Data protection and privacy at Qyro.

Qyro Ltd (“Qyro”) respects individuals’, customer’s and partner company’s rights over their personal data. We are committed to ensuring that information is treated appropriately in everything we do. Any personal information received by Qyro in the course of providing Services is controlled by us and so we are considered the data controller of your personal information under European Union and UK data protection law. Any entities providing additional services will also separately be a “data controller” of your information if you sign up for such additional services. You can access the privacy policies of these entities from them directly. We will comply with the data protection laws set out in the Data Protection Act 2018 and from General Data Protection Regulation (EU) 2016/679 and UK GDPR when keeping personal information about you. Note, the Data Protection Act 2018 is the UK’s implementation of the General Data Protection Regulation (GDPR).

The purpose of this policy is to outline how and why Qyro handles personal data and the rights of individuals for whom Qyro is holding personal data.

This document is to be made available to Staff working in or on behalf of Qyro in the UK and EU (this includes contractors, temporary staff, embedded staff, secondees and all permanent employees). To be published on the Corporate Website and made available to customers and partners.

This Policy outlines:

• How Qyro may collect personal data about you
• How Qyro may use your personal data
• Why Qyro is allowed to use your information in this way
• The circumstances under which Qyro may share your personal data or disclose it to others
• Additional details about cookies and technical information
• Data retention policies
• Your rights over personal data
• How to contact Qyro

Where this Notice refers to ‘personal data’ it is referring to data about you from which you could be identified – such as name, date of birth or contact details.

This Notice applies to all personal data processed by Qyro about its customers and contacts. This includes data that may have been provided via third parties, and which is therefore also covered by their own Privacy / GDPR Policies.

This policy was last updated on 8th December 2025. Any updates will be posted to this version of the policy. If you wish to see a previous version of the policy, or have any other questions, please get in touch.

Qyro may collect personal data from you via means such as:

• In person, when you speak to one of our representatives
• Through a telephone call, either where you call us or we call you
• On paper, such as if you return/send a printed document to us
• Digitally, such as if you fill in a form on a website or interact with Qyro online
• When you enter into a transaction with Qyro
• On marketing platforms, where you have provided the information or made the information public, or you have made the information available in a social media forum run by Qyro
• On a Customer Relationship Database
• On a platform used as part of our services to you such as a Support Portal or Help Desk Portal.

We may collect personal data about you such as:

• Name
• Contact details (e.g. email address, address, telephone / mobile number)
• Future communication preferences
• Information about your company/organisation
• Issues you raise
• Topics you are interested in

We may also collect information when you interact with Qyro digitally, such as by visiting our website(s) or communicating with one of our social media channels. This may include additional data to that above, such as:

• Your IP address
• Your device, browser or operating system
• Details of the links that you click and the content that you view
• Any other information you share when using third party sites (e.g. using the Like function on LinkedIn or Instagram). We may also place one or more cookies on your device. For further details on this, see below.

We may also collect information about you from other public sources, such as Companies House or other commercially available sources. We only do so where those sources are lawfully permitted to share the data with us and where we have a legal basis to process data from such sources.

We may use your personal data to assist with providing a service to you, share it with our representatives internally and/or contact you in future.

Examples of the way we may use your data include to:

• Share outcomes of any contact made with you to highlight new products and
• Features of existing products
• Sending you Qyro related news
• Tell you about service or company changes that may be of interest to you
• Respond to queries that you raise with us
• Manage our sites and services

For more specific information about how we use your data for these activities, and the legal basis on which we rely to process your data in this way, please see the ‘Why Qyro is allowed to use your information in this way’ part of this Notice.

If you have provided us with your email, mobile phone number or landline phone number and we have a legal right to use them for such purposes.

You may opt out of communications from us at any time.

Depending on how and why you provide us with your personal data it may be shared within Qyro or with companies that provide services to Qyro.

However, save for the limited circumstances noted above, we will never pass your personal data to any unrelated third parties unless you have given us your permission to do so and we will do our best to ensure any third party has appropriate data controls in place to comply with, and meet the standards of the same laws as Qyro.

Qyro is a UK Registered Company that provides services to UK partners. It is necessary to hold information on individuals’, partners’ and companies to allow us to be operationally responsive to customer requests, to inform you of changes to any part of our business, to keep in touch with you when you make a request of us and to develop our services.

You do have rights to ask us to stop processing your data for these purposes, and you can read details about those rights below.

In addition to the above we may also process your data for other purposes where you ask us to, or enter into a relationship with us that requires us to. In these circumstances a contract will be put in place between you and us and we will process your personal data to the extent that we need to in order to fulfil our obligations under that contract.

