Data Privacy & Cookie Governance Policy

1. Data Controller Identification & Statutory Framework

Kyrvyn Ltd ("we", "us", or "our") is the Data Controller responsible for personal data collected via this website and our associated services. We operate in strict compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), the Privacy and Electronic Communications Regulations 2003 (PECR), and align our operational workflows with ISO/IEC 27001:2022 (Information Security) and ISO/IEC 27701:2019 (Privacy Information Management).

2. Lawful Bases for Data Processing (UK GDPR Article 6)

We process personal data only when there is an explicit lawful basis under Article 6 of the UK GDPR:

• Commercial Inquiries & Scoping: Processed under Article 6(1)(b) (Performance of a contract or steps prior to entering into a contract) and Article 6(1)(f) (Legitimate interests) to review requirements, prepare engineering roadmaps, and communicate feasibility.
• Newsletter & Technical Insights: Processed under Article 6(1)(a) (Consent). You can revoke consent at any time via one-click unsubscribe links.
• Store Purchases & Invoicing: Processed under Article 6(1)(b) (Contractual necessity) and Article 6(1)(c) (Legal obligation) to deliver digital goods, book retainer services, and comply with UK statutory accounting/HMRC obligations.
• Platform Security & Fraud Prevention: Processed under Article 6(1)(f) (Legitimate interests) to prevent abuse, enforce rate limits, and maintain system integrity.
• Optional Telemetry & Analytics: Processed under Article 6(1)(a) (Consent) via our cookie preferences banner.

4. Data Retention Schedule (UK GDPR Article 13(2)(a))

We retain personal data strictly for as long as necessary to fulfill the specific purpose for which it was acquired:

• Contact inquiries & project briefs: Retained for 12 months after last communication, unless engaged under an active commercial contract.
• Commercial contracts, orders & invoices: Retained for 6 years to satisfy UK Companies Act and HMRC statutory audit requirements.
• Newsletter subscriptions: Retained until you click unsubscribe or request deletion.
• Server access & rate limit telemetry: In-memory and transient; cleared automatically.

5. International Data Transfers & Sub-Processors

Data is stored primarily on UK and EEA cloud infrastructure. Where third-party cloud service providers (such as Vercel, Neon Database, or transactional mail dispatchers) process information outside the UK/EEA, transfers are secured via statutory safeguards, including the UK International Data Transfer Agreement (IDTA) or European Commission Standard Contractual Clauses (SCCs).

6. Automated Lead Scoring & AI Transparency Notice

In accordance with UK GDPR Article 22 and responsible AI standards (ISO/IEC 42001), our contact intake pipeline utilizes deterministic heuristics to classify technical inquiry categories and calculate response prioritization.

This automated categorization does not produce legal effects or similarly significant outcomes. All project roadmaps, fee quotes, technical proposals, and commercial contracts are subject to direct, mandatory review and approval by a senior engineer and founding director.

7. Individual Data Subject Rights (UK GDPR Articles 15–22)

Under UK data protection law, you have enforceable legal rights regarding your personal information:

• Right of Access (Subject Access Request - SAR): Request a copy of personal data held about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of data where no overriding statutory basis exists.
• Right to Restriction: Limit processing while accuracy or dispute claims are investigated.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format.
• Right to Object: Object at any time to direct marketing communications.

To exercise any of these rights, email our Data Protection Lead at privacy@kyrvynltd.co.uk (or contact@kyrvynltd.co.uk). Under our Standard Operating Procedure (SOP-PRV-01), we acknowledge requests within 48 hours and provide a full statutory response within one calendar month free of charge.

8. Right to Lodge a Complaint with the Supervisory Authority

If you have unresolved concerns regarding how your personal information is handled by Kyrvyn Ltd, you have the statutory right to lodge a complaint with the UK supervisory authority: