Privacy & Cookie Policy

01. Introduction

OWIONE Ltd (Company No. 17412632) ("OWIONE", "we", "us" or "our") is committed to protecting your privacy and handling your personal data in an open and transparent manner. We operate a software-as-a-service platform that integrates with your existing business systems and documents to help you monitor operational and compliance activities, identify missing or expiring evidence, prioritise risks, provide recommendations (including AI-assisted recommendations) and send reminders (the "Platform").

This Privacy & Cookie Policy explains how we collect, use, disclose and protect personal data when you visit our website at https://owione.com (the "Website") or use the Platform, and it describes your rights in relation to your personal data. It applies to personal data for which OWIONE acts as a controller.

We are the controller of the personal data described in this Policy. This means we determine how and why your personal data is processed. Where we process personal data on behalf of a customer as a processor (for example, personal data contained in documents or systems that a customer connects to the Platform), that processing is governed by our data processing agreement with the relevant customer rather than by this Policy.

We process personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR").

02. Who this Policy applies to

This Policy applies to:

• visitors to and users of the Website;
• individuals who register for, access or use the Platform, including during any private beta or free trial ("Users");
• prospective customers, contacts at customer or supplier organisations, and other individuals who communicate or otherwise deal with us; and
• individuals whose personal data we hold for marketing, business development or administrative purposes.

03. Personal data we collect

We collect and process the following categories of personal data:

• Identity and account data: your name, job title, organisation, username, account credentials and profile details.
• Contact data: your email address, telephone or mobile number (used for email reminders and notifications) and postal or business address.
• Integration and content data: personal data contained within third-party systems and documents that you or your organisation choose to connect to the Platform (for example Microsoft 365, cloud storage and, in future, financial systems). Where this data is processed on behalf of a customer, we act as a processor and our data processing agreement applies.
• Usage and technical data: your IP address, device and browser type, operating system, log-in data, pages viewed, features used, session information and other data collected through cookies and similar technologies (see the Cookie Policy section below).
• Communications data: the content of, and metadata relating to, your communications with us, including support requests and feedback provided during the beta programme.
• Marketing and preferences data: your preferences in receiving marketing from us and your communication preferences.

We do not intentionally collect special category personal data (such as data concerning health, race or political opinions) about visitors or Users through the Website or in operating the Platform. Please do not submit special category data to us except where we have expressly requested it. The Platform is intended for business use and is not directed at children. We do not currently use an SMS provider. If SMS functionality is introduced in the future, we will update our legal documentation before that functionality goes live.

04. How we collect personal data

We collect personal data:

• directly from you, when you contact us, register for an account or beta, book a consultation, subscribe to communications or otherwise provide information to us;
• automatically, through cookies, analytics and similar technologies when you use the Website or Platform;
• from the third-party systems and documents you connect to the Platform, in accordance with the permissions you grant; and
• from third parties and public sources, such as our service providers, analytics providers and, where relevant, publicly available business information for B2B outreach.

05. How and why we use personal data

We use personal data for the following purposes, relying on the lawful bases indicated:

• To provide, operate and maintain the Website and Platform, including creating and administering accounts, delivering features and generating recommendations, scores and reminders. Lawful basis: performance of a contract, or our legitimate interests in operating our business.
• To communicate with you, respond to enquiries, provide support and administer beta or trial participation. Lawful basis: performance of a contract or our legitimate interests.
• To send operational messages, including email reminders and service notifications. Lawful basis: performance of a contract or our legitimate interests.
• To improve, develop and secure the Website and Platform, including analysing usage and, where relevant, using de-identified or aggregated data. Lawful basis: our legitimate interests in improving and securing our services.
• To send marketing communications about our products and services. Lawful basis: consent, or our legitimate interests for B2B direct marketing in accordance with PECR, subject to your right to opt out at any time.
• To comply with our legal and regulatory obligations and to establish, exercise or defend legal claims. Lawful basis: compliance with a legal obligation and our legitimate interests.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may ask us for more information about that assessment using the contact details below.

06. Automated processing and AI-assisted features

The Platform uses automated processing, including AI-assisted features, to analyse connected information and to generate compliance readiness scores, prioritised risks, recommendations and automated reminders.

These features are designed to support your decision-making and do not replace professional, legal, accounting or regulatory advice. Scores, recommendations and reminders are indicative only and should not be relied on as a definitive assessment of your compliance position. You remain responsible for reviewing outputs and making your own decisions.

