Privacy Policy

Last updated: 18/08/2026

Privacy Policy


Joown Ltd trading as Matriva

We are the controller of your personal data. For more information on controllers and their responsibilities, please see our guidance on data protection principles, definitions, and key terms.


This privacy notice tells you what to expect us to do with your personal information.


Contact details

security@matriva.co.uk


What information we collect, use, and why


We collect or use the following information to provide services and goods, including delivery:

  • Names and contact details

  • Addresses

  • Date of birth

  • Purchase or account history

  • Payment details (including card or bank information for transfers and direct debits)

  • Credit reference information

  • Website user information (including user journeys and cookie tracking)

  • Identification documents


We collect or use the following information for the operation of customer accounts and guarantees:

  • Names and contact details

  • Addresses

  • Payment details (including card or bank information for transfers and direct debits)

  • Account information, including registration details

  • Information used for security purposes

  • Marketing preferences


We collect or use the following information to prevent, detect, investigate or prosecute crimes:

  • Names and contact information


We collect or use the following information for service updates or marketing purposes:

  • Names and contact details

  • Addresses

  • Marketing preferences

  • Location data

  • IP addresses

  • Website and app user journey information


We collect or use the following information to comply with legal requirements:

  • Name

  • Contact information

  • Identification documents

  • Financial transaction information


We collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details

  • Address

  • Payment details

  • Account information

  • Purchase or service history


Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.


Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide services and goods are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

  • 1. Purpose of Processing

    Joown Ltd processes personal data in order to provide, administer, and improve the services and goods offered to our customers and users. This includes, but is not limited to, verifying identity, assessing suitability for services, facilitating transactions, communicating with customers regarding their accounts or enquiries, and delivering a personalised and efficient customer experience. We have identified that processing personal data for these purposes constitutes a legitimate interest under Article 6(1)(f) of the UK GDPR, as set out in this assessment.

  • 2. The Legitimate Interest

    We have a genuine and lawful business interest in processing personal data to: - Deliver the services and goods that customers have requested or expressed interest in - Verify that individuals meet eligibility criteria for specific services - Maintain accurate records necessary to fulfil contractual and pre-contractual obligations - Protect the business and its customers from fraud, misrepresentation, or misuse of services - Improve our products and services based on how they are used and experienced Communicate with customers in ways that are relevant to their relationship with us These interests are real, specific, and directly connected to the lawful operation of our business. They are not speculative or overly broad.

  • 3. Necessity Test

    We have considered whether the same purposes could be achieved without processing personal data, or by processing less data. We have concluded that: The processing is necessary to deliver the service — it cannot be provided without it We collect only the minimum data required for each specific purpose Where possible, we use aggregated or anonymised data in preference to identifiable personal data We do not process data beyond what is reasonably required for the stated purpose

  • 4. Balancing Test

    We have considered the reasonable expectations of the individuals whose data we process and weighed these against our legitimate interests. Individuals engaging with our services would reasonably expect their personal data to be used to deliver those services. The data processed is proportionate to the nature of the service being provided Processing is conducted in a manner that minimises intrusion into individuals\' private lives. We implement appropriate technical and organisational security measures to protect personal data at all times. Individuals retain the right to object to processing based on legitimate interests at any time, and we will honour such requests unless we can demonstrate compelling legitimate grounds that override the individual\'s interests We have concluded that our legitimate interests are not overridden by the rights and freedoms of the individuals concerned, provided processing is conducted transparently and proportionately.


  • 5. Safeguards

    To ensure that processing remains proportionate and respectful of individual rights, we apply the following safeguards: Clear and accessible privacy notices are provided at the point of data collection Data is retained only for as long as necessary for the stated purpose Access to personal data is restricted to authorised personnel on a need-to-know basis Individuals are informed of their rights, including the right to object, access, rectify, or erase their data A Data Protection Officer or nominated lead is available to handle queries and complaints
     

  • 6. Conclusion

    We are satisfied that processing personal data for the purpose of providing services and goods represents a genuine legitimate interest, that such processing is necessary and proportionate, and that it does not unduly prejudice the rights and interests of the individuals concerned. This assessment will be reviewed annually or whenever a material change in processing activities occurs.


For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

  • Recognised legitimate interests - our pre-approved purpose for collecting or using personal information to provide and improve products and services for clients are:

We need to share personal information with a public authority or another organisation because they need it for their public tasks or official functions (the ‘public task disclosure response condition’).

Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

  • 1. Overview

    Joown processes personal data in connection with the creation and operation of customer accounts and the administration of any guarantees offered as part of our products or services. This document sets out the lawful bases upon which such processing is conducted, in accordance with Article 6 of the UK GDPR.

  • 2. Lawful Bases Applied

    • 2.1 Contract

      The primary lawful basis for processing personal data in connection with customer accounts is that processing is necessary for the performance of a contract to which the data subject is party, or to take steps at the request of the data subject prior to entering into a contract. This applies to: Creating and maintaining a customer account at the customer\'s request Verifying identity and eligibility to use our services Processing transactions, payments, and order histories Managing account access, preferences, and settings Communicating with the customer regarding their account status Administering guarantees, warranties, or service commitments attached to goods or services purchased Without this processing, we would be unable to fulfil our contractual obligations to the customer.

    • 2.2 Legal Obligation

      Certain processing activities are required to comply with legal obligations to which Joown is subject. This includes: Retaining transaction records for the purposes of tax and financial compliance Responding to lawful requests from regulatory bodies or law enforcement Maintaining records necessary to demonstrate compliance with consumer protection legislation Honouring statutory guarantee and warranty rights under the Consumer Rights Act 2015

    • 2.3 Legitimate Interests

      Where processing is not strictly required to fulfil a contract or legal obligation, we rely on legitimate interests where our interests are not overridden by the rights and freedoms of the individual. This applies to: Fraud prevention and the protection of customer accounts from unauthorised access Maintaining records of guarantee claims to identify patterns and improve product quality Communicating with customers about changes to account terms or service conditions that may affect them Internal analysis to improve account management processes and customer experience We have conducted a Legitimate Interests Assessment confirming that this processing is proportionate and does not unduly prejudice individual rights.

    • 2.4 Consent

      Where processing goes beyond what is necessary for the above purposes - for example, sending optional marketing communications or using account data for profiling - we will seek the customer's explicit consent. Consent is recorded at the point of collection and may be withdrawn at any time without affecting the lawfulness of prior processing or the customer's ability to use our core services. 

3. Special Category Data

We do not routinely process special category data in connection with customer accounts or guarantees. Should this become necessary in specific circumstances, an additional lawful basis under Article 9 UK GDPR will be identified and documented separately. 

4. Individual Rights Customers have the following rights in relation to this processing:

Access - to obtain a copy of their personal data
Rectification - to correct inaccurate data
Erasure - subject to our legal and contractual retention obligations
Restriction - to limit processing in certain circumstances
Objection - to processing based on legitimate interests Portability - to receive account data in a structured, machine-readable format

Requests should be directed to security@matriva.co.uk. 

5. Retention

Personal data processed under these lawful bases is retained only for as long as necessary. Account data is held for the duration of the customer relationship and for a period of 5 years thereafter, in line with our Data Retention Policy and applicable legal requirements.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information to prevent, detect, investigate or prosecute crimes are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

  • Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

    Our legitimate interests are:

  • 1. Purpose of Processing

    Joown Ltd processes personal data where necessary to prevent, detect, investigate, or assist in the prosecution of criminal activity. This includes fraud, identity theft, money laundering, misrepresentation, and any other unlawful conduct that may affect our business, our customers, or the wider public. We rely on legitimate interests under Article 6(1)(f) of the UK GDPR as the lawful basis for this processing, supported where applicable by Schedule 1, Part 2, Paragraph 10 of the Data Protection Act 2018, which expressly recognises the prevention and detection of crime as a legitimate processing purpose.

