byStrata Ltd · Privacy Policy
Privacy Policy
Entity
byStrata Ltd · Co. No. 17138853
Law
UK GDPR · Data Protection Act 2018 · PECR
Effective
21 October 2026
Contact
info@bystrata.co.uk
1 · Who we are
byStrata Ltd builds and looks after software systems for small businesses. We are a company registered in England and Wales (company number 17138853); our registered office is the address shown for that number on the Companies House register. We are registered with the Information Commissioner's Office (ICO), registration reference ZC216260.
We are the controller of the personal data this policy describes: visitors to bystrata.co.uk, people who contact us or book a call, our clients and suppliers, businesses we contact about our services, and people who interact with our social media accounts.
When we build and run a system for a client, such as a loyalty card or booking tool their customers use, the client decides how that data is used and we act as their processor under a written agreement. If you are one of their customers, their privacy notice applies and requests should go to them. If you send one to us, we will pass it on and help them answer it.
Questions about this policy: info@bystrata.co.uk. The two founders, Gabriel Maier and Jordan Hardwick, handle every request themselves.
2 · What we collect and why
You contact us or enquire
What we collect
Name, business name, email, phone, and what you tell us. On our audit form, your answers about how your business runs. The page and any campaign link (such as utm_source) you arrived from.
Why
To reply, understand what you need, and follow up about working together. Audit answers are summarised by an AI model so we can prepare for a call. A person always reads them; the AI makes no decision about you.
Lawful basis
Legitimate interests (Art. 6(1)(f)): answering people who contact us. Steps you ask for before a contract (Art. 6(1)(b)).
You book a call
What we collect
Name, email, the time you choose, and anything you add to the booking.
Why
To arrange and hold the call.
Lawful basis
Steps you ask for before a contract (Art. 6(1)(b)); legitimate interests.
You are a client
What we collect
Contact names, job titles, email, phone, business address, contracts, invoices and payment records.
Why
To deliver and look after what we build, invoice you, and keep our accounts.
Lawful basis
Contract (Art. 6(1)(b)); legal obligation for accounting records (Art. 6(1)(c)).
You are a supplier or partner
What we collect
Name, business contact details, and bank details if we pay you.
Why
To work together and pay you.
Lawful basis
Contract (Art. 6(1)(b)); legitimate interests.
We contacted your business first
What we collect
From Google Maps listings: business name, address, phone, website and public rating. From the business's own website: an email address it publishes there. From the Companies House register: whether it is a limited company, and its company number and registered name. For limited companies only: the name and job title of the person who runs it and links to their public LinkedIn, X or Instagram profiles, found by an AI web search (OpenAI); and, from Hunter.io, a business email address and whether it is valid. Which emails we sent, whether you replied, and notes of any phone call with you.
Why
To offer our services to businesses that may benefit from them, by email or phone. See section 4.
Lawful basis
Legitimate interests (Art. 6(1)(f)): business-to-business marketing.
You visit our website
What we collect
Pages viewed, the site that referred you, country, device type, browser and operating system, and link tags such as utm_source. No cookies and no identifier that follows you.
Why
To see which pages help people and fix the ones that don't.
Lawful basis
Legitimate interests (Art. 6(1)(f)).
You interact with our social media
What we collect
Your public profile name and picture, and the comments, messages, reactions and follows you make on our Facebook Page, our Instagram account (@wearebystrata) or our LinkedIn page.
Why
To publish our posts, reply to you, and see in total how our posts perform.