In relation to your rights under the UK GDPR concerning automated individual decision-making:

• we do not use automated processing to make decisions that produce legal or similarly significant effects concerning you without human involvement;
• where any such automated decision were to occur, you have the right to obtain human intervention, to express your point of view and to contest the decision; and
• you can contact us using the details below to exercise these rights or to ask how our AI-assisted features work.

07. Sharing your personal data

We may share personal data with:

• service providers and sub-processors who support our business and Platform, including cloud hosting, storage, email, analytics and AI service providers, and integration partners such as Microsoft 365 and cloud storage providers;
• our professional advisers, including lawyers, accountants and insurers, where necessary;
• regulators, courts, law enforcement and other authorities where required by law or to protect our rights; and
• a buyer or successor in the event of a merger, acquisition, financing or reorganisation of our business.

We require our service providers and sub-processors to process personal data only on our instructions and to keep it secure and confidential. We do not sell your personal data.

08. International transfers

Some of our service providers, integration partners and cloud infrastructure may be located, or may process personal data, outside the United Kingdom. Where we transfer personal data outside the UK, we ensure an appropriate level of protection is in place by relying on one or more of the following safeguards:

• transfers to countries that the UK has determined provide an adequate level of protection (adequacy regulations);
• the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK Addendum; and
• other lawful transfer mechanisms and supplementary measures as appropriate.

You may request a copy of the relevant safeguards by contacting us using the details below.

09. How long we keep personal data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, accounting, regulatory or reporting requirements. When personal data is no longer required, we will securely delete or anonymise it.

Where personal data is processed on behalf of a customer as part of the Platform, retention and deletion of that data (including on expiry of a beta trial or termination of an account) is governed by our terms and data processing agreement with the relevant customer.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures include access controls, encryption in transit and at rest where appropriate, and ongoing review of our security practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We will notify you and the Information Commissioner's Office of any personal data breach where required by law.

11. Your rights

Subject to the conditions and exemptions in the UK GDPR and Data Protection Act 2018, you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate or incomplete personal data corrected;
• have your personal data erased in certain circumstances;
• restrict or object to our processing of your personal data, including for direct marketing;
• receive certain personal data in a portable format and, where technically feasible, have it transmitted to another controller;
• withdraw your consent at any time where we rely on consent, without affecting the lawfulness of prior processing; and
• not be subject to a solely automated decision with legal or similarly significant effects, as described in the Automated processing and AI-assisted features section above.

To exercise any of these rights, please contact us using the details below. We will respond within the timeframes required by law. There is usually no charge, although we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.

12. Complaints

If you have any concerns about how we handle your personal data, please contact us first so that we can try to resolve the matter. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.

13. Cookie Policy

This Cookie Policy forms part of our Privacy & Cookie Policy and explains how we use cookies and similar technologies on the Website and Platform. Cookies are small text files placed on your device when you visit a website. Similar technologies include pixels, tags, local storage and software development kits.

We use the following categories of cookies and similar technologies:

• Strictly necessary cookies: required for the Website and Platform to function, including security, network management and authentication. These do not require your consent.
• Functional cookies: remember your choices and preferences to improve your experience.
• Analytics and performance cookies: help us understand how visitors and Users interact with the Website and Platform so we can improve them, for example through analytics providers.
• Marketing and remarketing cookies: used to deliver relevant advertising and measure the effectiveness of marketing campaigns, including remarketing pixels.

Except for strictly necessary cookies, we place non-essential cookies only where you have given consent through our cookie banner. You can withdraw or change your consent at any time using the cookie settings on the Website or by adjusting your browser settings. Blocking some cookies may affect how the Website and Platform function. Further information about the cookies we use is available in this Cookie Policy and through the cookie settings on the Website.

14. Cookie consent banner wording

The following wording may be used for the Website cookie consent banner:

"We use cookies to make our website work and, with your consent, to analyse usage and improve your experience and marketing. Strictly necessary cookies are always on. You can accept all cookies, reject non-essential cookies, or manage your preferences. You can change your choice at any time. See our Cookie Policy for details."

Suggested banner buttons: "Accept all", "Reject non-essential" and "Manage preferences".

15. Changes to this Policy

We may update this Policy from time to time. The current version will always be available on the Website, and the "Last updated" date shows when it was last revised. Where changes are material, we will take reasonable steps to notify you.

16. Contact us

If you have any questions about this Policy or how we handle your personal data, or if you wish to exercise your rights, please contact us at:

Controller

OWIONE Ltd (Company No. 17412632)

Registered address

66 Paul Street, London, England, EC2A 4NA

Privacy email

hello@owione.com

17. Company details

OWIONE LTD (Company No. 17412632), a company incorporated in England and Wales.