  • 2. The Legitimate Interest

    We have a genuine and pressing interest in processing personal data to: Detect and prevent fraudulent applications, transactions, or account activity Verify that individuals are who they claim to be and are not acting under false pretences Identify patterns of behaviour consistent with criminal activity or abuse of our services Share relevant information with law enforcement, regulators, or other authorised bodies where required or permitted by law Protect our customers, employees, and business from financial or reputational harm caused by criminal conduct Maintain the integrity and trustworthiness of our platform and services These interests are substantial, specific, and directly connected to the protection of individuals and the lawful operation of our business.

  • 3. Necessity Test

    We have considered whether these purposes could be achieved without processing personal data or with less intrusive means. We have concluded that: Effective crime prevention cannot be achieved without analysing relevant personal data We process only the data necessary to identify genuine risk indicators Automated screening is used proportionately and is subject to human review where decisions may significantly affect individuals We do not use this basis to justify speculative or disproportionate surveillance of customers

  • 4. Balancing Test

    We have carefully weighed our interests against the rights and freedoms of individuals: Customers engaging with financial or property-related services would reasonably expect basic fraud and crime prevention checks to be carried out The nature of the data processed is proportionate to the risk being assessed Processing is conducted discreetly and does not unnecessarily intrude on individuals\' private lives Where a concern is not substantiated, data relating to that assessment is not retained beyond what is necessary Individuals retain the right to object to processing based on legitimate interests, subject to our ability to demonstrate compelling grounds where crime prevention is at stake We are satisfied that our interests are not overridden by individual rights, given the significant public benefit of preventing criminal harm.

  • 5. Safeguards

    Access to data processed for crime prevention purposes is strictly limited to authorised personnel Data is not used for any secondary purpose unrelated to crime prevention or detection Retention periods are kept to the minimum necessary, unless a live investigation requires longer retention Any disclosure to third parties, including law enforcement, is documented and conducted only where lawful authority exists Individuals are informed of this processing in our Privacy Notice, except where disclosure would prejudice an active investigation

  • 6. Conclusion

    Processing personal data to prevent, detect, investigate, or prosecute crime represents a clear and proportionate legitimate interest. The significant harm that criminal activity can cause to individuals and businesses justifies this processing, provided it is conducted responsibly, transparently where possible, and with appropriate safeguards in place. This assessment will be reviewed annually or upon any material change in processing activities or applicable legislation.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

  • Recognised legitimate interests - our pre-approved purpose for collecting or using personal information to prevent, detect, investigate or prosecute crimes are:

We need to share personal information with a public authority or another organisation because they need it for their public tasks or official functions (the ‘public task disclosure response condition’).

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

  • 1. Purpose of Processing

    Joown Ltd processes personal data to keep customers informed about updates to our services and to communicate marketing information about products, services, and offers that may be relevant to them. We rely on legitimate interests under Article 6(1)(f) of the UK GDPR for this processing, subject to the conditions and safeguards set out below. Where electronic direct marketing is involved, we also comply with the Privacy and Electronic Communications Regulations 2003 (PECR), including the soft opt-in exemption where applicable.
     

  • 2. The Legitimate Interest

    We have a genuine business interest in processing personal data to: Inform existing customers of important updates, changes, or improvements to services they already use Notify customers of new products or services that are similar in nature to those they have previously purchased or enquired about Communicate time-sensitive information relevant to a customer\'s account or service relationship Promote our business to prospective customers whose interests and circumstances suggest our services may be relevant to them Maintain an ongoing relationship with customers that supports retention and satisfaction These interests are real, proportionate, and directly connected to the lawful operation of our business.

