Privacy Notice

1. Who we are and how to reach us

We are the controller of the personal data described in this notice — we decide why and how it is used. Where we work inside a customer’s own systems (for example when one of our plugins runs on a customer’s website), the customer is the controller and we act as its processor under a written data processing agreement; section 9 explains which is which.

2. What this notice is, and what it is not

This notice explains what personal data we collect, where it comes from, why we use it, on which legal basis, who we share it with, where it goes, how long we keep it, how we protect it, and what your rights are. It is written to meet Articles 13 and 14 of the UK GDPR and of the EU GDPR, the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR).

It does not cover the content of websites we audit or the customers’ own use of our products towards their users: for those, the website owner’s or the customer’s own privacy notice applies. Cookies are covered in our separate Cookie Policy; in short, our own cookies keep the site working and remember your choices, and Google Analytics cookies are set only if you accept them in the banner.

3. The personal data we handle, and where it comes from

We handle little personal data, and most of it is business contact data. The table lists every category, what it contains and where we obtain it.

Special categories of data (health, ethnicity, religion, sexual orientation, biometrics and the like) and criminal-offence data: we do not ask for them and do not want them. If you send them to us in a message, we hold them only as part of that message and under the conditions in section 5. Our Clinical AI Governance work is about policies, procedures and systems; we do not process patient records, and where a customer must share clinical information for an engagement, that is done under the customer’s own governance and a written agreement.

Children. Our services are for businesses and professionals. We do not knowingly collect data about anyone under 18; if you believe we have, tell us and we will delete it.

4. Why we use personal data, and the legal basis for each use

Data protection law requires a legal basis for each purpose. We use four: contract (the processing is needed to perform a contract with you or to take steps you ask for before one); legal obligation (the law requires it); legitimate interests (we have a real business reason that does not override your interests, rights and freedoms — we have assessed each one and the assessments are available on request; the Data (Use and Access) Act 2025 recognises direct marketing and the security of our systems as legitimate interests); and consent (you have agreed, and can withdraw at any time).

We do not sell personal data, and we do not use it for purposes incompatible with the one it was collected for. If we ever need to use it for a new purpose, we will tell you first and, where required, ask.

5. Automated decisions and the use of AI

A person is always in the loop. We use AI to speed up our work, not to replace judgement, experience or the personal approach we promise. Our tools score websites, draft text, sort replies and prepare content; a person sets the rules they work to, reviews what they produce, and approves it. No decision with a legal or similarly significant effect on you is taken by automated means alone: whether we take on an engagement, what we send to a customer, how we answer a request or a complaint, and what is published under our name or a customer’s are decided by a person.

We use third-party AI models as processors to analyse public websites, to draft and check content, and to classify replies. When we do, we send only what the task needs — normally a business website’s public content, a company’s public register entry, the customer’s brief, and the text to be checked — and not your correspondence with us, your account details or your payment data. The providers we use are named in section 6. We use them through their business interfaces, under terms that do not allow the data we send to be used to train their models.

Content we produce with AI assistance — articles, posts, landing pages, outreach emails — is prepared within a review window and published or sent under a person’s editorial responsibility, in the name of the organisation it comes from. Where the law of the reader’s country requires it, AI-generated content is labelled as such. Where you interact with an automated assistant of ours, it tells you that it is automated.

6. Who we share personal data with

We share personal data only with organisations that help us provide our services, each under a contract that binds them to use it only on our instructions and to protect it, or where the law requires it. We never share it for their own marketing.

We do not share personal data with data brokers, advertising networks or social networks for advertising.

7. Business outreach — the companies we contact

Part of our marketing is done by writing to companies we believe would benefit from our services. This is the part of our processing you are most likely to notice without having dealt with us, so we set it out in full.

• Whom we write to. Companies on the Companies House register of a corporate type (limited companies, PLCs, LLPs). We do not write to sole traders, partnerships or private individuals, and we do not write to healthcare providers directly.
• What we use. The company’s public register entry (name, number, type, registered office, the names of its officers), its own website, and a business email address found on that website or in a public business listing. We check the website’s AI visibility before we write, and the message refers to what we found.
• The legal basis. Legitimate interests — direct marketing to businesses, which the Data (Use and Access) Act 2025 recognises as a legitimate interest — balanced against yours: we write to a business address about business services, once, with at most three follow-ups, and we stop the moment you ask. Under PECR, email to a corporate subscriber does not require prior consent; we still make every message easy to decline.
• Where the message comes from. Our outreach is sent from the domain daryo89partners.com; our direct correspondence is sent from daryo89.com. Anything else claiming to be us is not.
• How to stop it. Reply “stop” to any message, use the link in it, or write to d.lapegna@daryo89.com. We keep your address on a suppression list so that we do not write again — that list is the one thing we keep indefinitely, because it exists to honour your objection.
• Your rights. You may object at any time (section 11), ask what we hold and where we obtained it, and ask us to delete it. This section is the information Article 14 requires when data is obtained from public sources rather than from you; we give it in the first message we send.

