the point of capture before any transmission. A non-reversible Biometric Template (a mathematical biometric vector) is computed on the device. This Biometric Template cannot be used to reconstruct the user's original facial image, the original video, or any raw biometric data.
Step 2 — Transmission: The watermarked video and the on-device Biometric Template are transmitted securely via SSL/TLS from OXU Pass to OXU IDP. Raw, unwatermarked video is never transmitted or stored.
Step 3 — Storage and Admin Review (OXU IDP): OXU IDP stores the watermarked video and the Biometric Template. Authorized administrators of the organization may review submitted videos via the OXU Identity Admin Application.
Step 4 — Matching (OXU IDP): During subsequent verification, OXU IDP performs identity matching by comparing Biometric Templates on the server.
Step 5 — Deletion: The watermarked video is permanently and irreversibly deleted on the 91st day from its creation date. The Biometric Template is permanently deleted 90 days from its creation date, regardless of account status.
Cross-reference: For the OXU Pass client-side handling of biometric data (device permissions, local authentication, and watermarking), see the OXU Pass Privacy Policy, Section 5.
Create and maintain OXU IDP accounts provisioned by organizations;
Authenticate users to OXU and to third-party applications;
Manage profile settings, preferences, and remembered consents;
Provide customer support and communicate about service changes.
Verify credentials and cryptographic assertions (e.g., Passkey/WebAuthn);
Issue and validate OAuth/OIDC tokens;
Enforce SSO, session continuity, and logout;
Support multi-factor authentication.
Detecting suspicious or anomalous sign-in patterns;
Preventing credential stuffing, brute force attempts, and token abuse;
Monitoring service health and error conditions;
Investigating and remedying security incidents.
Operate admin consoles and apply role-based access controls;
Record administrative actions for accountability and audit;
Support billing and subscription management;
Provide usage summaries to authorized administrators.
We employ automated systems for authentication, token validation, and abuse prevention. These systems may prompt for additional verification steps but do not make automated decisions with significant legal or similarly significant effects on users without providing an opportunity for human review or user action. Users may contact their organization administrator or OXU support to request human review of any automated action.
Users are presented with a Consent Screen clearly identifying the application requesting access and the specific information fields requested;
We only share the data fields the user has explicitly approved on the Consent Screen;
Users may revoke previously granted consents at any time through their account settings;
We will seek separate, explicit consent before sharing any sensitive categories of personal data.
Prohibit use of personal data beyond the defined service scope;
Require implementation of appropriate technical and organizational security measures;
Impose confidentiality obligations on their personnel;
Require notification to OXU in the event of a security incident involving OXU data.
Standard Contractual Clauses (SCCs) issued or recognized by the relevant supervisory authority, where applicable;
Contractual and technical safeguards requiring the receiving party to maintain equivalent data protection standards;
Compliance with the requirements of the UAE Federal Decree-Law No. 45 of 2021 for transfers involving UAE personal data;
Compliance with applicable transfer requirements under Singapore PDPA, Thailand PDPA, Indonesia UU PDP, Malaysia PDPA, and Philippines Data Privacy Act, as applicable to the specific data transfer.
Review each request to verify its legal validity and scope;
Limit disclosure to the minimum data legally required;
Notify the affected organization unless prohibited by law or court order.
In the event of a merger, acquisition, reorganization, or sale of all or substantially all of OXU's assets, personal data may be transferred to the successor entity. We will provide affected organizations and users with reasonable advance notice before personal data becomes subject to a materially different privacy policy, and will ensure the successor entity provides equivalent data protection.
Encryption of data in transit (TLS 1.2 or higher) and at rest using industry-standard algorithms;
Access controls based on least-privilege principles and role-based permissions, with regular access reviews;
Network and application safeguards including environment segregation, web application firewalls, and protective monitoring;
Logging and monitoring to detect and alert on suspicious or anomalous activity;
Vulnerability management program including regular security testing and penetration testing;
Secure development lifecycle practices including change management, code review, and peer review;
Employee and contractor safeguards including written confidentiality obligations, role-appropriate access provisioning, and mandatory security awareness training.
We will notify the relevant supervisory authority within 72 hours of becoming aware, where required by applicable law;
We will notify affected organizations without undue delay so they can fulfill their obligations to affected individuals;
We will provide organizations with the information necessary to assess the impact and take appropriate protective action;
We will cooperate fully with any investigation by competent supervisory authorities.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, to provide our services, and to comply with applicable legal obligations. Because OXU IDP serves enterprise organizations in a B2B context, Your Organization (as Data Controller) has authority over retention configurations for member data within the scope permitted by applicable law. OXU retains data according to Your Organization's instructions, subject to the minimum and maximum periods described in this Section.
Planned feature: OXU IDP will introduce Organization-level Data & Privacy controls, allowing Org Admins to configure retention periods for activity logs, determine what data is shared with integrated applications, and manage deletion schedules for member data. This section will be updated when those controls become available.