  • 3. Necessity Test

    We have considered whether these purposes could be achieved without processing personal data or through less intrusive means: Service updates cannot be communicated without using contact details held on record Marketing is targeted based on existing customer relationships or reasonable indicators of relevance, not indiscriminate mass contact We use the minimum data necessary to identify the appropriate audience and deliver the communication Where aggregated or anonymised data can achieve the same result, we prefer that approach 

  • 4. Balancing Test

    We have weighed our interests carefully against the rights and freedoms of the individuals concerned: Existing customers would reasonably expect to receive communications about services they use or have used Marketing is directed only at individuals where a prior relationship exists or where there is a clear and reasonable connection to our services All marketing communications include a clear, simple, and free opt-out mechanism Opt-out requests are actioned promptly and preferences are respected across all channels We do not sell or share personal data with third parties for their own marketing purposes without explicit consent Individuals are informed of this processing in our Privacy Notice at the point their data is collected We are satisfied that our legitimate interests are not overridden by individual rights, provided opt-out mechanisms are prominent and consistently honoured.

  • 5. Safeguards

    Marketing lists are reviewed and suppression lists updated regularly Frequency of communications is kept reasonable to avoid causing nuisance Electronic marketing to existing customers is conducted under the PECR soft opt-in exemption only where all conditions are met Consent is obtained for electronic marketing to new contacts where the soft opt-in does not apply Consent records and opt-out requests are logged and auditable This basis is not used to justify profiling or behavioural tracking beyond what is necessary for basic audience segmentation

  • 6. Conclusion

    Processing personal data for service updates and relevant marketing communications represents a proportionate and genuine legitimate interest. Provided individuals are clearly informed, given meaningful control over their preferences, and can opt out easily at any time, we are satisfied that this processing respects the reasonable expectations of our customers and does not unduly prejudice their rights. This assessment will be reviewed annually or upon any material change to our marketing activities or applicable regulations.


For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.


Our lawful bases for collecting or using personal information for legal requirements are:


  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

    Our legitimate interests are:

  • 1. Purpose of Processing

    Joown processes personal data where necessary to comply with legal and regulatory obligations to which we are subject. While legal compliance is primarily governed by Article 6(1)(c) of the UK GDPR — which permits processing necessary to fulfil a legal obligation — there are circumstances where no specific legal obligation exists but where processing is nonetheless necessary to protect our legal position, respond to legal proceedings, or demonstrate regulatory compliance. In these circumstances we rely on legitimate interests under Article 6(1)(f) as the applicable lawful basis.

  • 2. The Legitimate Interest

    We have a genuine and substantial interest in processing personal data to: Retain records necessary to demonstrate compliance with applicable legislation and regulation Respond to enquiries, audits, or investigations conducted by regulatory bodies or public authorities Establish, exercise, or defend legal claims, whether actual or anticipated Seek and act upon legal advice in connection with our business activities Monitor and document compliance with internal policies that reflect external legal requirements Ensure that contractual obligations with third parties, including suppliers and partners, are met and evidenced These interests are specific, legitimate, and directly connected to our ability to operate lawfully and protect the rights of our business and our customers.

  • 3. Necessity Test

    We have considered whether these purposes could be achieved without processing personal data or through less intrusive means: Legal compliance and the defence of legal claims cannot be achieved without retaining relevant records that may include personal data We retain only the data that is reasonably necessary to fulfil the legal or regulatory purpose identified Where anonymisation or pseudonymisation can achieve the same compliance objective, we apply those techniques in preference to retaining fully identifiable data Retention periods are defined by the nature of the legal requirement and are not extended beyond what is justifiable

  • 4. Balancing Test

    We have carefully weighed our legitimate interests against the rights and freedoms of the individuals whose data we process: Individuals engaging with regulated services would reasonably expect their data to be retained for legal and compliance purposes The volume and sensitivity of data retained is proportionate to the specific legal risk or obligation being addressed Data processed under this basis is not used for unrelated commercial purposes Individuals are informed of this processing through our Privacy Notice Where individuals request erasure of their data, we will honour that request unless retention is necessary to comply with a legal obligation or defend a legal claim, in which case we will explain the basis for continued retention clearly and promptly We are satisfied that our legitimate interests in maintaining legal compliance are not overridden by individual rights, given the significant consequences that regulatory non-compliance or undefended legal claims could have for both our business and our customers.

