Privacy Policy
The Owl Barn Ltd is committed to safeguarding the privacy of our customers and users whilst providing the highest possible quality of service. When you place orders or access your account information, we offer the use of a secure server. We follow strict security procedures in the storage and disclosure of information which you have given us, to prevent unauthorised access. Our security procedures mean that we may occasionally request proof of identity before we are able to disclose sensitive information to you. Under the terms of the Data Protection legislation, we are required to explain to you how we will treat any personal data which we collect from you.
1. Who we are
We are The Owl Barn Ltd (Registered in the UK company number 03048995), located in Middlewood Green, UK. Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we operate as the Data Controller for the personal data we collect from you. We sell a wide range of gifts for men, women & children through catalogues, advertisements and on the internet. The www.owlbarn.co.uk website is owned and operated by us. Any questions relating to data protection should be directed to:
The Data Protection Dept Owl Barn Ltd. Unit 2, The Stable Yard, Middlewood Green, Stowmarket, Suffolk, IP14 5HG.
2. When We Collect Your Information
We are committed to safeguarding your consumer privacy & your statutory rights. This Policy sets out the basis on which any personal data we collect from you, or that you provide us, or that we obtain from other sources will be processed by us when you:
When you post in your order to us:
Use our website: www.owlbarn.co.uk
Contact us by telephone to place an order, request a catalogue or discuss your order / personal preferences.
3. What Sort of Data We Collect
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed, (anonymous data) and relates only to living individuals.
In order to fulfil your order (for example, to purchase a gift) we need to know certain personal information collected at the time of the order.
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
• Identity data: includes your title, name, last name, username or similar identifier & title.
• Contact data: includes billing address, delivery address, email address and telephone numbers.
• Financial data/ Payment processing: Please Note: Payment card details are encrypted after data entry and are not stored on our systems once used.
• Transaction data: includes details about payments to and from you, returns and other details of products and services you have purchased from us.
• Technical data: includes internet protocol (IP) address, device number, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
• Profile data: includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
• Usage data: includes information about how you use our website, products and services.
• Marketing and communications data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.
We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.
4. Credit Card Security
We want you to shop with confidence, so we make sure your information is safe. Our website is securely hosted by Shopify, who work alongside leading payment providers, such as Paypal, meaning all your online payments are looked after by their top security system. For non-web orders, we process your card payments through Opayo (by Elavon), keeping your details secure every step of the way. Our systems are also regularly scanned to ensure PCI compliance by First Data Merchant Services.
Why you can shop safely with us:
- Secure Website: Shopify hosts our site and guards your web payments.
- Trusted Partners: We also use Opayo (by Elavon) to process cards safely.
- Peace of Mind: All transactions are secure & encrypted, so that your payment details are always fully protected.
5. What Happens If You Fail to Provide Personal Data?
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.
6. Our Legal Grounds for Processing Your Data
The sections below explain how and why we process your personal data, as well as the legal basis on which we carry out this processing. The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:
Performance of our contract with you: Where we need to perform, the contract we are about to enter or have entered with you.
Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
Legitimate Interests (Soft-Opt In): if you are an existing customer who has purchased from us, we may email you about similar gift products. We will always provide a clear opportunity to opt-out at the point of sale and in every email we send.
Consent: If you sign up directly via our website newsletter form, we rely on your explicit Consent.
Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.
7. How We Use Data to Fulfil Your Orders
When you order products from us, we will process your personal data, including identity, contact, financial, and transaction data to register you as a customer and process your order so that we can deliver our products to you.
This includes:
Sharing your personal data with our payment system provider to process your payment or refund in respect of a return. The lawful basis for processing: Performance of our contract with you and compliance with a legal obligation.
Sharing your personal data with delivery companies to deliver your purchases and keep you informed of their status, and to process any returns including (where applicable) collecting the item from you. The lawful basis for processing: Performance of our contract with you.
8. How We Manage and Secure Your Online Account
To manage your Owl Barn account:
We use your personal data to provide you with access to your online account via our website. We store your personal data including identity, contact and profile data (including your password), to create, update and register that account. We do this to manage and provide you with access to your account and provide you with the services you request.
The lawful basis for processing: Performance of our contract with you.