Similarly, you may from time to time give us your consent to send you communications by email (or similar mediums) which promote our work. Where you do that we will use your details to send you those kinds of communications until you tell us otherwise. Should you ever ask us to stop sending those kinds of communications we will hold your details on file to ensure that we respect that request – we justify that retention on the basis that we have a legitimate interest in holding your data in that way.

Qyro will never sell your personal data to third parties.

Depending on how and why you provide us with your personal data it may be shared within the company and it may also be shared with those who provide services to Qyro.

We may use service providers to undertake processing operations on our behalf to provide us with a variety of administrative, statistical, advertising and technical services. We will only supply service providers with the minimum amount of personal data they need to fulfil the services we request. We oblige all of our data processors to sign contracts with us that clearly set out their commitment to respecting individual rights, protecting your personal data – including not using it for any purpose other than providing us with an agreed service or fulfilling their legal obligations - and their commitments to assisting us to help you exercise your rights as a data subject.

With your consent, service providers may hold personal data about you in order to facilitate the provision of future services or financial transactions to which you have agreed, such as a payment processor retaining your payment details in order to process agreed future payments from you.

Please note that some of our service providers may be based outside of the European Economic Area (the “EEA”). Where we transfer your data to a service provider that is outside of the EEA we seek to ensure that appropriate safeguards are in place to make sure that your personal data is held securely and that your rights as a data subject are upheld – in almost all cases we do this by ensuring that the agreements between us and our chosen service providers contain model clauses that oblige them to treat your personal data as if they themselves were based in the EEA. We are contractually obliged in some cases to ensure your data does not leave the UK, in which case we will ensure that no data, personal or otherwise, will indeed leave the UK. This is managed through agreements between us and our chosen service providers.

However, save for the limited circumstances noted above, we will never pass your personal data to any unrelated third parties unless you have given us your permission to do so.

Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS England. NHS England is the controller for any personal information you provided to NHS England to get an NHS login account and verify your identity, and uses that personal information solely for that single purpose. For this personal information, our role is a “processor” only and we must act under the instructions provided by NHS England (as the “controller”) when verifying your identity. To see NHS login’s Privacy Notice and Terms and Conditions, please click here. This restriction does not apply to the personal information you provide to us separately.

Please note that if you access our service using your NHS Care Identity credentials, the identity access and management services are managed by NHS England. NHS England is the controller for any personal information you provided to NHS England to get a national digital identity and authenticate your claim to that identity, and uses that personal information solely for that single purpose. For any personal information, our role is a “processor” only and we must act under the instructions provided by NHS England (as the “controller”) when verifying your identity. To see NHS England’s Privacy Notice and Terms and Conditions, view the NHS Care Identity Service 2 page. This restriction does not apply to the personal information you provide to us separately which is managed in accordance with our Privacy Policy.

A cookie is a small text file placed on your device when you visit a website. You can accept or decline cookies through your browser settings or other software. For more information about cookies, see Information Commissioner's Office's Cookies Information.

When you visit our website(s), we may place one or more cookies on your device. These are for purposes which include:

• Improving your experience of visiting the site, including providing personalised content
• Gathering information you have submitted via the site
• Processing requests for information or action that you have made through the site
• Processing login requests
• Enabling your activity in one place to be used to decide on what information, if any, to present to you in other places
• Gathered statistical information about the usage of the site
• Ensuring the smooth operation of online services
• Remembering whether or not you have been shown a cookie notification message on an earlier visit to the site
• To make sure marketing you may receive from us are relevant to your interests.

By using one or more of our sites, you are consenting to our use of cookies in accordance with this Notice. If you do not agree to our use of cookies, then you should set your browser or other software settings accordingly.

We also provide options to share content on social media which may result in your being directed to the social media network’s own systems. If you proceed with this, those networks may gather personal data about you in line with their own privacy policies. On our websites or in other digital communications we may also use technologies variously described as web beacons, pixel tags, clear gifs or tracking pixels to provide us with information about how people have navigated through the site or responded to the communication.

Qyro takes the protection of your information very seriously. We use encryption (TLS) to protect your personal data when appropriate, and all the information provided to the company is stored securely once we receive it. Employees working for Qyro only have access to the information they need, and the web servers are stored in a secure environment. Qyro may store your personal data on secure servers either on our premises or in third party data centres within the UK or EEA (as agreed).

