1. Who we are
Datavey (datavey.com) is operated by Kyros Software Ltd, a private limited company registered in England and Wales, company number 16915277. Our registered office is 82a James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE, United Kingdom.
Kyros Software Ltd is the controller of the personal data described in this notice. This means we decide how and why it is used, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC258531.
For anything about your personal data, email [email protected]. For general questions, email [email protected].
2. What this notice covers
This notice covers:
- our website at datavey.com;
- the waitlist for workers and the waitlist for companies, including the emails we send about them;
- signing in to Datavey accounts at app.datavey.com.
Before you verify your identity or take part in any paid task, we will give you a separate notice that explains the extra information those steps involve. Nothing is collected for identity verification while you are on the waitlist.
3. What we collect
If you join the worker waitlist
- your email address;
- the country you live in;
- your age range (for example 25–34). We do not ask for your date of birth;
- the languages you speak;
- your main device (phone, laptop or desktop, or both);
- how you heard about us;
- the referral code you used to join, if any, which tells us which member referred you.
Once you confirm your email address, we also create and hold:
- your own referral code and personal waitlist page;
- the number of confirmed referrals you have made, which we use to calculate your place in the queue (each confirmed referral moves you up 50 places);
- the date you confirmed and, when your place comes up, the date we invited you.
If you join the company waitlist
- your name and work email address;
- your company name and your role;
- what you need data for, the volume you expect and when you want to start;
- any message you choose to send us.
For both waitlists
- A normalised copy of your email address, used only to spot duplicate sign-ups. For example, we treat capital letters, “+” tags and, for Gmail, dots as the same address.
- A record of your consent: the versions of this Privacy Policy and our Terms that you accepted, the date and time you accepted them, and a keyed cryptographic hash of your IP address. A keyed hash is a one-way code: we can tell whether two sign-ups came from the same connection, but we cannot turn the code back into your IP address. We never store your IP address itself with your waitlist entry.
- whether and when you confirmed your email address, and the date of your last activity on the waitlist.
When you submit a form: bot protection
Our forms use Cloudflare Turnstile to tell people apart from automated bots. When the check runs, Cloudflare processes signals from your browser and connection, such as your IP address, browser user agent and technical characteristics of your connection and device. Cloudflare uses these signals only to decide whether the visitor is a person. We receive only the result of the check, not the signals themselves.
To stop abuse, we also count recent attempts from each connection and email address. These counters are stored as keyed hashes, not as readable addresses, and are deleted within two days.
If you have a Datavey account
When you create an account at app.datavey.com, we hold your name, email address, a securely hashed version of your password (we never see or store the password itself), whether you have verified your email address, and your account role. Each time you sign in we keep a session record containing the IP address and browser user agent used, so you and we can spot unfamiliar sign-ins.
Emails
Our email provider records whether each message we send was delivered, bounced or marked as spam, so we can keep our emails working.
Website analytics
We use Umami, an analytics tool we run on our own servers, to count page views. It records the page visited, the referring website, your browser, operating system, device type and the country your visit came from. It does not use cookies, does not store your IP address and does not follow you across other websites. We cannot use it to identify you. It respects your browser's “Do Not Track” setting.
Technical logs
Like any website, our servers handle your IP address when you connect to them. Where it is recorded in technical logs used to keep the service running and secure, those logs are kept only as long as needed for that purpose and are then deleted. We do not use them to identify visitors.
4. How we use your data and our lawful bases
Under UK GDPR we need a lawful basis for each way we use your data. These are ours:
| What we do | Lawful basis |
|---|---|
| Keep your place on the waitlist and send you waitlist emails: your confirmation link, your referral link and queue updates, and your invitation when your place comes up. | Consent (Article 6(1)(a)), which you give when you tick the box on the form. You can withdraw it at any time. |
| Read and reply to a company's request, and talk to you about working together. | Consent (Article 6(1)(a)), and our legitimate interests in responding to business enquiries (Article 6(1)(f)). |
| Prevent fraud and abuse: the Turnstile check, rate limiting, hashing IP addresses, blocking disposable email addresses, detecting duplicate sign-ups and checking that referrals are genuine. | Legitimate interests (Article 6(1)(f)): keeping the waitlist fair and free of bots and fake entries. |
| Keep a record of your consent and of the documents you accepted. | Legal obligation (Article 6(1)(c)): we must be able to show that we have your consent (Article 7(1)). |
| Send one final email confirming that your waitlist details have been deleted. | Legitimate interests (Article 6(1)(f)): giving you a record that your request was carried out. |
| Provide your Datavey account, keep you signed in and send sign-in, verification and password emails. | Contract (Article 6(1)(b)): we need this to provide the account you asked for. |
| Count visits to the website with cookie-less analytics. | Legitimate interests (Article 6(1)(f)): understanding which pages are useful and improving the website. |
| Establish, exercise or defend legal claims. | Legitimate interests (Article 6(1)(f)). |
We do not use your waitlist data for advertising, we do not build marketing profiles and we never sell your data.