9. How We Detect and Prevent Fraud
To detect and prevent fraudulent transactions:
We use your identity, contact, financial and transaction data for fraud prevention purposes, the prevention of other illegal activities and to verify who you are. For example, by checking your delivery addresses to identify potentially fraudulent transactions by third parties (e.g. if someone were to use your bank card).
The lawful basis for processing: Our legitimate interest in keeping our systems and your account safe and protect our customers from fraud and theft.
10. How We Use Your Data for Legal, Safety, and Compliance Reasons
We process your personal data for several compliance, regulatory, and safety purposes, relying on different legal frameworks depending on the activity:
· To Comply with Our Legal Obligations: We will use your identity, transaction, and financial data to maintain corporate records, fulfil statutory tax reporting duties (e.g., to HMRC), and respond to binding legal requests, court orders, or law enforcement actions.
· To Protect Our Legitimate Interests: We monitor identity, financial, and transaction data to detect, investigate, and prevent fraudulent transactions. This processing is necessary to protect our business, our platform, and our customers from financial crime.
· To Ensure Product Safety and Protect Your Vital Interests: We will use your contact and profile data to notify you about product recalls, quality alerts, or legally mandated safety notices related to your purchases. This ensures your physical safety and fulfils our commitment to product quality.
11. Direct Marketing and Managing Your Preferences
How we use your information for Direct Marketing & how to manage your marketing preferences
We want to keep you updated about our new gift collections, sales, and special offers. We use your data for marketing across two separate channels:
Catalogues by post
Direct Marketing by us, Owl Barn Ltd, Catalogues by post. We would like to contact you by post and to let you know about our new collections and any offers or sales we may be running. Owl Barn will use your identity, contact, usage and marketing information for postal marketing purposes (depending on your preferences) and may send you our catalogues or special offers.
We regularly send print catalogues to our existing customers and individuals who request them
Lawful Basis: Legitimate Interests. We have a business interest in keeping our customers informed about our catalogue updates
Opting Out: You can opt out of postal mailings at any time by contacting us directly. Please see Section 26. How to contact us & how to change things
Email Marketing Communications
We may send you marketing communications by email such as newsletter updates & digital offers & discounts. if you have requested information from us, purchased goods or services from us, expressed interest in our products or explicitly opted in to receive them. We do not use SMS or telephone marketing.
Lawful Basis: Depending on your relationship with us, we rely on one of two lawful bases under the UK GDPR and PECR to process your personal data for email marketing:
Consent: If you are a prospect or subscriber who has actively signed up via our website or forms, we process your data based on your explicit consent.
Legitimate interests: If you are an existing customer who has previously purchased a product or service from us, we may send you email marketing regarding similar products or services. We do this under the "soft opt-in" exemption, as it is in our legitimate business interests to keep you informed about our offerings. We will only do this if you were given an opportunity to opt out at the time of your purchase and did not choose to do so.
Your right to opt out
You have the absolute right to stop receiving marketing emails from us at any time, regardless of the lawful basis used. You can exercise this right by:
* Clicking the unsubscribe link found at the bottom of any marketing email we send you.
* Contacting our privacy team directly at privacy@owlbarn.co.uk
When you opt out, we will immediately move your email address to a suppression list to ensure you receive no further marketing communications. This will not affect any non-marketing operational emails, such as order confirmations or billing updates.
12. How We Provide Customer Services
We use your identity, contact, financial and transaction data to respond to your queries, refund requests and occasional complaints. We also keep records of telephone calls, emails and postal correspondence from you. We do this for training and monitoring reasons. We may also keep a record of calls and other communications to inform any future communication with us, to demonstrate how we communicated with you throughout, for quality monitoring, for the defence of claims and to improve our products and services.
13. Personalising Your Online Experience
We use your technical, usage and transaction data to record how you interact with our websites and any marketing you are exposed to offer a tailored experience when you interact with our website.
We use technical, usage, transaction and profile data and third party data to create a profile about you, which helps us to tailor your shopping experience, to show you products and offers that we think you will be most interested in, and find ways to improve our catalogue and website.
We use your profile data and technical data about the devices you use to access our website and your interactions with us to operate personalised features across our website and marketing communication directed to you.
We may also use your technical and usage data to develop, test and improve the systems, services and products we provide to you by for example, recording your browser’s Session ID to help us understand your online feedback better if you are having any problems on the site.