  • 5. Safeguards

    Data retained for legal compliance purposes is held securely and accessed only by authorised personnel with a genuine need Retention schedules are documented and reviewed regularly against current legal requirements Data is deleted promptly once the legal or regulatory purpose for which it was retained has been fulfilled Any disclosure to regulators, courts, or legal advisers is conducted only where lawful authority or genuine necessity exists and is documented accordingly Individuals are notified of disclosures affecting them wherever legally permissible

  • 6. Conclusion

    Processing personal data to comply with legal requirements and protect our legal position represents a clear, proportionate, and genuine legitimate interest.


For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

  • Recognised legitimate interests - our pre-approved purpose for collecting or using personal information to comply with legal requirements are:

We need to share personal information with a public authority or another organisation because they need it for their public tasks or official functions (the ‘public task disclosure response condition’).

  • Recognised legitimate interests - our pre-approved purpose for collecting or using personal information for recruitment purposes are:

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

  • Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

  • Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

  • Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

    Our legitimate interests are:

  • 1. Purpose of Processing

    Joown Ltd processes personal data where necessary to receive, investigate, and respond to queries, complaints, and claims raised by customers, third parties, or other individuals in connection with our products and services. We rely on legitimate interests under Article 6(1)(f) of the UK GDPR as the lawful basis for this processing.

  • 2. The Legitimate Interest

    We have a genuine interest in processing personal data to: Receive and log queries or complaints submitted by customers or third parties Investigate the circumstances surrounding a complaint or claim thoroughly and fairly Communicate with the individual during the resolution process Retain records of queries, complaints, and outcomes for quality assurance and dispute resolution purposes Identify recurring issues that indicate a systemic problem requiring remediation Defend or respond to claims made against our business, including those escalated to third party resolution services or legal proceedings These interests are real, proportionate, and directly connected to our duty to treat customers fairly and operate our business responsibly.

  • 3. Necessity Test

    We have considered whether these purposes could be achieved without processing personal data: Queries and complaints cannot be investigated or resolved without reference to the personal data relevant to the individual\'s circumstances We process only the data necessary to understand, investigate, and resolve the matter raised Records are retained for the minimum period necessary to fulfil quality, regulatory, and legal requirements

  • 4. Balancing Test

    We have weighed our interests against the rights and freedoms of individuals: Individuals raising a query or complaint would reasonably expect their personal data to be used to investigate and resolve it Processing is limited to what is relevant and necessary for the specific matter in hand Data relating to resolved complaints is not used for unrelated purposes Individuals are informed of this processing through our Privacy Notice The right to object is available, though objections must be balanced against our legitimate need to investigate and respond to matters raised We are satisfied that our interests are not overridden by individual rights, given that this processing is in the direct interest of the individuals raising queries or complaints.

  • 5. Safeguards

    Complaint and query records are held securely and accessed only by authorised personnel handling the matter Data is retained in line with our Data Retention Policy and deleted once no longer required for resolution, quality assurance, or legal purposes Disclosures to third parties, such as ombudsman services or legal representatives, are made only where necessary and lawful Individuals are kept informed of how their data is being used throughout the resolution process

  • 6. Conclusion

    Processing personal data to handle queries, complaints, and claims is a proportionate and necessary legitimate interest. It serves both our business and the individuals concerned by ensuring matters are investigated fairly, resolved promptly, and recorded accurately. This assessment will be reviewed annually or upon any material change to our complaints handling processes.


For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.


  • Recognised legitimate interests - our pre-approved purpose for collecting or using personal information for dealing with queries, complaints or claims are:

We need to prevent, detect, or investigate a crime, including the apprehension and prosecution of offenders (the ‘crime condition’).


Where we get personal information from

  • Directly from you

  • Publicly available sources

  • Previous employers

  • Credit reference agencies


How long we keep information

We keep your information for a minimum of 5 years from the date you submitted that information.

For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.


How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: security@matriva.co.uk

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO. 

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint