Prohibited Data Policy

Permanent rule

Special categories of personal data under Article 9 GDPR, data relating to criminal convictions and offences under Article 10, and minors' data are permanently excluded from Owevaro. No plan, consent, configuration or exemption permits their upload, storage or analysis. Examples include health, biometric data used for identification, racial or ethnic origin, political opinions, religion, trade-union membership, sex life or sexual orientation, criminal records, criminal proceedings and data concerning minors.

Mandatory declaration and evidence

Before each upload, the user must confirm, through boxes that are not preselected, that they are entitled to upload the document and that the file does not contain special-category data, criminal-offence data or minors' data. The server links the identifier, version and SHA-256 of this policy, the declarations and a server-side timestamp to that upload. The declaration is an organisational control and evidence of the instructions received: it does not create a legal basis, authorise prohibited data or transfer all responsibility to the uploader.

Verified technical status

The UI and API require separate confirmations. TXT files undergo deterministic screening; PDFs and images are checked by antivirus software, reconstructed by the CDR and subjected to local OCR on the reconstructed content. The same screening blocks text before any extraction. OCR text and prohibited content are neither recorded in logs nor retained as separate output; the response contains category codes only. In the permitted local flow, the original is deleted at the end of extraction and is not promoted to durable document storage.

Lexical screening and OCR are not infallible legal classifiers: they may produce false positives, fail to read handwriting or poor scans, and fail to detect indirect wording. An unreadable, ambiguous or flagged file is rejected and deleted from quarantine; it does not reach durable storage, indexing or AI. The real-data gate remains closed until the residual risk associated with the permanent policy and its screening has undergone professional review.

Precautionary challenge process

The rejection response provides a review code, policy version and request reference without excerpts from the document. The rejected original is not retained. A person who believes the control produced a false positive may request review by citing only the reference, without attaching the file or reproducing sensitive passages. Owevaro checks the configuration, engine version, category and reproducibility using an equivalent synthetic sample; it does not retrieve the deleted file and does not apply a manual bypass to an individual upload. The user may also remove or redact the disputed passage and try again.

If the technical review confirms a general defect, the rule is corrected, tested against the synthetic corpus and deployed with a new version before the user is invited to upload again. If the doubt requires legal classification or access to real content, the case remains blocked and is referred to the competent professional. Internal operational targets are acknowledgement within five working days and completion within ten; these are not a contractual SLA until the Terms and support arrangements are approved.

Required flow before real data

1. preliminary control before promotion;
2. separate quarantine and minimum access;
3. no transmission to AI, indexing or content logging;
4. cautious notice to the user without exposing the data;
5. verified deletion or false-positive handling;
6. audit with codes, not content;
7. complaint/human-review process;
8. tests using synthetic samples only.

No product exception

Owevaro does not provide an exceptional flow for these data. If a future product change sought to introduce one, it would constitute a new and separate scope rather than an implied amendment to this policy: it would require a new controller decision, a new DPIA, new professional review, new documents/versions and a new implementation kept closed until every gate had been completed.