The lawful basis for processing: Our legitimate interest in providing a personalised shopping experience and improving our systems and products. Where the above purposes rely on cookies or similar technologies, the lawful basis will include any consent you provide for the use of such cookies or similar technologies.
14. Resolving Technical Issues and Improving Our Website
We use usage data about how you browse and engage with our website to improve our website.
We use technical data derived from cookies and other similar technologies to keep track of your preferences when using our website.
We use technical data derived from cookies and similar technologies to help us understand how you use the website. This allows us to optimise your shopping experience and continually improve our website.
We'll use your technical data and usage data to identify and resolve any problems and protect the integrity of our website.
We’ll process your technical data and usage data (such as a browser's Session ID) to help us understand your issue when you leave us online feedback about any problems you're having.
We use your technical data for data analytics, logistics planning, demand forecasting, management information, dealing with errors on our website, and general research and development as it is necessary to keep the business running efficiently. To do this we may share your personal data with the third-party analytics and search engine providers that assist us in the improvement and optimisation of our website.
We gather data about any devices you use to access our sites (for example your IP address and device type) to ensure the website is secure and works across multiple platforms.
The lawful basis for processing: Our legitimate interest in ensuring our websites work effectively. Where the above purposes rely on cookies or similar technologies, the lawful basis will include any consent you provide for the use of such cookies or similar technologies.
15. Sending Products to Other People (Gifts)
Where you have provided identity and contact data about another person (for example, where you order goods as a gift to be delivered to someone else), we need to process such personal data to provide these products to the other person or people. This will include sharing their personal data with delivery companies. We need to process their personal data in this way to be able to provide them with the products you have ordered for them from us.
The lawful basis for processing: Our legitimate interest to provide the person you have identified and requested with the products you have ordered.
16. Changes to the Purpose of Processing your data.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us at the details provided in Section 27: How to Contact Us & How to Change Things which can be found further down in this privacy policy.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal data without your knowledge or consent, in compliance with the relevant legislation, where this is required or permitted by law.
17. Service Providers Who Process Data on Our Behalf (Data Processors)
We may share your personal data about you the third parties set out below, for the following purposes:
We work with the following data processors for order fulfilment purposes & to carry out our direct marketing activities:
Fulfilment partner: West Quay Ltd: They process your name, address and other contact details to enable processing and dispatchment of your order on behalf of Owl Barn Ltd.
Postal Communications/Carriers: Citipost, Royal Mail, The Delivery Group (TDG) for onward delivery to you.
Mailing house: Advanced Direct Mail Ltd, they process name, address and mailing preference details only to enable them to mail out our postal communications (catalogues) on our behalf through Royal Mail and any other recognised mail carrier.
Database infrastructure: Strategy 7, Neptune Digital Ltd & New Media Ltd. They process your name, address and other contact details to maintain and secure our customer databases to ensure privacy.
18. Sharing Data with Third Parties for Direct Postal Marketing Purposes.
We may share your name and postal address with carefully selected third-party commercial brands, Retailers, Data Alliances (such as Epsilon Abacus, Experian Ltd, and Choreograph), and UK-based registered charities for direct postal marketing purposes. We do this to introduce you to goods, services, or appeals that we believe may be of interest to you.
Our Legal Basis:
We rely on Legitimate Interests to share names and postal addresses for one-time postal mailings.
We have balanced our commercial business interests and the interests of the charity sector against your privacy rights, ensuring that your data is never used for digital marketing (email or telephone) by third parties.
Your Right to Object
You are under no obligation to allow us to share your details. You can object to this data sharing at any time, completely free of charge. To stop this sharing, you can:
- · Uncheck the third-party marketing box during checkout on our website,
- · Tick the appropriate box on the order form when ordering via one of our catalogues
- · Contact our privacy team directly at privacy@owlbarn.co.uk or Tel 03455 331376
- · Speak directly to our customer services team on Tel: 0345 174 0199
- · Or go to www.owlbarn.co.uk log into your account and use the form on the Contact Us page to amend your preferences.
- · Register your home address with the Mailing Preference Service (MPS) at www.mpsonline.org.uk.
