GDPR
Data Protection.

1. Our Commitment

Ovysion Technologies Ltd is committed to processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where applicable, the EU GDPR (Regulation 2016/679). We have implemented policies, procedures and technical safeguards to uphold these obligations.

2. Data Controller

Company: Ovysion Technologies Ltd

Website: www.ovysion.com

Data Protection Contact: legal@ovysion.com

3. Data Protection Principles

We adhere to the following principles (Article 5 UK/EU GDPR):

• Lawfulness, fairness and transparency — processing is lawful, fair and transparent to data subjects
• Purpose limitation — data is collected for specified, explicit and legitimate purposes
• Data minimisation — we collect only what is necessary
• Accuracy — we take reasonable steps to maintain accurate data
• Storage limitation — data is not kept longer than necessary
• Integrity and confidentiality — appropriate security measures are applied

4. Lawful Basis for Processing

Depending on the nature of the processing, our lawful basis may be one or more of:

• Article 6(1)(a) — Consent
• Article 6(1)(b) — Performance of a contract
• Article 6(1)(c) — Legal obligation
• Article 6(1)(f) — Legitimate interests (balanced against data subjects' rights)

5. AI and Automated Processing

Some of our services involve automated processing by AI systems — including Emma and Delia Concierge. These systems process conversational data to generate responses.

Where automated processing has significant effects on individuals, we implement appropriate safeguards and provide the right to request human review, as required under Article 22 UK/EU GDPR.

AI conversation outputs do not constitute decisions affecting legal rights. They are informational interactions subject to human oversight and verification.

6. Data Subject Rights

Under UK/EU GDPR, you have the following rights:

• Right of access — Article 15
• Right to rectification — Article 16
• Right to erasure ("Right to be Forgotten") — Article 17
• Right to restriction of processing — Article 18
• Right to data portability — Article 20
• Right to object — Article 21
• Rights related to automated decision-making — Article 22

To exercise any of these rights, contact: legal@ovysion.com. We will respond within 30 days (extendable by a further 2 months for complex requests).

7. Data Breach Procedure

In the event of a personal data breach, Ovysion will:

• Follow our internal breach response procedure
• Notify the ICO within 72 hours where the breach is notifiable
• Inform affected data subjects where the breach poses a high risk to their rights

8. International Data Transfers

Where we transfer personal data outside the UK or EEA, we rely on approved transfer mechanisms including Standard Contractual Clauses (SCCs) or adequacy decisions.

9. Data Protection Officer

We do not currently have a statutory obligation to appoint a DPO. All data protection enquiries should be directed to: legal@ovysion.com.

10. Supervisory Authority

Information Commissioner's Office (ICO)
www.ico.org.uk  ·  0303 123 1113

EU residents may alternatively contact the data protection authority of their EU member state.