Exercise your data-subject rights.
Under the UK GDPR and the Data Protection Act 2018 (and the EU GDPR where it applies) you have rights over your personal data. This page explains those rights, our retention defaults and deletion timelines, and how to submit a request to our Data Protection Officer.
Before you start
Which requests come to us, and which go to the organization that screened you
on8 handles personal data in two different roles, and that decides who your request goes to.
Your on8 account
For the personal data in your own on8 user account, on8 is the data controller. Exercise the rights below by writing to our Data Protection Officer, and we respond within one month as the UK GDPR requires.
Being screened by an on8 customer
If an organization used on8 to screen you - the screening records and any documents it uploaded - that organization is the data controller and on8 is only its processor. Send your request to that organization; the one-month response time is its obligation, not ours. If you write to us instead, we forward your request to the relevant customer and assist them under our Data Processing Agreement.
Your rights
Your data-subject rights under the UK GDPR
| Right | What it means |
|---|---|
| Access | Receive a copy of the personal data we hold about you. |
| Rectification | Correct personal data that is inaccurate or incomplete. |
| Erasure | Request deletion of your personal data where no obligation requires us to retain it. |
| Portability | Receive your data in a structured, machine-readable format. |
| Restriction | Limit how we process your data while a request is reviewed. |
| Objection | Object to processing based on legitimate interests. |
| Complain to the ICO | Complain to the Information Commissioner's Office (ico.org.uk), the UK supervisory authority, if you are unhappy with how your data is handled. In the EU you can complain to your local data protection authority. |
Retention
Retention and deletion defaults
| Data | Retention policy |
|---|---|
| Account data | Retained for the life of the account, deleted within 30 days of closure. |
| Screening records | Retained for 5 years, or longer under an applicable legal hold. |
| Audit logs | Retained for 7 years. |
| Security and authentication logs | Retained for 2 years. |
Verified erasure requests are completed within 30 days. Backups are purged on their normal rotation cycle.
Submit a request
How to exercise your rights
Email our Data Protection Officer at dpo@on8.ai or reach us through our contact page. We verify identity before acting and respond within one month, as the UK GDPR requires.
For processing terms, read our Data Processing Agreement, or email dpo@on8.ai for a counter-signed copy. See also our cookie policy.