MPS is a free service set up in 1983 and funded by the direct mail industry to enable consumers to have their names and home addresses in the UK removed from lists used by the industry. It is actively supported by the Royal Mail and all directly involved trade associations and fully supported by The Information Commissioners Office (ICO). For more information or if you wish to register with the MPS please visit their website www.mpsonline.org.uk
We only ever share names and postal addresses for a one-time mailing use. We strictly never sell or share customer email addresses or telephone numbers with third parties for marketing purposes
For fraud management, we may share information about fraudulent or potentially fraudulent activity in our premises or systems. This may include sharing data about individuals with law enforcement bodies.
We may also be required to disclose your personal data to the police or other enforcement, regulatory or Government body, upon a valid request to do so. These requests are assessed on a case-by-case basis and take the privacy of our customers into consideration.
Commercial Data Partners, Retailers, and Charities
Data alliances and marketing companies: Epsilon International UK Ltd (Epsilon Abacus), Experian Ltd, and Choreograph. They process name, address, mailing preferences and purchase history of the purpose of sharing in their alliances. For more information on how they use the data see below.
Third-party retailers: Selected commercial consumer brands in sectors such as clothing, home, garden, and gifts.
Registered charities: UK-based non-profit organisations looking for prospective donors or supporters.
Marketing by other companies - We may share your name and postal addresses with carefully selected retail companies and charities. We do this to introduce you to goods, services, or appeals that we believe may be of interest to you, for direct postal marketing purposes. We also work with Epsilon Abacus (registered as Epsilon International UK Ltd), a company that manages the Abacus Alliance on behalf of UK retailers and charities; Experian Ltd. Strategy 7, Morkrynski International Ltd, Choregraph & Access DM who manage data on behalf of UK retailers. The participating retailers are active in the clothing, collectables, food & wine, gardening, gadgets & entertainment, health & beauty, household goods, and home interiors and travel categories.
They share information on what their customers buy. Epsilon Abacus analyses this pooled information to help retailers understand consumers' wider buying patterns. From this information, retailers can tailor their communications, sending people by direct postal mail, suitable offers that should be of interest to them, based on what they like to buy.
If you would like to watch a video illustrating how your data is being used and what the benefits of sharing your data with trusted retailers are, please follow the link below:
https://www.youtube.com/watch?v=_2784r6KUcU
We may also share data (Name & Address only) directly with other trusted retailers in the clothing, collectables, gardening, gadgets, entertainment, health & fitness, household goods, home interiors sectors and UK charities and travel categories, for direct postal mailing purposes. If data is shared it is done so on a one time only basis and the company or organisation are not entitled to store your data for further use unless you engage with them.
Supporting Trustworthy Charities
We believe that we have a legitimate interest to support the charity sector, and we ensure that your information is always kept within strict control and only used for the purpose of a postal direct marketing campaign.
The UK charity sector is reliant on postal appeals as the most cost-effective method of raising funds for good causes. As a business, we recognise that Charities need a platform to put forward their appeals as there is a societal benefit to the work charities do which may benefit us all in one way or another throughout our lives.
The types of charities that we work with include both large national and international charities as well as small local organisations that operate in the following areas; health & medical research, supporting elderly people, community charities, children’s charities, veterans & active forces personnel, heritage and conservation organisations, disability support, overseas aid and development, emergency air ambulances and animal charities
19. How We Acquire and Use Prospective Customer Lists (Cold Data)
Data processed: Name and postal address.
Source of Data: We occasionally purchase marketing lists containing prospective customer data from vetted UK data brokers, and marketing agencies, specifically Epsilon International UK Ltd, Experian Ltd, and Choregraph.
Our Use Case: We use this information to send you direct marketing about our products and offers that we believe may be of interest to you, in the form of a printed catalogue, by post. We will do this only once per list purchase.
Lawful basis: We process this data based on our legitimate interests to promote our retail business and reach prospective customers. We only acquire this data where the broker guarantees that individuals have given explicit, affirmative consent to share their details with third-party retailers in the home, garden, and gift sectors for postal marketing purposes. We also conduct a Legitimate Interest Assessment (LIA) to balance our commercial interests against your privacy rights.
Safeguards: We systematically screen all data against the UK Mailing Preference Service (MPS) database before any physical mailing to ensure we respect your choices.
