Your GDPR Rights.

We are committed to protecting your personal data. This notice explains what data we hold about you, why we hold it, and how you can exercise your rights under UK GDPR.

■ Version 1.0   |   Effective date: 1 March 2026   |   Last reviewed: 1 March 2026

1. Who We Are

KEYSY Ltd ("KEYSY", "we", "us") is the data controller for the personal data collected through our website at keysy.uk and through the KEYSY platform. As data controller, we determine the purposes and means of processing your personal data.

Where your employer or organisation subscribes to KEYSY on your behalf, we act as both data controller (for our relationship with you as a contact) and data processor (for the data your organisation stores on our platform). In the latter case, your organisation is the data controller.

2. What Data We Process

2.1 Account and Contact Data

  • Full name and job title
  • Email address and phone number
  • Company name and business address
  • Account login credentials (password stored as a cryptographic hash only)

2.2 Usage Data

  • Log data: IP address, browser type, pages visited, timestamps
  • Platform activity: key transactions, user actions, audit trail entries
  • Device information: operating system, screen resolution

2.3 Customer-Submitted Data

Where your organisation uses KEYSY to manage property keys, the platform may hold data about tenants, contractors, or other individuals submitted by your organisation. For this data, your organisation is the data controller and KEYSY acts as data processor under a Data Processing Agreement.

2.4 Communications Data

  • Messages submitted via our contact form
  • Support correspondence (email or in-app)
  • Marketing opt-in preferences

3. Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases to process your personal data:

  • Contract (Article 6(1)(b)): Processing necessary to provide the Services to you or your organisation — account management, billing, and platform operation.
  • Legitimate interests (Article 6(1)(f)): Security monitoring, fraud prevention, product improvement, and sending service-related communications. We have assessed that these interests are not overridden by your data protection rights.
  • Consent (Article 6(1)(a)): Marketing emails and non-essential cookies, where you have actively opted in. You may withdraw consent at any time.
  • Legal obligation (Article 6(1)(c)): Retaining financial records and responding to lawful requests from regulators or law enforcement.

4. How We Use Your Data

We use the personal data we collect to:

  • Provide, operate, and maintain the KEYSY platform
  • Create and manage your account and authenticate access
  • Process payments and manage billing
  • Send transactional emails (account confirmations, password resets)
  • Provide customer support and respond to enquiries
  • Send marketing and product updates (where you have consented)
  • Monitor platform performance, security, and detect abuse
  • Comply with our legal and regulatory obligations
  • Improve and develop our Services

5. Sharing Your Data

We do not sell, rent, or trade your personal data to third parties. We may share data with:

  • Google Firebase: Our cloud infrastructure provider, used to host and store platform data. Firebase is operated by Google LLC and certified under various security frameworks.
  • Payment processors: To handle subscription billing; these providers are PCI-DSS compliant.
  • Email service providers: For transactional and marketing emails.
  • Analytics providers: Aggregated, anonymised usage data only.
  • Legal and regulatory authorities: Where required by applicable law, court order, or to protect our legal rights.

All third-party providers are contractually bound to handle data in accordance with UK GDPR and our instructions.

6. Retention Periods

We retain personal data only for as long as necessary for the purposes set out in this notice:

  • Account data: For the duration of your subscription plus 2 years, to handle any post-termination queries or disputes.
  • Platform data: For the duration of your subscription plus 30 days (you may request an export before deletion).
  • Financial records: 7 years, as required by HMRC and UK tax legislation.
  • Contact form submissions: 2 years from the date of submission.
  • Marketing preferences: Until you withdraw consent or the relevant list is actively cleaned.
  • Server logs: 90 days for security monitoring.

7. International Data Transfers

Google Firebase infrastructure operates across multiple data centres globally. Where personal data is transferred outside the UK or European Economic Area (EEA), we ensure that appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO)
  • Adequacy decisions where applicable
  • Google's certification under recognised security frameworks

We do not knowingly transfer personal data to countries without an adequate level of data protection without the above safeguards in place.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data. To exercise any of these rights, please contact us at privacy@keysy.uk. We will respond within 30 days.

Right of Access

Request a copy of the personal data we hold about you (a Subject Access Request or SAR).

Right to Rectification

Ask us to correct any inaccurate or incomplete personal data we hold about you.

Right to Erasure

Request deletion of your personal data where we no longer have a lawful basis to retain it ("right to be forgotten").

Right to Restrict Processing

Ask us to pause processing your data while you contest its accuracy or object to our use of it.

Right to Portability

Receive a copy of data you provided to us in a structured, machine-readable format and transfer it to another controller.

Right to Object

Object to processing based on legitimate interests, including direct marketing. We must stop unless we have compelling grounds.

Right to Withdraw Consent

Withdraw consent at any time for processing based on consent (e.g. marketing). Withdrawal does not affect prior lawful processing.

Rights re Automated Decisions

Not to be subject to solely automated decisions with significant effects, including the right to human review.

We will not charge a fee for handling a rights request unless it is manifestly unfounded or excessive. In such cases we may charge a reasonable fee or refuse to act, with written reasons.

9. Automated Decision-Making and Profiling

We do not currently make any decisions about you that are based solely on automated processing and that produce significant legal or similarly significant effects. If we introduce such processing in the future, we will update this notice and ensure you are informed of your rights, including the right to request human review.

10. How to Complain

If you have concerns about how we handle your personal data, please contact us first at privacy@keysy.uk and we will aim to resolve the matter promptly.

You also have the right to lodge a complaint with the UK's supervisory authority:

  • Information Commissioner's Office (ICO)
  • Website: ico.org.uk
  • Helpline: 0303 123 1113

11. Contact and Data Protection Officer

For all data protection queries, subject access requests, or to exercise your rights, please contact us:

We take all data protection enquiries seriously and will respond within the statutory 30-day timeframe.