GDPR Compliance

owl-field is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page outlines how we fulfil our obligations and respect your rights as a data subject.

Data Controller

owl-field acts as the data controller for personal information collected through our services. We determine the purposes and means of processing your personal data and are responsible for its protection.

Lawful Basis for Processing

We process your personal data under the following lawful bases:

• Contract: Processing necessary to fulfil our service agreement with you
• Legitimate Interest: Processing for fraud prevention and service improvement
• Legal Obligation: Processing required by financial services regulations
• Consent: Processing for marketing communications where you have opted in

Your Rights Under GDPR

Right to Access

You have the right to request a copy of all personal data we hold about you. We will respond to your request within one month and provide the information in a commonly used electronic format.

Right to Rectification

If any personal data we hold is inaccurate or incomplete, you have the right to request correction. We will update your records promptly upon receiving your request.

Right to Erasure

Also known as the right to be forgotten, you can request deletion of your personal data when it is no longer necessary for the purpose it was collected, or you withdraw consent. Certain legal obligations may require us to retain some data.

Right to Restrict Processing

You can request that we limit how we use your data while we verify its accuracy or assess our legitimate grounds for processing against your objection.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller without hindrance.

Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we demonstrate compelling legitimate grounds.

Rights Related to Automated Decision Making

Our fraud detection systems use automated processing. You have the right to request human intervention in decisions that significantly affect you, to express your point of view, and to contest automated decisions.

Data Protection Impact Assessments

We conduct Data Protection Impact Assessments for processing activities that pose high risks to individuals' rights and freedoms. Our fraud monitoring systems have been assessed to ensure appropriate safeguards are in place.

International Data Transfers

When transferring personal data outside the UK, we ensure adequate protection through Standard Contractual Clauses approved by the Information Commissioner's Office or transfers to countries with adequacy decisions.

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours and inform affected individuals without undue delay.

Exercising Your Rights

To exercise any of your data protection rights, please contact our Data Protection Officer:

Email: [email protected]
Address: Data Protection Officer, 47 Kensington High Street, London W8 5ED

We will respond to all legitimate requests within one month. For complex or numerous requests, we may extend this period by two months with prior notification.

Complaints

If you are unsatisfied with how we handle your personal data or respond to your rights requests, you have the right to lodge a complaint with the Information Commissioner's Office:

Website: ico.org.uk
Helpline: 0303 123 1113