Your rights under GDPR Article 22

What this page tells you

You have rights when an organisation uses automated systems to make decisions about you that have legal or similarly significant effects — including credit decisions. This page explains those rights in plain language and tells you how Marvin handles them.

Your rights, in plain terms

• You have the right not to be subject to a decision based solely on automated processing if that decision has a legal or similarly significant effect on you (Article 22 of the EU General Data Protection Regulation).
• That right has narrow exceptions: when the decision is necessary to enter into or perform a contract you've requested, when it's authorised by EU or member-state law with safeguards in place, or when you've given explicit consent.
• Even when an exception applies, you have the right to obtain human intervention, to express your point of view, and to contest the decision.
• You have the right to a meaningful explanation of how the decision was reached.

How Marvin handles automated decisions

Marvin is designed as a co-pilot for credit officers, not an autonomous decision system. Every credit decision Marvin produces is reviewed by a named human officer at the lender before it's communicated to you:

• Marvin's output is one of four outcomes — approve,reject, review, or rework — together with a regulator-readable rationale, the policy citations the system relied on, and a confidence score.
• The lender's officer reviews this material, may override it, and is the named accountable decision-maker. The system does not communicate decisions to borrowers directly.
• Approvals that carry conditions, decisions to reject, and any case the system flags as review all require a four-eyes human sign-off before execution.

Because of this human-in-the-loop design, decisions that involve Marvin are not solely automated within the meaning of Article 22(1). Your right to obtain human intervention, express your view, and contest the decision is preserved at the lender's end of the process; the lender's officer is the contact point.

Exercising your rights

Marvin is the technology vendor; the lender that asked you for credit is the data controller and the right place to direct Article 22 requests. The lender's privacy notice will tell you who to contact.

If your enquiry concerns the design of Marvin itself rather than a specific decision, you can email hello@marvinos.uk. We'll route legitimate enquiries to the appropriate lender and cooperate as a processor.

Related material

• Data Protection Impact Assessment (DPIA) template — what processing Marvin performs, what risks it identifies, and what mitigations are in place.
• The MODEL_CARD.md at the project root documents intended use, data sources, eval results, known limitations, and the four version pins recorded on every decision.