Kraylo Privacy Notice

KRAYLO LTD (company number 17324157) of 66 Paul Street, London, England, EC2A 4NA ("Kraylo", "we", "us" or "our") is committed to handling personal data fairly and transparently. This notice explains how we use personal data when you visit kraylo.co.uk, use Kraylo's applications, request a demonstration, contact us, or act for one of our business customers (together, the "Services").

For questions or to make a privacy request, contact support@kraylo.co.uk. You can also write to us at the address above.

1. Roles

For website visitors, prospective customers, business contacts, billing contacts and Kraylo account administrators, Kraylo is normally the controller of personal data.

For operational data uploaded to or generated in the platform by a customer - including data about its personnel, drivers, orders, stock, banking activity and other business operations - the customer is normally the controller and Kraylo is its processor. Our Data Processing Addendum forms part of the customer agreement and explains that processing.

2. Personal data we collect

Depending on how you use the Services, we may collect:

• Contact and account information: name, work email address, telephone number, company, job title, account credentials and role.
• Customer operational data: information that a customer or its users enter, upload or create in the Services. This may include personnel and driver details, operational records, orders, stock, receipts/files, banking-related records, reports, support tickets and audit entries.
• Usage and technical information: IP address, device/browser and app information, log data, session/activity records, diagnostics and security events.
• Communications: enquiries, demo requests, support messages, feedback and records needed to manage a request.
• Billing information: subscription and purchase information. Card payment data is processed by Stripe and is not stored by Kraylo.

Please do not upload special-category personal data (for example health information) unless your organisation has agreed this with us and has a valid lawful basis.

3. How we use personal data and our lawful bases

Where we process customer operational data as processor, the customer decides the purposes and lawful basis, and we process only on its documented instructions under the DPA.

4. Who we share data with

We share personal data only where necessary with:

• service providers that help us host, secure, operate or support the Services, including Vercel, Supabase, Stripe, Resend (transactional email delivery), PostHog (product and website analytics) and Sentry (application error monitoring and diagnostics);
• professional advisers, insurers, auditors and authorities where required or appropriate;
• a buyer, investor or successor in connection with a merger, acquisition, financing or sale, subject to appropriate safeguards; and
• other recipients where you or the relevant customer directs us to share data, or where required by law.

We do not sell customer operational data or share it with third parties for their own marketing. See our Subprocessor List for the current provider categories and locations.

5. International transfers

Kraylo's production database and application compute are configured in Germany (EU). Website delivery uses Vercel's global CDN, and some providers or support activities may involve access from outside the UK or EU. Where a restricted transfer occurs, we use an appropriate UK GDPR transfer mechanism, such as adequacy regulations or the UK International Data Transfer Agreement/Addendum together with supplementary measures where appropriate. You may request more information at support@kraylo.co.uk.

6. Retention

We retain controller data only for as long as needed for the purposes described above, including statutory record-keeping and limitation periods. Customer operational data is retained for the customer-agreed term and then returned or deleted in accordance with the customer agreement and DPA, unless law requires longer retention. Backups are retained on the schedule in our applicable service documentation.

7. Security

We use appropriate technical and organisational measures designed to protect personal data. These include HTTPS/TLS, authentication, role-based access controls, database row-level tenant isolation, audit logging, managed encrypted cloud infrastructure, controlled releases and backups. No system can be guaranteed completely secure.

8. Your rights

Subject to the UK GDPR and any applicable law, you may have rights to access, correct, erase, restrict or object to processing, receive portable data, and withdraw consent. To exercise a right regarding data for which Kraylo is controller, contact support@kraylo.co.uk. We may need to verify your identity.

If we process your data for a Kraylo customer, contact that customer first; it is normally the controller. We will assist the customer as required by our DPA.

You may complain to the UK Information Commissioner's Office at ico.org.uk if you are unhappy with how we handle your data.

9. Cookies and marketing

Our website may use strictly necessary cookies to make it work. We use optional analytics or marketing technologies only where required consent has been obtained. See the Cookie Notice and the cookie settings link on our website. You can unsubscribe from marketing messages using the link in the message or by contacting us.

10. Children and third-party links

The Services are designed for business use and are not intended for children. Our website may link to third-party sites; their privacy practices are governed by their own notices.

11. Changes

We may update this notice from time to time. The "Last updated" date shows when it was last revised. If changes are material, we will provide additional notice where appropriate.