Privacy Policy

Welcome to SPYRO. We are committed to protecting your privacy and ensuring that your personal data is handled securely and in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains how we collect, use, and protect your personal information.

Who We Are (Data Controller)

SPYRO Global Ltd ("SPYRO", "we", "us") is a company registered in England and Wales under company number 16087803, with its registered office at Woodend Gallery and Studios, The Crescent, Scarborough, YO11 2PW. For the personal data described in this policy, SPYRO is the data controller, except where we act as a processor on a member's behalf (see "Member-Uploaded Contacts" below). You can contact us about privacy at info@spyroglobal.com.

Who and What This Policy Covers

This policy applies to visitors to our website and to users of the SPYRO platform and its services, including Supplier Members, Resellers, Schools and other Buyers, Partners and Referrers, and covers the Marketplace, Partner Relationship Management (PRM), AI Partner Matching and Business Development. Capitalised service terms have the meaning given in the applicable SPYRO terms and conditions.

Information We Collect

We collect the following types of personal data:

• Identity and Contact Data – Name, email address, phone number, and business details.
• Technical Data – IP address, browser type, and device information collected through cookies and analytics tools.
• Usage Data – Information on how you use our website, including pages visited and interactions.
• Financial Data – Payment details processed securely through Stripe (SPYRO does not store card data directly). Where SPYRO collects and disburses payments between members, we also process transaction and settlement data such as amounts, dates and the parties to a transaction.
• Profile and Matching Data – Business profile information you provide, and data used to generate AI Partner Matching suggestions, drawn from your profile, from SPYRO's own network and from third-party data sources.
• Member-Uploaded Contact Data – Contact details (such as names, business emails, roles) that a member enters into PRM or AI Partner Matching about its own partners and prospects.
• Activity and Correspondence Data – Records of searches you run and of correspondence conducted through the platform (including email and messaging), used to operate the services and to calculate and attribute commission.

How We Collect Data

We collect personal data through:

• Direct interactions – When you submit a contact form or register for our services.
• Automated tracking – Through cookies, analytics tools (e.g., Google Analytics), and log files.
• Third-party providers – Payment transactions via Stripe. We also receive data from third-party data providers and from SPYRO's own network for the purpose of AI Partner Matching.

How We Source Business and Reseller Data

As well as data you give us directly, we may compile business and reseller profiles — including the products a reseller represents — from publicly available sources (such as company and reseller websites and directories), using automated tools, and from our prior dealings with you. Even where information is publicly available, if it identifies an individual it is personal data and we handle it accordingly.

Where we obtain this information for the Marketplace and AI Partner Matching (matching resellers and suppliers), we rely on our legitimate interests. Where we obtain personal data from a source other than you, we will provide a privacy notice as required by UK GDPR, normally when we first contact you or within one month.

You can object to this processing, and you can ask us to correct or remove your data, by contacting info@spyroglobal.com. We take reasonable steps to keep this information accurate and up to date, and will act on a valid objection unless we have overriding legitimate grounds. Where we contact you electronically, applicable electronic-marketing rules will also apply.

Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR, depending on the activity:

• Contract – to provide the services you or your organisation have signed up for, including the Marketplace, PRM, AI Partner Matching and Business Development, and to administer fees and commission.
• Legitimate interests – to operate, secure and improve the platform, to generate matching suggestions, to prevent fraud, and to pursue business development, balanced against your rights, and to send business-to-business marketing to corporate subscribers subject to an opt-out.
• Consent – for certain marketing communications and non-essential cookies, which you may withdraw at any time.
• Legal obligation – to comply with law, including tax, accounting and regulatory requirements.

How We Use Your Data

We use your data to:

• Provide and manage our services.
• Respond to inquiries and customer support requests.
• Improve website functionality and user experience.
• Send marketing communications about our products and services, in accordance with your preferences and applicable law (see "Marketing Communications" below).
• Ensure security and prevent fraud.
• Generate AI Partner Matching suggestions, including profiling of business profile and activity data.
• Administer fees, commission and the referral programme, including logging platform activity and correspondence to attribute deals.