5. Our legitimate interests
Where we rely on legitimate interests, we have weighed our interests against your rights and expectations. The whole point of Datavey is that every participant is a real, unique person, so stopping bots, duplicate accounts and fake referrals protects both the people on the waitlist and the companies that rely on us. We use the least data we can for this: for example, we keep a one-way hash of your IP address rather than the address itself. You have the right to object to any use based on legitimate interests (see section 9).
6. Who we share your data with
We use a small number of service providers, known as processors, who handle data only on our instructions and under contracts that require them to protect it:
| Provider | What they do | Where |
|---|---|---|
| Resend | Sends our transactional emails, such as confirmation links, invitations and sign-in links. | United States |
| Cloudflare | Runs the Turnstile bot protection check on our forms. | United States, with a global network |
| Our hosting provider | Hosts our servers and database, including the Umami analytics we run ourselves. | Germany |
Umami runs on our own servers, so analytics data is not shared with a third party. We may also disclose personal data if the law requires it, for example to a court or a regulator, or to a buyer or successor if our business is sold or restructured, in which case this notice would continue to apply to your data.
7. International transfers
Our servers are in Germany. The UK recognises the countries of the European Economic Area, including Germany, as providing adequate protection for personal data, so no further safeguards are needed for data held there.
Resend and Cloudflare process data in the United States. When we transfer data to them, we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it. Where it does not apply, we use the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, approved under UK law. You can ask for a copy of the relevant safeguards by emailing [email protected].
8. How long we keep your data
| Data | How long |
|---|---|
| Waitlist sign-ups that are never confirmed | Deleted automatically after 30 days. |
| Confirmed waitlist entries, including your consent record | Kept until you join Datavey by creating an account, you leave the waitlist, or 24 months pass without any activity on your entry. Then they are deleted. |
| If you use the leave-the-waitlist link in any email | Deleted immediately. |
| Rate-limiting counters | Deleted within two days. |
| Technical server logs | Only as long as needed to keep the service secure and working, then deleted. |
| Datavey accounts | Kept while your account is open. Individual sign-in sessions expire after 7 days. You can ask us to delete your account at any time. |
| Cookie-less analytics | Kept as aggregate statistics that do not identify anyone. |
Activity on your entry includes confirming your email address and visiting your personal waitlist page. Our email provider keeps its own delivery logs for a short period after each message is sent.
9. Your rights
Under UK data protection law you have the right to:
- access your personal data and receive a copy of it;
- have inaccurate data corrected and incomplete data completed;
- have your data erased;
- restrict how we use your data;
- object to us using your data on the basis of legitimate interests;
- receive data you gave us in a portable format and have it sent to another organisation (portability);
- withdraw your consent at any time. This does not affect anything we did with your data before you withdrew it.
Exercising your rights is free. We will reply within one month, or tell you within that month if we need longer because a request is complex.
If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
10. How to exercise your rights
- To leave the waitlist and delete your data, use the link at the bottom of any email we have sent you. Your details are deleted straight away and you will see a confirmation on screen.
- For anything else, including access, correction or objection, email [email protected] from the email address you signed up with. If you write from a different address, we may ask you to confirm you control the original one before we act, so that nobody else can see or change your data.
11. Children
Datavey is only for people aged 18 or over. Our worker form does not accept anyone who tells us they are under 18, and nothing they enter is saved. If you believe someone under 18 has given us their details, email [email protected] and we will delete them.
12. Automated decisions
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. The Turnstile check and our rate limits are automated, but they only decide whether a form can be submitted at that moment. If you are blocked in error, wait a few minutes and try again, or email [email protected] and a person will help.
13. How we protect your data
All connections to Datavey are encrypted with TLS. Passwords are stored only as secure hashes, IP addresses on the waitlist are stored only as keyed hashes, and links in our emails are cryptographically signed so they cannot be guessed or altered. Access to waitlist data is limited to authorised members of our team who need it to run the waitlist.
14. Changes to this notice
We will update this notice when the way we use personal data changes. Each version has a version number shown at the top of this page, and we record which version you accepted. If we make a significant change that affects you, we will email you before it takes effect.
15. Contact us
Kyros Software Ltd
82a James Carter Road
Mildenhall
Bury St Edmunds
IP28 7DE
United Kingdom
Email: [email protected]