Qyro only keeps your personal data for as long as required to meet the purposes set out in this Notice, unless a longer retention period is required by law. For example, this may include holding your data after you have ceased to engage with Qyro (such as by resigning) where we have a legitimate interest in doing so, such as to enable us to respond effectively to grievances that may arise after you cease to engage with us.

Qyro has a Records Management Policy which sets out how we manage the retention of such information.

All of the above is subject to your legal rights, such as to have data in certain cases deleted or corrected, as set out below.

You have legal rights over any of your personal data that we hold.

Right of Access

You may, at any time, request access to the personal data that we hold which relates to you.

This right entitles you to receive a copy of the personal data that we hold about you. It is not a right that allows you to request personal data about other people, or a right to request specific documents from us that do not relate to your personal data.

Right to Rectification and Erasure

You may, at any time, request that we correct personal data that we hold about you which you believe is incorrect or inaccurate. You may also ask us to erase personal data if you do not believe that we need to continue retaining it (sometimes called the right to be forgotten).

Please note that we may ask you to verify any new data that you provide to us and may take our own steps to check that the new data you have supplied us with is accurate. Further, we are not always obliged to erase personal data when asked to do so; if for any reason we believe that we have a good legal reason to continue processing personal data that you ask us to erase we will tell you what that reason is at the time we respond to your request.

Right To Restrict Processing

Here we process your personal data on the legal basis of us having a legitimate interest to do so, you are entitled to ask us to stop processing (object to your data being processed) it in that way if you feel that our continuing to do so impacts on your fundamental rights and freedoms or if you feel that those legitimate interests are not valid.

You may also ask us to stop processing your personal data:

• if you dispute the accuracy of that personal data and want us verify its accuracy;
• where it has been established that our use of the data is unlawful but you do not want us to erase it;
• where we no longer need to process your personal data (and would otherwise dispose of it) but you wish for us to continue storing it in order to enable you to establish, exercise or defend legal claims.

If for any reason we believe that we have a good legal reason to continue processing personal data that you ask us to stop processing, we will tell you what that reason is, either at the time we first respond to your request or after we have had the opportunity to consider and investigate it.

Right to Portability

Where you wish to transfer certain personal data that we hold about you, which is processed by automated means, to a third party you may write to us and ask us to provide it to you in a commonly used machine-readable format.

Right to Stop Receiving Communications

Wherever possible, we will provide you with a choice about how we can contact you to share information about Qyro. You can opt out of communications at any time by contacting hello@qyro.co. It may take several days for requests submitted this way to become effective on our systems, or by the methods described below.

Email

If you provide us with your email address and indicate that we may do so (e.g. by subscribing to an email distribution list we may send you further information about Qyro in the future. These communications will take the form of emails informing you about us and our work.

You can request that you cease to receive these kinds of communications from us at any time. The easiest way to do so is to use the unsubscribe link provided at the bottom of any e-mail messages that we send to you. It may take several days for requests submitted this way to become effective on our systems.

General

While all of our direct marketing communications contain details of how you can contact us to stop receiving them in the future, you can either follow those instructions (such as using the unsubscribe link in an email) or visit www.qyro.co, or ask us directly at hello@qyro.co. If you do the latter, please provide us with full details of the contact details, postal addresses, email addresses and so on to which you wish us to stop sending communications to in order to help us deal with your request quickly and accurately.

We will process any requests to stop receiving communications as quickly and comprehensively as is practical although there may in some cases be further communications already on their way to you which cannot be stopped.

If you ask us to stop sending you information we may keep a record of your information to make sure we do not contact you again, up until the normal retention period for that type of data.

Please note that this right to stop communications does not apply to emails that we send to you that are a necessary part of us providing a service to you or us notifying you about how your personal data is being used.

You may exercise any of these rights by contacting us using the details below and providing the necessary details for us to be able to identify the relevant data and to act on your request accurately.

When you contact us making a request to exercise your rights we are entitled to ask you to prove that you are who you say you are. We may ask you to provide copies of relevant ID documents to help verify your identity.

It will help us to process your request if you clearly state which right you wish to exercise and, where relevant, why it is that you are exercising it. The clearer and more specific you can be, the faster and more efficiently we can process the request. If you do not provide us with sufficient information then we may delay actioning your request until you have provided us with additional information (and where this is the case we will tell you).

If you are not satisfied that your complaint has been dealt with appropriately, you have the right to make a complaint to the Information Commissioner’s Office. Details on how to make a complaint can be found at https://ico.org.uk/make-a-complaint/

If you have any queries regarding the information set out here, if you wish to exercise any of your rights set out above or if you think that it has not been followed, please contact us at hello@qyro.co.

Qyro Ltd, All Rights Reserved, 2025