The short version. We hold the name and email of the people on your team who log — so their reports reach them and their hours carry the right rate. We hold nothing at all about the people you support: they are codes you generate and control, and we never see who they are. We do not sell data, we do not share it for anyone else's purposes, and we do not use it to train anything. Ask us to delete your details and we will.
Owl Impact™ is operated by ATO Insight Solutions Ltd (Companies House no. 17238290, registered in England and Wales), from Flintshire, North Wales. Owl Impact™ is part of the AsktheOwl® suite.
We are registered with the Information Commissioner's Office, registration C1941169. Everything here is handled under UK GDPR and the Data Protection Act 2018.
This notice covers owlimpact.wales and app.owlimpact.wales. It sits alongside our terms.
This is the part most people want answered first, so it comes first.
We hold no data about the people your organisation supports. Not their names, not their dates of birth, not their addresses, not their characteristics. Beneficiaries, participants, pupils and the organisations you help are identified by a code that you generate and keep. We see a code, a measure and a number. You hold the key to who that code refers to, offline, under your own retention policy.
It follows that we cannot give you a person's data, correct it, or delete it — because we do not have it. If someone asks you what Owl Impact holds about them, the honest answer is nothing.
You must not type a person's name or identifying details into a field meant for a code. If you do, you have put personal data into our system without a basis for it being there, and we may remove it.
1. Your team. When your organisation sets up, an administrator enters the people who will log: their name, email address, role and hourly or daily rate. That is so their personal link works, their report reaches them, and their hours are costed correctly.
Note for administrators: you are entering other people's details. Tell your team that their name, email and rate are held in Owl Impact for this purpose. You are the controller for those details; we process them on your instructions.
2. People running a tester. A work email address, and a name where you give one, so the report can be produced and sent.
3. Organisation details. Your organisation's name, the programmes you run, the funders you report to, and the rates you set. Organisational information, not personal.
4. What gets logged. Hours, activity type, outcome type, before-and-after measures, dates and locations of delivery — attached to a code, never to a name.
5. Contact and enquiries. If you use a form or email us: your name, organisation, email and what you wrote.
6. Payment. Direct Debits are set up and collected by GoCardless. Your bank details go to them, not to us. We see that a payment succeeded or failed, and the reference it relates to.
We do not use your data to make automated decisions about you, and we do not profile anyone.
Where aggregate insight across organisations is offered, it is built from counts and costed hours from organisations that have agreed to take part. It never contains an individual, and it is never presented in a form small enough to identify one. Since we hold no participant data, there is nothing about the people you support in it either.
We keep the list short on purpose. Each of these is a processor acting on our instructions, under a contract:
Some of these are outside the UK. Where they are, transfers are made under the safeguards UK GDPR requires, and each is bound by a processor contract.
The current list of named processors is available on request — email [email protected] and we will send it. We name them to you rather than publish them, so that changing a supplier never leaves this notice inaccurate.
We do not sell data. We do not share it with third parties for their own purposes. We do not use it to train AI models.
Some tools can send the same costed record to the organisation that hosted or booked the session, as well as to the person who delivered it — that is what makes it a figure two parties hold rather than a claim by one. This only happens where you have entered that organisation's contact details, and it contains no participant data.
We do not use tracking or advertising cookies. There is no cookie banner because there is nothing to consent to.
Analytics. We use Cloudflare Web Analytics, which is privacy-first: no cookies, no fingerprinting, no cross-site tracking. It tells us how many people visited a page and roughly where they came from. It does not tell us who they are.
Stored in your browser, not sent to us. The tester keeps a count of how many logs you have used in your browser's local storage, so it can show your remaining allowance. The app keeps a small cache so it works offline and submits when you are back in signal. Both stay on your device. Clearing your browser data clears them.
The site runs over HTTPS with security headers in place. Access to the platform's data is limited to what is needed to run it. Personal links carry a key that makes them unguessable. Form submissions are deleted from our host's storage immediately after processing, so they do not sit there.
No system is perfect. If a breach ever affected your data we would tell you, and the ICO, within the timescales the law sets.
Over your own details, and your team's, you can ask us to:
Email [email protected] and we will respond within one month, usually much sooner. There is no charge.
If you are unhappy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.
Owl Impact is not used by children. Work with young people is recorded by the adult delivering it, at code and headcount level. No pupil or young person's data enters the system.
The current version always lives at owlimpact.wales/privacy with the date it was last changed. Where a change materially affects you, we will tell you.
Questions about your data, or about anything here: [email protected]
ATO Insight Solutions Ltd · Co. No. 17238290 · registered in England and Wales · ICO registration C1941169