Website Privacy Notice

Last Updated: 12 September 2026 (Version 1.0)

This Website Privacy Notice explains how hyf.id Ltd ("hyf.id", "we", "us", or "our") handles personal data through our public business website and our relationships with organizations, retailers and partners. It covers our HubSpot-hosted pages, business enquiry and meeting forms, report requests, related communications, and contact and commercial relationship records managed in HubSpot.

Our Consumer Privacy Notice covers information you provide through a hyf.id session, sign-in, account, verification, wallet, offer or campaign. Using a business email address does not change which notice applies. If you enquire about hyf.id and also use the Service, each notice applies to the relevant activity. Third-party websites and services have their own privacy notices.

Who We Are

hyf.id Ltd is the controller for the website and business relationship activities described here: we decide why and how this personal data is used. HubSpot provides website, form and customer relationship management services on our behalf.

We are registered in England and Wales under company number 17276154. Our address is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Our UK Information Commissioner's Office (ICO) registration number is ZC239188.

Contact privacy@hyf.id about your personal data, or write to our address marked "Data Protection".

Who This Notice Covers

• visitors to our public business website and landing pages
• people who enquire about hyf.id, request a meeting, demonstration or report, or correspond with us about our services
• contacts at prospective or existing customer organizations, retailers and partners, including their commercial, billing, legal and technical representatives
• business contacts whose details are supplied by their organization, a colleague, a referral or a public business source

Personal Data We Collect and Where It Comes From

The information depends on your interaction with us:

• Business contact information: your name, work email, company, role, telephone number and other contact details you or your organization provide. Our website lead form asks for your name, work email and company.
• Enquiries and communications: form answers, messages, meeting requests, correspondence, report requests and our related follow-up notes.
• Organization and commercial information: business name, domain, country, information supplied for a report, customer or prospect status, onboarding progress, relationship history, and relevant subscription, billing or usage summaries. Organization information is personal data where it identifies or relates to an individual, including a sole trader.
• Preferences: marketing subscriptions, consent records where relevant, cookie choices, objections and unsubscribe records.
• Website and communication activity: IP address, browser and device information, pages visited, referral and campaign information, form activity and, where enabled and permitted, cookie identifiers and interactions with our emails. HubSpot may associate website activity with a contact record after a form submission or tracked email interaction, subject to the tracking settings and applicable consent requirements.

We collect information directly from you, automatically through website interactions, and from your organization, colleagues or business referrals. We may use public company websites, professional contact information and public registers to understand or verify a business enquiry. Our connected business systems may provide organization onboarding, account and commercial updates to our CRM. This does not make a consumer's verification evidence or account activity business marketing data.

Please use business enquiry forms for business contact details and your enquiry. Provide identity or eligibility evidence only through the relevant verification flow.

Why We Use Personal Data and Our Lawful Bases

We use personal data for the following purposes:

• Answering enquiries and arranging meetings or reports: our legitimate interests in responding to people who contact us and explaining our services. Where you personally are entering a contract, we may instead use the information to take steps you request before that contract.
• Managing customer and partner relationships: our legitimate interests in communicating with business representatives, maintaining accurate records, supporting onboarding and providing customer service. Where a contract is with you personally, we use information necessary to perform it; a contract with your employer does not by itself make contract our lawful basis for your personal data.
• Sending relevant business communications: our legitimate interests in promoting our services where permitted, or your consent where required. The marketing section below explains your choices.
• Operating, protecting and improving the website: our legitimate interests in reliable operation, preventing misuse, troubleshooting and understanding how our business website performs. Where cookies or similar technologies require consent, we obtain it before using them.
• Meeting legal obligations: complying with applicable accounting, tax, regulatory and other legal requirements. We may also retain necessary information for our legitimate interests in establishing, exercising or defending legal claims.

When relying on legitimate interests, we consider the necessity of the processing and the effect on your interests, rights and freedoms. You may object as explained below. When we rely on consent, you can withdraw it without affecting earlier lawful processing.

Providing business contact information is optional. We may be unable to answer you, arrange a meeting or deliver a requested report without the relevant contact details. Submitting an enquiry does not by itself give consent to unrelated marketing.

