ObjectNow treats personal information as information entrusted to it for a defined purpose.

ObjectNow processes personal data so that it can provide and secure its services, including creating and transmitting representations where the user asks it to do so, maintaining the records needed to operate the service, verifying users, preventing abuse, responding to support requests and meeting legal or regulatory obligations. ObjectNow states in its published Privacy Policy that it acts as a data controller for the personal data it processes through its website and services and is registered with the Information Commissioner's Office.

ObjectNow does not sell personal information.

ObjectNow does not sell or rent users' personal data and does not disclose it to unrelated third parties for advertising, marketing or commercial data-broker purposes. This does not mean that personal information is never disclosed to anyone outside ObjectNow. Where a user asks ObjectNow to submit a representation, the information required for that representation is transmitted to the relevant planning, consenting or public authority.

Necessary service providers may process information on ObjectNow's behalf, and information may also be disclosed where required by law or where a lawful disclosure is necessary for the investigation or prevention of unlawful activity.

ObjectNow collects only information required for the service and its security.

Depending on the service being used, this can include a user's name, postal address, postcode, email address, information voluntarily included in a representation or support request, and limited technical or security information such as IP addresses, timestamps and server logs. Technical information is used for purposes such as verification, service reliability, duplicate and abuse detection, fraud investigation and protection of the platform.

Personal information is protected through technical and organisational controls.

ObjectNow uses encryption where reasonably practicable and restricts access to systems and information according to operational need. Access controls, verification measures, logging and security monitoring are intended to reduce unauthorised access, misuse and loss. No internet-connected service can truthfully guarantee absolute security, so ObjectNow's approach is to apply proportionate safeguards and review security controls as the service develops.

ObjectNow does not keep personal data simply because it may be useful in the future.

You have data-protection rights.

Depending on the circumstances, these include rights of access, rectification, erasure, restriction and objection. A Subject Access Request (SAR) can be used to ask for a copy of personal information ObjectNow holds about you together with the supplementary information required by data-protection law. ObjectNow must respond without undue delay and normally no later than one calendar month after receiving a valid request.

Where ObjectNow reasonably needs information to confirm the requester's identity, the response period starts when that necessary information is received. For a SAR, current law also permits the time limit to be paused where clarification is reasonably required to identify the information being requested.

Where a request is complex, or the individual has made a number of requests, the response period can be extended by up to a further two months, making the maximum period three calendar months from the applicable start date. If an extension is required, ObjectNow must tell the requester within the initial one-month period and explain why more time is necessary.

The right to be forgotten is a right to erasure, but it is not absolute.

UK GDPR Article 17 gives individuals a right to request erasure in specified circumstances. ObjectNow must respond to an erasure request without undue delay and normally no later than one calendar month after receiving the request. If information is reasonably required to verify the requester's identity, the response period begins when that necessary information is received.

Where the request is complex or the individual has made a number of requests, the response period can be extended by up to a further two months. ObjectNow must notify the requester within the first month if it needs to use that extension and explain why. The right to erasure is not absolute.

For example, continued processing may be permitted or required where there is a legal obligation or where the information is necessary for the establishment, exercise or defence of legal claims. ObjectNow will therefore assess what information is held, why it is held and whether an exception applies. If erasure is refused in whole or in part, the requester will be told the reason and informed of the right to complain to the ICO and seek a judicial remedy.

How do I make a Subject Access Request or ask ObjectNow to erase my information?

Submit a support ticket through the ObjectNow Support Centre and identify the request as a Data Protection, Subject Access or Right to Erasure request. Explain what you are asking ObjectNow to provide, correct, restrict or erase. To prevent somebody else from obtaining or deleting your information, ObjectNow may ask for proportionate information to verify identity where necessary. In the ordinary case the legal deadline is one calendar month, not 30 days.

For example, a request received on 3 September would ordinarily be due by 3 October. If the corresponding date does not exist in the following month, the deadline falls on the last day of that month; if it falls on a weekend or public holiday, the deadline moves to the next working day. Where a lawful extension applies, the total response period can reach three calendar months.

You can also raise a concern with the ICO.

If you believe your personal information has not been handled properly, you can raise the matter with ObjectNow so that it can investigate and respond. You also have the right to complain to the Information Commissioner's Office. ObjectNow's registration with the ICO does not amount to ICO approval or endorsement of ObjectNow; registration and regulatory oversight are distinct from endorsement.

Sources and further information

ObjectNow Privacy Policy

Information Commissioner's Office - A guide to subject access

Information Commissioner's Office - Right to erasure

Information Commissioner's Office - Storage limitation

Last checked: 26 September 2026

ObjectNow does not permit representations to be submitted in another person's identity without their knowledge and authority.

The platform is designed for genuine individuals to make their own deliberate decision to participate. Deliberately using another person's identity or personal information to create a representation that they did not authorise is misuse of the service and may also raise legal issues depending on what occurred, the information used and the intention of the person responsible.

The platform uses multiple layers of anti-abuse protection.

ObjectNow's controls include verification of access to the email address supplied by the user, human and bot detection, duplicate-submission controls, rate limiting and behavioural or security measures intended to identify suspicious or automated activity. Verification is not itself a submission: the user must progress through the process, make the required selections, review the representation and actively choose to submit it.

Suspicious activity can trigger additional protection.

Where ObjectNow's security systems identify activity that indicates a person may be the victim of impersonation, misrepresentation, unauthorised use of their details or other suspicious activity, the system can notify the affected user and provide steps for checking or reporting the activity. Automated security alerts are protective indicators rather than a finding that a criminal offence has occurred.

If you receive an alert or believe your details have been used without permission, report it promptly.

Submit a ticket through the ObjectNow Support Centre and select or state that the issue concerns suspected fraudulent submission, impersonation or misuse of personal data. Provide the representation or application reference if known, the email address affected and enough information for ObjectNow to identify the relevant transaction. Do not publish security codes, passwords or unnecessary identity documents in a public forum.

ObjectNow can preserve relevant technical records while the allegation is investigated.

Where a credible report of misuse is received, normal deletion or retention processes may need to be adjusted so that relevant security records are not destroyed while an investigation, dispute or potential legal claim is active. Any retention must still have a lawful purpose and be limited to what is necessary. Relevant material may include timestamps, verification events, IP or security logs, duplicate-detection records and transaction identifiers where those records exist.

ObjectNow will distinguish an allegation from evidence.

An unfamiliar representation, incorrect address, disputed email or security alert should be investigated, but none of those facts alone proves who was responsible or that a criminal offence occurred. ObjectNow can examine the records it controls, identify inconsistencies and preserve relevant evidence, but criminal responsibility is determined through the proper investigative and judicial process.

The relevant authority should also be told where an unauthorised representation has entered the official record.

ObjectNow can assist the affected person in identifying the recipient authority and the representation concerned. The authority controls its own official record and decides what action is appropriate in relation to a disputed representation. ObjectNow cannot unilaterally delete or alter a representation after it has entered another body's records.

ObjectNow can cooperate with police, regulators and other competent authorities through lawful channels.

If a law-enforcement authority investigates suspected criminal conduct, ObjectNow can preserve and, where there is a lawful basis, disclose relevant information needed for that investigation. ICO guidance makes clear that organisations can share personal information with law-enforcement authorities where the data-protection requirements are satisfied, but disclosure should be necessary, proportionate and limited to relevant information. A police request or court order may define what information is required.

ObjectNow's role is to preserve evidence and assist a lawful investigation, not to determine guilt.

Where the evidence indicates serious deliberate misuse, ObjectNow will cooperate with the relevant authority and provide available records through the appropriate legal process. ObjectNow will take reasonable steps to support the identification and investigation of the responsible person. Whether somebody is charged, prosecuted or convicted is a matter for the police, prosecutors and courts, not ObjectNow.

Security investigations do not remove the affected person's data-protection rights.

A person who believes their details were misused can also make a Subject Access Request or request rectification, restriction or erasure where the relevant right applies. Some information may need to be retained where necessary for an active investigation, compliance with law or the establishment, exercise or defence of legal claims. ObjectNow will explain the position where a request cannot lawfully be fulfilled in full.

Why does ObjectNow retain limited security information?

Anti-fraud controls are effective only if suspicious events can be investigated after they occur. Limited technical records can help establish whether a verification was completed, when an action occurred, whether repeated attempts came from the same technical source and whether automated or duplicate behaviour was detected. These records are not retained for advertising or profiling. Their purpose is platform security, accountability, abuse prevention and, where necessary, supporting a lawful investigation.

Sources and further information

ObjectNow Privacy Policy

ObjectNow - verification and anti-abuse safeguards

Information Commissioner's Office - Sharing personal data with law enforcement authorities

Information Commissioner's Office - Personal data breaches: a guide

Last checked: 26 September 2026