Lawful basis
Legitimate interests (Art. 6(1)(f)).
| When | What we collect | Why | Lawful basis |
|---|---|---|---|
| You contact us or enquire | Name, business name, email, phone, and what you tell us. On our audit form, your answers about how your business runs. The page and any campaign link (such as utm_source) you arrived from. | To reply, understand what you need, and follow up about working together. Audit answers are summarised by an AI model so we can prepare for a call. A person always reads them; the AI makes no decision about you. | Legitimate interests (Art. 6(1)(f)): answering people who contact us. Steps you ask for before a contract (Art. 6(1)(b)). |
| You book a call | Name, email, the time you choose, and anything you add to the booking. | To arrange and hold the call. | Steps you ask for before a contract (Art. 6(1)(b)); legitimate interests. |
| You are a client | Contact names, job titles, email, phone, business address, contracts, invoices and payment records. | To deliver and look after what we build, invoice you, and keep our accounts. | Contract (Art. 6(1)(b)); legal obligation for accounting records (Art. 6(1)(c)). |
| You are a supplier or partner | Name, business contact details, and bank details if we pay you. | To work together and pay you. | Contract (Art. 6(1)(b)); legitimate interests. |
| We contacted your business first | From Google Maps listings: business name, address, phone, website and public rating. From the business's own website: an email address it publishes there. From the Companies House register: whether it is a limited company, and its company number and registered name. For limited companies only: the name and job title of the person who runs it and links to their public LinkedIn, X or Instagram profiles, found by an AI web search (OpenAI); and, from Hunter.io, a business email address and whether it is valid. Which emails we sent, whether you replied, and notes of any phone call with you. | To offer our services to businesses that may benefit from them, by email or phone. See section 4. | Legitimate interests (Art. 6(1)(f)): business-to-business marketing. |
| You visit our website | Pages viewed, the site that referred you, country, device type, browser and operating system, and link tags such as utm_source. No cookies and no identifier that follows you. | To see which pages help people and fix the ones that don't. | Legitimate interests (Art. 6(1)(f)). |
| You interact with our social media | Your public profile name and picture, and the comments, messages, reactions and follows you make on our Facebook Page, our Instagram account (@wearebystrata) or our LinkedIn page. | To publish our posts, reply to you, and see in total how our posts perform. | Legitimate interests (Art. 6(1)(f)). |
3 · Where your data comes from
Mostly from you. The exceptions:
- –Cal.com: when you book a call, the booking details come to us from our scheduling service.
- –Public sources, OpenAI and Hunter.io: for businesses we contact first: Google Maps listings, which we read with our own software; the business's own website; and the Companies House register, which tells us whether it is a limited company. For limited companies only, an AI web search run through OpenAI finds the name and public profile links of the person who runs the business, and Hunter.io finds and checks their business email address.
- –Meta and LinkedIn: when you interact with our accounts, those platforms show us your public profile and what you posted or sent.
- –Our clients: when we run a system for a client, their customers' data comes from that client, who remains responsible for it.
4 · If we contacted your business first
We sometimes email or phone businesses that have not contacted us, because we think what we build could help them. When we do:
- –Who we email: only limited companies and LLPs, at a business address. We do not cold-email sole traders or partnerships, because the law treats them as individuals who must agree first.
- –What our first email tells you: who we are, where we found your details, and how to stop hearing from us.
- –Saying no: reply “stop” or email info@bystrata.co.uk at any time. We stop straight away. Your objection to marketing always wins; there is no weighing up.
- –What we keep after: only your business name and email address, on a do-not-contact list, so we never contact you again.
- –How long: we delete the rest 12 months after our last contact with you.
5 · Who we share it with
We do not sell personal data, and we do not share it with anyone for their own advertising. These providers handle it on our behalf, under written agreements:
Vercel
What they do for us
Hosts this website and its forms, and provides our cookieless analytics
Where
USA
Supabase
What they do for us
Stores enquiries, client and prospect records in our database
Where
EU (Germany)
Microsoft (Microsoft 365)
What they do for us
Our email
Where
UK and EU
Anthropic
What they do for us
Summarises audit-form answers for us. It does not use them to train its models.
