Privacy
Plain words on privacy.
Last updated 17 August 2026.
1. Who we are
Krayso ("we," "us," "our") is a company registered in England and Wales under company number 17341240, with registered office at 45 Fifth Cross Road, Twickenham, TW2 5LJ, United Kingdom. We are the data controller for the personal data described in this policy.
2. What this policy covers
This policy covers personal data we collect through this website (krayso.com) — for example, when you contact us, book a discovery call, or browse the site. It does not cover how we process data on behalf of clients as part of a Krayso engagement; that's governed by the Data Processing Agreement in each client's contract, not this policy.
3. What we collect
- Contact details you give us directly — name, work email, company, role, and a one-line description of the challenge you want to discuss — when you fill in the contact form or email us. Form submissions are sent to us as email; we do not store them in a website database.
- Booking details — when you book a discovery call through the calendar on our contact page, our scheduling provider Cal.com collects your name, email, and chosen time, and shares them with us so the call can happen.
- Usage data, in aggregate only — we use Cloudflare Web Analytics, which is cookieless. It gives us aggregate counts: pages visited, referring sites, country, and browser and device type. It sets no cookies, stores nothing on your device, assigns no visitor identifiers, and does not track you across other sites. We cannot pick an individual visitor out of it.
We do not collect special category data (health, biometric, etc.) through this website.
4. How we use it
- To respond to enquiries and set up discovery calls.
- To operate, maintain, and improve the website, using aggregate usage data only.
- To send you information you've asked for. We don't add you to marketing lists without your consent.
- To meet legal and regulatory obligations.
5. Legal basis
Where UK/EU GDPR applies, we rely on: our legitimate interests (responding to enquiries, keeping the site secure, measuring site usage in aggregate without identifying anyone), your consent where we ask for it (for example, if you opt in to updates from us), and legal obligation (e.g. tax and accounting records).
6. Who we share it with
We use a small number of service providers to operate this site and our business:
- Cloudflare — hosts the website, delivers contact-form messages to our inbox, and provides the cookieless analytics described above.
- Cal.com — runs the booking calendar on our contact page and processes your details when you book a call.
Each provider is bound by a data processing agreement and only processes data on our instructions. A full list of sub-processors is available on request. We do not sell personal data. We do not use website visitor data to train any AI model.
7. International transfers
Some of our service providers are US companies. Cloudflare, Inc. operates a global network, and Cal.com, Inc. processes booking data in the United States. Where personal data leaves the UK/EEA, we ensure an appropriate safeguard is in place — for example the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, depending on the provider. We do not use Google Analytics, so no visitor data is transferred to Google.
8. How long we keep it
We keep contact and enquiry data for 24 months from your last contact with us unless you become a client, in which case retention follows the terms of that engagement and applicable accounting/tax requirements. After 24 months of inactivity, enquiry data is deleted or anonymised.
9. Your rights
Under UK/EU GDPR you have the right to access, correct, delete, restrict, or port your data, and to object to certain processing. To exercise any of these, email hello@krayso.com. You also have the right to complain to the ICO (ico.org.uk) or your local supervisory authority.
10. Contact
Questions about this policy: email hello@krayso.com. Krayso has not appointed a Data Protection Officer; direct any data protection queries to the address above.