AI Partner Matching and Automated Processing

AI Partner Matching produces a ranked list of suggested potential Buyers using automated means. The suggestions are generated from your profile information, from SPYRO's own network and from third-party data sources, using artificial-intelligence technology provided by a third-party provider. The output is advisory only: it is a suggestion for you to evaluate, not a decision that produces legal or similarly significant effects, and a human (you) decides whether to act on it. We do not use AI Partner Matching to make solely automated decisions about you within the meaning of Article 22 UK GDPR. Where third-party AI providers process data on our behalf, they act as sub-processors and are restricted to providing the service.

Member-Uploaded Contacts (PRM) — Controller and Processor Roles

Where a member uploads its own contacts into PRM or AI Partner Matching, the member is the data controller of those contacts and SPYRO acts as the member's processor, processing them only on the member's instructions to provide the service. The member is responsible for having a lawful basis and for providing any privacy notice required to those individuals. Contacts a member adds are kept private to that member and are not added to the general matching database or made available to other members. Where SPYRO only processes contacts on a member's behalf, we will pass any request from an individual about that data to the member as controller.

Data Sharing & Third Parties

We do not sell, rent, or share your personal data with third parties, except:

• Payment Processing – Financial transactions are securely handled via Stripe.
• Hosting and AI platform – our platform is hosted and operated using Base44 (operated by Wix.com Ltd), which processes personal data on our behalf as a processor, together with its sub-processors (which include cloud hosting and AI providers such as OpenAI and Anthropic). Base44's sub-processor list is available at base44.com/dpa/exhibitc.
• Analytics and email – service providers that help us analyse usage and send communications, acting on our instructions.
• Legal Compliance – If required by law or to enforce our legal rights.

We do not sell or rent personal data. Our processors are bound by written terms restricting them to providing services to us.

International Transfers

Some of our processors are located outside the UK, including in the United States (for cloud hosting and AI processing) and Israel. Where we transfer personal data outside the UK, we rely on an appropriate safeguard, such as UK "adequacy" (which covers Israel), the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the UK extension to the EU-US Data Privacy Framework where the importer is certified. Details of the specific safeguard are available on request.

Data Retention

We retain your personal data for as long as you are a member or use our services. Once an account is deleted, we remove associated personal data unless required by law to retain certain records. Backups may persist for a limited period before deletion. Where we act as a processor for member-uploaded contacts, retention is determined by the member as controller.

Your Rights

Under UK GDPR, you have the right to:

• Access your personal data.
• Correct inaccurate or incomplete data.
• Request deletion of your data.
• Restrict processing or object to how we use your data.
• Request data portability.
• Withdraw consent at any time where we rely on consent.
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your data.

To exercise these rights, contact us at info@spyroglobal.com. Where we process data only on a member's behalf, we will forward your request to that member as controller.

Marketing Communications

We may send you marketing about our products, services and offers. Where you are a business or corporate subscriber, we may do so by email, telephone or post, subject to your right to opt out. Where you are an individual or sole trader, we send electronic marketing only with your consent or where otherwise permitted (for example to existing customers about similar products, always with an opt-out). Every electronic marketing message includes a way to unsubscribe, and we act on opt-outs promptly. Marketing is separate from service and account messages, which we may always send. This is described further in the applicable terms and conditions.

Cookies & Tracking Technologies

We use cookies to track website usage and improve user experience. By using our website, you consent to the use of cookies as described in our Cookie Policy.

• Essential Cookies: Required for website functionality.
• Analytics Cookies: Used to measure website performance.
• Marketing Cookies: Used for advertising purposes.
• Users can manage cookie preferences via their browser settings. Non-essential cookies are set only with your consent.

Security Measures

We take appropriate security measures to protect your data from unauthorised access, alteration, or loss. However, no system can be 100% secure. Our processors are required to maintain appropriate technical and organisational security measures.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version and change the "last updated" date, and where appropriate notify you.