Data Processing Policy

For the data you enter about your own customers and staff, you are the controller: you decide what to collect and why. Owwel is the processor: it holds and handles that data on your behalf, to run the software you are paying for, and for nothing else.

This means you are responsible for having a lawful basis to hold your customers' details, for telling them you hold it, and for answering their requests. Owwel will help you do that, as set out below.

• Customer records: name, phone, email, notes, purchase history and outstanding balances.
• Staff records: name, contact details, employment details, shifts, attendance and ratings.
• Transaction records: sales, invoices, payments, expenses and stock movements linked to the above.
• Anything else you choose to type into a free-text field or upload as a file.

Owwel processes this for the duration of your subscription, and for as long afterwards as the account exists.

Owwel processes this data only to provide the service. Concretely, that means:

• Storing it, and showing it back to the people you have granted access.
• Producing the reports, statements and totals the software exists to produce.
• Sending the SMS campaigns you compose and choose to send, to the recipients you select.
• Backing it up, and restoring it if that is ever needed.

Owwel will not use your customers' or staff data for its own purposes, will not sell it, will not share it with advertisers, and will not use it to train models.

• There is no internal screen at Owwel for browsing a customer's books.
• A small number of people hold the platform administration access needed to operate and repair the service. That access exists to keep the system running.
• Where a fault genuinely requires looking at affected records, it is done to fix that fault and nothing else.
• Everyone with such access is bound by confidentiality.

Owwel applies encryption in transit and at rest, row-level isolation enforced by the database itself, per-feature role permissions, session limits, device verification and an automatic audit trail. Each of these is described in full, including its limits, in the Security Center.

Owwel uses a small set of suppliers to deliver the service, each handling only what its job requires: hosting and database, transactional email, SMS delivery, error monitoring and payment processing. They are listed in the Privacy Policy.

Each is bound to protect the data it handles. If we add a sub-processor that materially changes how your data is handled, we will say so here.

If one of your customers asks to see, correct or delete what you hold about them, that request is yours to answer. Owwel gives you the tools:

• Customer records can be viewed, edited and exported directly in the app.
• Marketing opt-outs are recorded against the customer and honoured automatically on future campaigns.
• Where you need something the app cannot do on its own, write to info@owwel.com and we will help.

If such a request reaches Owwel directly rather than you, we will pass it to you rather than answer it ourselves, because it is not our data to decide about.

If Owwel becomes aware of a breach affecting data it processes for you, we will tell you without undue delay, with what we know: what was reached, whose data was involved, and what we have done. We will not wait until the picture is complete to tell you something happened. Reporting it onward to a regulator or to the people affected is your decision as controller, and we will give you what you need to make it.

• A lapsed subscription makes the account read-only. Your data stays and remains exportable.
• You can export at any point you can sign in.
• On a deletion request, live data is deleted and encrypted backups age out on their normal retention cycle.
• Owwel does not purge inactive accounts on its own initiative.