Business Marketing and Your Choices

We may contact business representatives about relevant hyf.id services where applicable law permits. Rules can differ for corporate addresses, sole traders and some partnerships; we obtain consent where required or use another legally available permission.

You can object to direct marketing at any time, use the unsubscribe link in a marketing email, or contact privacy@hyf.id. We will stop using your personal data for that marketing. We may keep a minimal suppression record so we respect your choice. Necessary replies to an enquiry and service or contractual communications may continue.

Cookies and Similar Technologies

Our business website uses HubSpot to serve pages and forms. Essential technologies support website delivery, security, form operation and recording privacy choices. Where enabled, analytics and communication tracking help us understand visits, enquiries and campaign performance. Technologies that require consent must wait for that consent; submitting a business enquiry does not replace a cookie choice.

The cookie information and controls on the relevant website explain the technologies enabled there and the choices available. You can also delete or block cookies through your browser, although this may affect website or form functions. Contact privacy@hyf.id if you need help with a cookie choice.

Our session Cookie Policy describes cookies used for sign-in and verification. Its statement that the session service does not use third-party analytics or advertising cookies applies to that service; website tracking is described here separately.

Who We Share Personal Data With

We share information as needed with:

• HubSpot and other service providers: providers supporting website hosting, forms, CRM, communications, reports, security and business administration, under appropriate confidentiality and data-protection obligations
• Your organization and authorized colleagues: where needed to respond to an enquiry or manage your organization's relationship with us
• Professional advisers and authorities: lawyers, accountants, auditors, insurers, regulators and other competent bodies where necessary or legally required
• Parties to a corporate transaction: prospective buyers, investors and advisers where necessary for a financing, merger or sale, subject to appropriate confidentiality and data-protection safeguards

We do not sell personal data. Suppliers may also act as controllers for their own processing where applicable; their notices explain that processing. See HubSpot's privacy policy for its own practices.

International Transfers

HubSpot and other suppliers may process data outside the United Kingdom, including in the United States and other countries. Where we make a restricted transfer, we use the safeguards required by applicable law, such as UK adequacy regulations or appropriate contractual safeguards, including the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, with supplementary measures where appropriate.

Contact privacy@hyf.id for information about safeguards relevant to your personal data.

How Long We Keep Information

We keep personal data only as long as needed for the purpose, considering the nature of the information, our relationship with you, and applicable legal requirements:

• enquiries, meeting and report requests, and prospect contact records are kept while we handle the request and for relevant follow-up, considering the last interaction and whether a business relationship remains reasonably expected
• customer and partner contact records are kept while the relationship is active and afterwards where needed for contractual, accounting, dispute or legal requirements
• marketing records are kept while there is a lawful basis to contact you; a minimal objection or unsubscribe record may be retained to prevent further marketing
• website activity, cookies and tracking records follow the purposes and retention settings of the relevant technology; the website's cookie information explains applicable cookie lifetimes
• security, complaint and rights-request records are kept as needed to resolve the matter, protect legal rights and demonstrate compliance

When information is no longer needed, we delete or anonymize it. Backup copies may remain until their normal secure rotation. Cookie expiry does not necessarily delete a contact record created through a form; contact us to request deletion of that record.

Security

We use technical and organizational measures designed to protect personal data, including access controls, appropriate supplier arrangements and limiting information to what is needed for the relevant purpose. No system can guarantee absolute security.

Your Rights and Complaints

Depending on applicable law and the processing, you may request access, correction, erasure, restriction or portability of your personal data. You may object to processing based on legitimate interests on grounds relating to your situation, and may withdraw consent at any time where we rely on it. You have an unconditional right to object to direct marketing.

Rights may have legal exceptions. We may ask for information reasonably necessary to confirm your identity. We normally respond within one month, subject to any lawful extension; requests are usually free. We do not use website enquiries or CRM records to make solely automated decisions with legal or similarly significant effects on you.

Email privacy@hyf.id or write to our address above to exercise a right. You may complain to the UK Information Commissioner's Office or your local supervisory authority without contacting us first.

Changes to This Notice

We will publish updates here with a revised version and date, and provide additional notice where appropriate for a material change. An updated notice does not itself create consent.