Privacy Policy

Last updated: 11 October 2026 . Holtwood Holdings Ltd trading as ownered.ai

ownered.ai is operated by Holtwood Holdings Ltd, a company registered in England and Wales. We take the privacy of our users seriously. This policy explains what data we collect, how we use it, and your rights under UK GDPR and the Data Protection Act 2018.

1. Who We Are

Data Controller: Holtwood Holdings Ltd
Trading as: ownered.ai
Registered in England and Wales
Contact: support@ownered.ai

2. What Data We Collect

We collect the following categories of data when you use our platform:

• Account data: your name, email address, and subscription plan when you register
• Usage data: campaigns created, targets saved, activity logs, and feature usage
• Payment data: processed by Stripe - Ownered does not store full payment-card details
• Sender & outreach details: your sending email address and display name for email campaigns, and the sender details you provide for postal letters — name, job title, company name, postal address, phone number, contact email, and an optional signature image
• Business and ownership data: company records and the names and roles of directors and People with Significant Control from Companies House, together with researched or enriched business-contact information such as a company website, business email address or company postal address (see Section 6)
• Communications: support messages sent via our in-app assistant

3. How We Use Your Data

• To provide and operate the ownered.ai platform
• To process subscription payments via Stripe
• To send transactional emails (account confirmations, billing, product updates)
• To power the AI assistants (queries are processed by our platform AI infrastructure). Conversations with the Ownered Analyst and with in-app support are retained in your account so you can return to them and so we can provide continued assistance; you can request their deletion at any time (see Section 8)
• To improve the platform through aggregated, anonymised usage analytics
• To comply with legal obligations

4. Legal Basis for Processing

We process your data under the following legal bases:

• Contract: to deliver the service you have subscribed to
• Legitimate interests: to improve our product and prevent misuse, and to compile and provide business and ownership information so that our users can discover and make professional contact with UK businesses about acquisition and investment opportunities (see Section 6)
• Legal obligation: to comply with UK law (e.g. tax, fraud prevention)
• Consent: for marketing communications where applicable (you can opt out at any time)

5. Third-Party Services

We use Stripe to process subscription payments and manage billing. Ownered does not store full payment-card details. Stripe's handling of personal information is explained in its Privacy Policy: https://stripe.com/privacy.

We also use the following categories of third-party service providers to operate the platform. Each processes personal data only as necessary to deliver the specific service described:

• AI processing provider - AI assistant functionality, accessed via our platform infrastructure provider
• Email delivery provider - transactional and campaign email delivery

These service providers are contractually required to handle your data in accordance with UK GDPR.

6. Business Contact and Companies House Data

This section is for the business owners, directors and other people whose information appears in the platform, as well as for our users. It covers personal data we obtain from public and business sources, rather than data you provide directly to ownered.ai.

Sources. We use company registration information and People with Significant Control (PSC) records published by Companies House, an executive agency of the Department for Business and Trade, under the Open Government Licence v3.0. PSC and officer records include personal information such as the names and roles of directors and shareholders. We add researched or enriched business-contact information from business-information providers and enrichment services, such as a company's website, a business email address and the company's registered or trading address.

Purpose and lawful basis. We process this information on the basis of legitimate interests: helping acquirers and investors find UK businesses and make relevant, professional contact with their owners about a possible sale or investment. We limit it to business information about a person's role in a company. We do not use it to profile private lives, and we do not sell, licence or redistribute Companies House data. Public availability does not remove data-protection obligations, and the Open Government Licence covers re-use of the published information; it does not by itself authorise any particular use of personal data. Our use is also governed by the Companies House terms of use.

Roles. We act as controller for how we compile, hold and make this information available in the platform. Each user acts as an independent controller for the outreach they choose to send, and is responsible for doing so lawfully under our Terms of Service.

Safeguards. Every campaign email carries an unsubscribe link. Opting out automatically suppresses further campaign emails from that sending address to that business. Automated email sequences stop when the recipient replies, and addresses that bounce or generate a complaint are suppressed from further sending. Follow-ups are limited to a short, controlled sequence.

7. Data Retention

We retain your account data for as long as your subscription is active, plus 6 years for accounting and legal purposes. Companies House register data is held internally and refreshed periodically from the public register, so records removed or corrected at Companies House are updated in the platform. Enriched business-contact information is kept while it remains relevant and is corrected or removed when we learn it is inaccurate or on request. Opt-out and suppression records are kept so that the opt-out continues to be honoured. You may request deletion of your personal data at any time by contacting us - we will action requests within 30 days.

8. Your Rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (right to be forgotten)
• Restrict or object to processing
• Data portability (receive your data in a machine-readable format)
• Lodge a complaint with the ICO at ico.org.uk

To exercise any of these rights, email us at support@ownered.ai

These rights also apply if you are a business owner or director whose information appears in the platform. You can object to your information being used for outreach, or ask for it to be corrected or removed, by contacting us. If you have received a campaign email, you can also use its unsubscribe link to stop further campaign emails from that sender.

9. Cookies

We use essential cookies only - required for authentication and session management. We do not use tracking or advertising cookies. No cookie consent banner is required for essential-only cookies.

10. Security

All data is transmitted over HTTPS (TLS encryption). API keys and sensitive credentials are encrypted at rest. We review our security practices regularly and are pursuing Cyber Essentials certification.

11. Changes to This Policy

We may update this policy from time to time. We will notify active subscribers of material changes via email. The latest version is always available at this URL.

12. Contact Us

If you have any questions about this policy or how we handle your data, please contact us at support@ownered.ai.