Privacy Policy

1. Who we are

Klyfton OS Ltd (“Klyfton”, “we”, “us”, “our”) is the controller of personal data collected through the website at klyfton.io (the “Site”). We are a company registered in England and Wales (Company No. 17253114) with our registered office at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018 (“UK GDPR”) and, where it applies to visitors in the European Economic Area, the EU General Data Protection Regulation (“EU GDPR”).

Questions or requests relating to this policy can be sent to founder@klyfton.io, or by post to the registered office above, marked “Data Protection”.

This policy covers the Site only. If and when you use the Klyfton platform, a separate platform privacy notice will apply and will be provided to you at that time.

2. Scope — what this policy covers

This policy explains what personal data we collect through the Site, why we collect it, the legal bases we rely on, who we share it with, how long we keep it, and the rights you have. It applies to visitors browsing the Site, people who join our waitlist or contact us, and recipients of our updates.

3. The personal data we collect

• Identity and contact data — your name, email address, and any details you choose to share when joining the waitlist or contacting us (for example, your creator handle, platform(s), or company name).
• Communications data — the content of messages you send us, and our correspondence with you.
• Technical data — IP address, browser type and version, device identifiers, operating system, time-zone setting, and general location inferred from your IP address.
• Usage data — how you interact with the Site, including pages visited, referral source, and time spent.
• Marketing-preference data — your subscription status and communication preferences.

We do not intend to collect special-category data (such as health or biometric data) through the Site, and we ask that you do not send it to us. The Site is not directed at children, and we do not knowingly collect data from anyone under 18.

4. How we use your data and our lawful bases

Under the UK and EU GDPR, we must have a lawful basis for each use of your personal data. These are set out below:

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms, and you have the right to object at any time (see section 9). We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not sell your personal data.

5. Cookies and similar technologies

The Site uses cookies and similar technologies. Strictly necessary cookies are used to make the Site work and are set on the basis of our legitimate interests. Analytics, functionality, and marketing cookies are set only with your consent, which you can give, refuse, or withdraw at any time via the cookie banner or your browser settings. Further detail on the specific cookies we use, their purposes, and their lifetimes is set out in our Cookie Policy [link] / the cookie settings panel on the Site.

6. Who we share your data with

We share personal data with service providers who process it on our behalf under written contracts that meet the requirements of Article 28 UK/EU GDPR. These include providers of:

• website hosting and infrastructure;
• email delivery and marketing tools (for waitlist and update communications);
• analytics services; and
• professional advisers (lawyers, accountants, insurers) where necessary.

We may also disclose personal data where required by law or regulation, to a court or authority, or in connection with a corporate transaction such as a merger, financing, or sale of assets, in which case the recipient will be bound by obligations consistent with this policy. We do not share your Site data with banking or payment partners; any such sharing would occur only under the separate platform terms and privacy notice if you become a Klyfton customer.

7. International transfers

Some of our service providers are located outside the United Kingdom and the European Economic Area. Where personal data is transferred internationally, we ensure appropriate safeguards are in place: an adequacy decision by the UK Government or European Commission, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, together with any supplementary measures needed. You can request a copy of the relevant safeguards using the contact details in section 1.

8. How long we keep your data

• Waitlist and marketing data — for as long as you remain subscribed, and removed or suppressed promptly after you unsubscribe or ask us to delete it.
• Enquiry correspondence — for up to 24 months after our last exchange, unless a longer period is needed for a legal claim.
• Technical and analytics data — in identifiable form for no longer than 26 months, after which it is deleted or anonymised.

We may retain limited data for longer where required by law or to establish, exercise, or defend legal claims. When data is no longer needed, we securely delete or anonymise it.

9. Your rights

Under the UK and EU GDPR, you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate or incomplete data;
• erase your data in certain circumstances (“right to be forgotten”);
• restrict processing in certain circumstances;
• data portability — receive data you provided to us in a structured, commonly used, machine-readable format;
• object to processing based on legitimate interests, and to direct marketing at any time (in which case we will stop);
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal; and
• not be subject to solely automated decisions with legal or similarly significant effects.

To exercise any of these rights, contact us at founder@klyfton.io. We will respond within one month (extendable by two further months for complex requests, in which case we will tell you). We will not charge a fee unless a request is manifestly unfounded or excessive, and we may need to verify your identity before acting.

Every marketing email we send includes an unsubscribe link, which takes effect promptly.

10. Complaints

If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or, if you are in the EEA, with the supervisory authority in your country of residence or place of work (for example, the AEPD in Spain).

11. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including encryption in transit, access controls, and vetting of our processors. No transmission over the internet is completely secure, so we cannot guarantee absolute security, but we will notify you and the relevant authority of a personal data breach where the law requires us to do so.

12. Third-party links

The Site may link to third-party websites and services. This policy does not cover those sites, and we encourage you to read their own privacy notices.

13. Changes to this policy

We may update this policy from time to time. The current version will always be posted on the Site with a revised “Last updated” date, and we will notify you of material changes where required by law (for example, by email if you are on our waitlist).

14. Contact

Klyfton OS Ltd

71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom

Email: founder@klyfton.io