Immediate effect: The account is archived instantly. The member can no longer sign in or use OXU-connected services. The account is hidden from active directory views but is not yet permanently deleted.
Grace period — 30 days: For 30 days following archival, the account remains recoverable. The Organization Administrator or the affected member may initiate account restoration through the Recover Account flow within this window. All personal data and activity history are preserved during this period.
Purge on day 31: If no restoration is initiated, OXU automatically purges all Personally Identifiable Information (PII) associated with the account on the 31st day. Active sessions, tokens, passkeys, Biometric Templates, and profile data are permanently and irreversibly deleted.
Post-purge: After purge, OXU retains only pseudonymized audit data (e.g., anonymized event records with no linkable identity) for security, compliance, and accountability purposes. This data cannot be used to identify the former member.
Important distinction: 'Archival' means access is suspended and data is preserved for potential recovery. 'Purge' means PII is permanently deleted and cannot be recovered. Organizations should communicate this distinction to members before initiating archival.
User Account and Profile Information: Retained while the account is active. Purged on day 31 following account archival as described in Section 6.2.
Authentication and Security Credentials (session tokens, passkey public keys, OTP secrets): Active credentials are retained only for the duration required for session and authentication integrity. Expired tokens are automatically invalidated. Credentials are purged as part of the account purge cycle (Section 6.2).
Activity Logs and Security Event Records: Retained for the period configured by Your Organization. Where Your Organization has not configured a specific retention period, OXU retains activity logs for the period required under applicable compliance obligations of the relevant jurisdiction. Pseudonymized audit records are retained beyond the account purge for security and compliance purposes as described in Section 6.2.
Facial Video Recordings (received from OXU Pass): Stored for a maximum of 90 days from their creation date. Permanently and irreversibly deleted on the 91st day, with no possibility of recovery. This applies regardless of account status.
Biometric Templates (Biometric Vectors): Permanently deleted 90 days from their creation date, regardless of account status or organizational configuration.
Consent Records: Retained while the consent is active. Upon revocation, the revocation event is recorded and retained for the applicable legal limitation period for accountability purposes.
Billing and Transactional Records: Retained in accordance with applicable financial, tax, and accounting regulations of the relevant jurisdiction.
Residual copies of deleted data may temporarily remain in encrypted backup archives maintained for business continuity purposes. These backups are subject to the same access controls as live data. Backup archives are overwritten on a regular rotation cycle. During this period, the data within backups is not accessible for operational use and is not restored except in a declared business continuity event.
Right of access – to obtain confirmation of whether we process your data and to receive a copy;
Right to rectification – to correct inaccurate or incomplete personal data;
Right to erasure – to request deletion of your data where it is no longer necessary or where consent has been withdrawn;
Right to restriction – to restrict processing in certain circumstances;
Right to data portability – to receive your data in a structured, commonly used, machine-readable format;
Right to withdraw consent – at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
Right to manage consents – to review and revoke authorizations granted to third-party applications;
Right to object – to processing based on legitimate interests.
The account is suspended immediately — the member cannot sign in or access connected services;
A 30-day grace period begins during which the account can be fully restored via the Recover Account flow;
On day 31, if not restored, OXU automatically purges all PII associated with the account. This is permanent and irreversible;
Pseudonymized audit records are retained after purge for compliance purposes and cannot be linked back to the former member.
Use the self-service tools available in your OXU account settings where applicable;
Submit a request to your organization's administrator for matters under organizational control;
Submit a request directly to OXU at dpo@oxu.com for matters under OXU's control as Data Controller.
Note: Biometric verification records (liveness videos and Biometric Templates) are governed by Your Organization and cannot be independently deleted by individual members. Deletion is automatic after 90 days. Requests for early deletion must be submitted through Your Organization's IT administrator.
Strictly Necessary Cookies: Required for the Services to function, including session cookies, CSRF protection tokens, and security identifiers. These cannot be disabled without impairing core functionality.
Functional Cookies: Used to remember user preferences such as language settings and display options. Not essential to core authentication but improve the user experience.
Analytics Cookies: Collect aggregated, anonymized data about Service usage to improve reliability and performance. No third-party advertising analytics are used.
Organizations are responsible for ensuring compliance with applicable laws regarding biometric data collection for users of any age in their jurisdiction. This includes obtaining any additional consent or parental authorization required under local law for users who may be considered minors. OXU does not independently verify the age of individual users provisioned by Organizations — this responsibility rests with the Organization as Data Controller.
We will not reduce your rights under this Policy without your prior explicit consent;
We will always indicate the effective date of the current version at the top of this Policy;
We maintain an archive of previous versions available upon request at dpo@oxu.com.
Email notification to registered organization administrators at least 30 days before the change takes effect;
Prominent notice displayed on the OXU IDP dashboard prior to the change taking effect;
In-product alert upon login during the notice period.