The Personal Data we both share and obtain from these third parties includes:
Title
Your Name
Postal Address
20. Where Your Personal Data is Processed (International Transfers)
We are a UK-based company, and your personal data is primarily stored and processed within the United Kingdom. However, to provide our services, we utilize trusted data partners (including Shopify and Epsilon Abacus) whose systems involve data transfers outside of the UK to the United States.
Where data is transferred to the US, we ensure it is protected by equivalent legal safeguards. This includes transferring data to organizations certified under the UK Extension to the EU-U.S. Data Privacy Framework, or by implementing UK Information Commissioner’s Office (ICO) approved International Data Transfer Agreements (IDTAs) and Standard Contractual Clauses (SCCs). You can request a copy of the specific safeguards applied to your data transfers by emailing us at privacy@owlbarn.co.uk.
21. How we use your information to understand our customers' wishes and shopping preferences
Our communications are designed to tell you about the benefits we can offer so that you have access to our best deals. We use the information we have about you to tailor the content and try to ensure that the offers are as relevant to you as possible. Under the Data Protection Legislation, this might qualify as profiling. If you do not wish us to use your data for this purpose, please call on 03455 331376, write to us at the address below or email us at privacy@owlbarn.co.uk
22. How we use your information to improve our service and our products
We may retain any feedback from individuals relating to customer service or product analysis to help us improve in these areas. Customer feedback may be used in our catalogue designs and/or on our websites. If at any time you wish this information to be removed, erased, or not used in any such way, please make this clear on the feedback you provide us with, call us on 03455 331376, write to us at the address below, or email us at privacy@owlbarn.co.uk.
You are always in control of your information, and we will stop sharing your postal data if you ask us to. For details of how to contact us, please see 27. How to contact us & how to change things which can be found further down in this privacy policy.
23. Cookies
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the Website may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookie Policy (also accessible through a link at the footer of our Website).
Cookies - Google.
Where you have provided your consent to us in placing the relevant cookies which enable Google to better understand on an anonymised basis the traffic on our website, in order to access the effectiveness of their advertising & to enforce browser-level controls to prevent malicious external sites from misusing your data & to record state permissions regarding integrated maps, search, or fonts.
24. How long we keep your data (Data Retention)
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting (typically up to 6 years following your last transaction) and standard consumer warranty limitations.
If you object to us sharing your data with other marketing companies, or if you object to our own direct marketing, we retain a secure "suppression marker" against your name. This ensures we permanently honour your request and do not accidentally re-import your information from a third-party cold data purchase in the future.
25.Your Statutory Right to Object Under the UK GDPR
You possess the following standalone legal rights regarding your personal data:
Your Right to Object Under Data Protection Laws
Object directly to our use of "legitimate interest" profiling, including an absolute right to stop postal direct mail or data-sharing.
You have the right to object to us processing your personal data where we are processing personal data:
Based on our legitimate interests, as previously set out in this policy. If you ask us to stop processing your personal data on this basis, we will stop processing your personal data unless we can demonstrate compelling grounds as to why the processing should continue in accordance with data protection laws; and
For direct marking purposes. If you ask us to stop processing your personal data on this basis, we will stop.
In each case please do so by using the unsubscribe functions in any marketing communication or by contacting us directly, please see 27. How to contact us & how to change things which can be found further down in this privacy policy.
26. Your Other Statutory Rights Under the UK GDPR
Right of access: Request a clear copy of all personal records we hold about you.
You have the right to receive confirmation as to whether your personal data is being processed by us, as well as access to the personal data we hold about you and copies of it. You can exercise this right by contacting us at privacy@owlbarn.co.uk. We will provide a copy of your personal data free of charge. However, if your request is objectively manifestly unfounded or excessive (for example, if you make repetitive, groundless requests), the law permits us to either: a) Charge a reasonable fee based on the administrative costs of providing the information; or b) Refuse to act on the request. If we refuse your request or charge a fee, we will explicitly explain our legal reasons to you within one month of receiving your request.
Right to rectification: You have the right to require us to rectify any inaccurate personal data we hold about you. You also have the right to have incomplete personal data we hold about you completed, by providing a supplementary statement to us. If you request a correction of your personal information, we will take reasonable steps to check its accuracy and correct it.
Right to erasure: You have the right to ask us to delete the data we hold about you.
("right to be forgotten").