8. International transfers

We are based in the United Kingdom and most of our processing happens here. Some of our providers process data in the European Economic Area, and some in the United States. When personal data leaves the UK or the EEA we use a lawful transfer mechanism: for the United States, the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it, and otherwise the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (for the UK) or the EU Standard Contractual Clauses (for the EEA), with a transfer risk assessment as the Data (Use and Access) Act 2025 requires. You can ask us for a copy of the mechanism that applies to a given provider.

9. Our products: when we are a controller and when we are a processor

What our plugins send to us: the licence key, the site address, the plugin version, counts of scans and credits, error reports without personal content, and the pages a scan requests. They do not send a customer’s user database, their visitors’ data or their leads to us. A data processing agreement on our standard terms is available to every customer on request.

10. How long we keep personal data

We keep personal data no longer than the purpose needs, then delete or anonymise it. The periods below are our standard; a legal hold or a live dispute can extend them.

11. Your rights

You have the following rights, free of charge, whichever country you are in. Write to d.lapegna@daryo89.com with “Privacy” in the subject; we may need to confirm who you are before acting.

• To be told what we do with your data — this notice, and specific answers on request.
• Access: a copy of your personal data and the details of how we use it. We answer within one month; for a complex or numerous request we may take up to two more months and will tell you why. We carry out a reasonable and proportionate search, as the law provides.
• Rectification: correction of data that is wrong or incomplete.
• Erasure: deletion where the data is no longer needed, where you withdraw consent, where you object and we have no overriding reason, or where the processing was unlawful. We may have to keep what the law obliges us to keep (invoices, for example) and will tell you what and why.
• Restriction: a pause on processing while a dispute about accuracy or legitimacy is resolved.
• Portability: the data you gave us, in a machine-readable format, where we process it by automated means under contract or consent.
• Objection: to processing based on legitimate interests. Objection to direct marketing is absolute — we stop the moment you object, with no questions asked.
• Withdrawing consent: at any time, without affecting what was done before.
• Automated decisions: we make none with a legal or similarly significant effect on you; if that ever changed, you would have the right to human intervention, to express your view and to contest the decision.

We do not charge for these requests unless a request is manifestly unfounded or excessive, and we never discriminate against anyone for exercising a right.

12. Complaints

If you think we have handled your personal data badly, complain to us first: write to d.lapegna@daryo89.com with “Data protection complaint” in the subject, or use the complaint form on this page. We acknowledge every data protection complaint within 30 days, we investigate it, we tell you the outcome and what we have done, and we keep a record of complaints, as section 164A of the Data Protection Act 2018 (introduced by the Data (Use and Access) Act 2025) requires.

You may also complain to the regulator at any time: in the UK, the Information Commissioner’s Office — ico.org.uk/make-a-complaint, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, SK9 5AF. In the EU or EEA, the supervisory authority of the country where you live or work (the list is at edpb.europa.eu).

13. How we protect personal data

Our founder learned data discipline in clinical practice before applying it to digital infrastructure, and our security is built to the standards our health and care customers are held to. In practice:

• Encryption in transit everywhere — TLS 1.2 or later on every connection to our sites, our products and our infrastructure — and encrypted backups.
• Access on a need-to-know basis, individual accounts, multi-factor authentication on every administrative account, and no shared passwords.
• Hard separation of our domains: human correspondence from daryo89.com, automated outreach from daryo89partners.com, and our products’ infrastructure kept apart from the public website.
• Least data: our tools request only what a task needs, our plugins send us only what licensing needs, and card data never touches our systems.
• Logging, monitoring and rate limits at every level — the network edge, the web server, the application and the API — with daily backups.
• Contracts with every processor that bind them to the same standard; annual review of who has access to what.
• A written breach procedure: we assess any incident at once, contain it, and notify the ICO within 72 hours and you without undue delay where the law requires it.

No system is perfectly secure. If we ever fail, we will say so plainly and tell you what to do.

14. If you are in the EU or the EEA

• The EU GDPR applies alongside the UK GDPR to our processing of your data. Your rights are those in section 11; your regulator is your national supervisory authority (section 12).
• Transfers from the EEA to the UK rely on the European Commission’s adequacy decision for the United Kingdom; transfers onward to the United States use the mechanisms in section 8.
• We have no representative in the EU because our processing of data about people in the EU is occasional (section 1); contact us directly at the addresses there.
• Content we produce with AI assistance and publish or send to readers in the EU is labelled where the EU AI Act (Article 50) requires it, and our automated assistants tell you they are automated.

15. Changes to this notice

We review this notice at least once a year and whenever our processing or the law changes. The version and date are at the top; material changes are announced on daryo89.com and, for customers, by email. Earlier versions are available on request.

Version history. 3.0 — 29 September 2026: rewritten in full (this notice). 2.x — 4 June 2026: generated statements (UK and EU), replaced.