Where
USA
Cal.com
What they do for us
Call bookings
Where
USA
OpenAI
What they do for us
Runs the AI web search that finds the name and public profiles of the person who runs a business we plan to contact
Where
USA
Hunter.io
What they do for us
Finds and checks business email addresses
Where
EU and USA
Hetzner Online
What they do for us
Hosts the server that runs our automation workflows
Where
Germany
Meta (Facebook, Instagram)
What they do for us
Our social media accounts and the tools we use to post to them
Where
Ireland and USA
What they do for us
Our LinkedIn page
Where
Ireland and USA
| Provider | What they do for us | Where |
|---|---|---|
| Vercel | Hosts this website and its forms, and provides our cookieless analytics | USA |
| Supabase | Stores enquiries, client and prospect records in our database | EU (Germany) |
| Microsoft (Microsoft 365) | Our email | UK and EU |
| Anthropic | Summarises audit-form answers for us. It does not use them to train its models. | USA |
| Cal.com | Call bookings | USA |
| OpenAI | Runs the AI web search that finds the name and public profiles of the person who runs a business we plan to contact | USA |
| Hunter.io | Finds and checks business email addresses | EU and USA |
| Hetzner Online | Hosts the server that runs our automation workflows | Germany |
| Meta (Facebook, Instagram) | Our social media accounts and the tools we use to post to them | Ireland and USA |
| Our LinkedIn page | Ireland and USA |
We also share data with our accountants, legal advisers and HMRC where the law or our accounts require it.
6 · Transfers outside the UK
Some of the providers above are in the USA. Where they are, we rely on the UK–US data bridge if the provider is certified under it, or otherwise on the UK Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement. Providers in the EU are covered by the UK's adequacy regulations. Ask us and we will tell you which applies to which provider.
7 · How long we keep it
- –Enquiries and audit answers: 2 years from our last contact, unless you become a client.
- –Call bookings: 2 years from the call.
- –Client records: the length of the contract plus 6 years. Accounting records: 6 years, as HMRC requires.
- –Supplier records: the length of the relationship plus 2 years.
- –Businesses we contacted first: 12 months from our last contact. If you object, only the do-not-contact entry is kept.
- –Website analytics: statistics only. The daily visitor hash is thrown away after 24 hours.
- –Social media: comments and reactions stay on the platform until you or we delete them. Messages about working with us are kept as enquiries, for 2 years.
8 · Your rights
- –Access: a copy of the personal data we hold about you.
- –Correction: fixing anything that is wrong or incomplete.
- –Deletion: removing your data, unless the law makes us keep it. See section 9.
- –Restriction: limiting how we use it while a question is sorted out.
- –Portability: your data in a format another service can read.
- –Objection: to any use based on legitimate interests. For marketing, an objection is always upheld.
Email info@bystrata.co.uk with the subject “Data rights request”. It is free, and we reply within one month. We may ask you to confirm who you are first.
You can also complain to the ICO at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.
9 · Deleting your data
To have us delete your personal data, email info@bystrata.co.uk with the subject “Delete my data”. Tell us your name and the email address, phone number or social media profile you used with us.
We delete it within one month and confirm by email. We keep only what the law requires, such as invoices, or what you ask us to keep, such as a do-not-contact entry.
Facebook and Instagram. If your data reached us through Facebook or Instagram, such as a comment, message or reaction on our Page or account, you can also delete it yourself on the platform at any time. Deleting a comment there removes it from our account too. The app we connect to Facebook and Instagram manages byStrata's own accounts only. Nobody else logs into it, so there is no app account of yours to remove.
10 · Keeping it safe
Data travels encrypted (TLS). Only the two founders can reach our records, and our database enforces access rules on every row. Every provider above works under a written agreement.
We record every personal data breach. We report one to the ICO within 72 hours unless it is unlikely to put anyone at risk, and we tell you directly if it is likely to put you at high risk.
11 · Cookies
This website sets no cookies, and our analytics stores nothing on your device. The details are in our Cookie Policy.
12 · Changes to this policy
When what we do changes, we update this page and the date at the top. The previous version was dated 12 October 2026.
13 · Contact
byStrata Ltd · Company number 17138853 · Registered in England and Wales
ICO registration reference: ZC216260
Email: info@bystrata.co.uk
Website: bystrata.co.uk