You have the right to require we erase your personal data which we are processing where one of the following grounds applies:
The processing is no longer necessary in relation to the purposes for which your personal data was collected or otherwise processed;
Our processing of your personal data is based on your consent; you have subsequently withdrawn your consent and there is no other legal ground we can use to process your personal data;
You object to the processing of your personal data as set outlined in this policy and we have no overriding legitimate interest for our processing;
The personal data have been unlawfully processed; and
The erasure is required for compliance with a law to which we are subject.
On verification of your request for erasure or rectification we will permanently update or delete your information from our active databases. In accordance with UK General Data Protection Regulation (UK GDPR), we will fulfil and confirm your request without undue delay and at the latest within one calendar month of receipt.
Catalogue Print & Third Parties Printing Mailing Logistics Notice:
Please note that our print catalogues are designed, addressed, and ordered from our mailing house several weeks in advance of distribution, as is sometimes the case with Third Parties print mailings. While we will completely remove your data from our & Third-Party active marketing systems within the statutory one-month window, any catalogue or Third-Party mailings already in production and entering the postal network cannot be intercepted. Because of these fixed printing cycles, a final catalogue or Third Party mailing may still arrive at your address up to 6 weeks after your request. We appreciate your patience during this logistical window.
Right to restrict processing: Restrict how we utilize your data while a legal dispute is evaluated.
You have the right to restrict our processing of your personal data where:
The accuracy of the personal data is being contested by you;
The processing by us of your personal data is unlawful, but you do not want the relevant personal data erased;
We no longer need to process your personal data for the agreed purposes, but you want to preserve your personal data for the establishment, exercise or defence of legal claims; or
We are processing your data based on our legitimate interest, as set out in this policy and you:
Object to our processing based on our legitimate interest as set out in this policy; and
Want processing of the relevant personal data to be restricted until it can be determined whether our legitimate interest overrides their legitimate interest.
Where any exercise by you of your right to restriction determines that our processing of personal data is to be restricted, we will then only process the relevant personal data in accordance with your consent and, in addition, for storage purposes and for the purpose of legal claims.Right to data portability
You have the right to receive your personal data in structured, standard machine-readable format and the right to transmit such personal data to another controller.
Right to withdraw consent
Right to withdraw consent at any time (where relevant) : Instantly withdraw consent, objecting to third-party data sharing, cookies, or email marketing at any time
Right to be informed (which this policy fulfils)
The right to know who is collecting your data, why, and how long it will be retained
Rights in relation to automated decision-making and profiling
The right not to be subject to decisions made solely by automated means without human intervention
27. How to contact us & how to change things
We wish to be as clear and transparent as possible regarding our data collection, security and how we use it. If at any time you wish to exercise your rights, such as those listed above, or if at any time you have any questions or comments regarding this, we would be happy to speak with you in person. If you wish to do this, please call 03455 331376 with your name, postcode & phone number. Alternatively, you can write to us at:
The Data Protection Lead, Owl Barn Ltd. Unit 2, The Stable Yard, Middlewood Green, Stowmarket, Suffolk, IP14 5HG
Or email us at privacy@owlbarn.co.uk
To protect your privacy and security we may need to verify your identity before making amendments.
If you wish to change your mailing preferences directly on your account that you have previously set up with us, you can also do this directly on www.owlbarn.co.uk log into your account and use the form on the Contact Us page to amend your preferences.
28. How to Submit a Data Protection Complaint.
If you have a concern or complaint about how we handle your personal data, you have the right to lodge an internal complaint directly with us. Please submit your complaint to privacy@owlbarn.co.uk or write to our Data Protection Lead. Please see our full Data Complaints procedure published here on our website.
In accordance with the Data (Use and Access) Act, we will officially acknowledge your complaint within 30 days of receipt and provide a full response regarding our investigation without undue delay. If you remain unsatisfied with our internal response after this process, or if we fail to respond within the required timeline, you have the statutory right to escalate your complaint to the Information Commissioner's Office (ICO) via their website (https://ico.org.uk) or by calling 0303 123 1113.
29. Updates to This Privacy Policy
This notice was updated on 21st August 2026. It may be updated to consider changes at Owl Barn Ltd. or for example to reflect changes to regulation or legislation, such as the Data (Use and Access) Act.
Updates to this policy will be posted on this page - please check back from time to time.
Further information on GDPR data protection regulations and laws can be found at https://ico.org.uk/for-the-public
