Privacy Policy

"Personal data" means any information that identifies, or could identify, a living individual, on its own or combined with other information, for example a name, email address, phone number, job title with employer, IP address, or login credentials.
"Processing" means anything done with personal data, from collection to deletion. "Controller" means the organization that decides why and how personal data is processed; "processor" means an organization processing it on a controller's behalf.

We are the controller for: visitors to hybytes.com; people who contact us, request a quote, or receive our marketing; Client personnel we deal with in the ordinary course of an engagement (names, work email, role); and job applicants.
We are a processor for: personal data we access or handle while performing Services under a Statement of Work, for example, data within a Client's AWS account, database, or application that we migrate, operate, or build against as part of an AWS Migration, Managed Services, or Development engagement. For that data, the Client is the controller and our Data Processing Agreement governs our processing. If you are an individual whose data appears in a system we support for a Client, please contact that Client first; we will assist them in responding to you.

Alongside the contract above, we publish the corporate policies and statements that govern how we run Hybytes Ltd. These are summaries of our internal policies and do not form part of any client contract unless a Statement of Work says otherwise.

• Identity and contact data: name, email address, phone number, organisation, and job title, when you fill in a contact form, book a consultation, or email us.
• Engagement and account data: names and contact details of Client personnel we work with, roles, and communications relating to a Statement of Work.
• Billing data: billing address, VAT or tax ID, and invoice and transaction history. We do not hold full card numbers; these are processed by our payment provider.
• Client system data (as processor): personal data present in the Client environments, databases, or codebases we work on under an engagement, handled under our Data Processing Agreement, never under this Privacy Policy.
• Website usage and technical data: pages visited, browser and device type, IP address, and identifiers set by cookies, described in our Cookie Policy.
• Communications data: support requests, emails, call or meeting notes, and survey responses.
• Recruitment data: CVs, application details, and interview notes, if you apply for a role with us.
• Marketing data: your preferences and consent records for receiving marketing from us.

We do not intentionally collect special category data (such as health or political opinions) through our own contact forms or marketing, and ask that you do not include it in enquiries or support requests.

Directly from you (when you contact us, engage us, or apply for a role); automatically (through hybytes.com, cookies, and server logs); and from third parties (Client contacts who introduce us to their colleagues, payment and analytics providers confirming transactions or usage, and publicly available business information such as Companies House filings).

Directly from you (when you contact us, engage us, or apply for a role); automatically (through hybytes.com, cookies, and server logs); and from third parties (Client contacts who introduce us to their colleagues, payment and analytics providers confirming transactions or usage, and publicly available business information such as Companies House filings).

• Responding to enquiries and preparing quotes or proposals: legitimate interests in running our business and responding to prospective clients.
• Performing and managing a Statement of Work, including invoicing: performance of a contract; legal obligation for tax and accounting.
• Securing our own systems and any environments we manage: authentication, access logging, and enforcing our Acceptable Use Policy: legitimate interests in keeping our business and our Clients' systems safe.
• Improving hybytes.com and how we run engagements, including website analytics: legitimate interests, or consent where cookies require it (see our Cookie Policy).
• Communicating with you: engagement updates, changes to terms, and service messages: performance of a contract; legal obligation.
• Marketing our services to you, where you have opted in or where we may lawfully rely on the soft opt-in for existing contacts, always with an unsubscribe option: consent; legitimate interests.
• Assessing job applications: steps taken at your request prior to entering a contract.
• Establishing, exercising, or defending legal claims, and complying with regulatory or law enforcement requests we are legally required to answer: legitimate interests; legal obligation.

Where we rely on legitimate interests, we balance them against your rights, and you may object as described in Section 12.

Our use of cookies on hybytes.com is described in our Cookie Policy, including the essential cookies used for the site to function and any analytics or marketing cookies used only with your consent. You can manage preferences through the cookie banner and your browser.

When you use our landing pages and booking forms, we use a limited number of cookies and identifiers and collect technical, usage, and device information. We use this information for the purposes below, each with its own legal basis under UK GDPR and PECR.

Security and abuse prevention. To protect our forms and booking system from bots, spam, fraud, and other abuse, we collect technical information that helps us distinguish genuine visitors from automated or suspicious activity. This may include your IP address and approximate location, browser and operating system information, a visitor or session identifier so our security measures can operate correctly, and information about how you interact with our forms, such as whether information is typed or pasted.

This includes the Cloudflare Turnstile check described in our Cookie Policy.

Legal basis: our legitimate interest in preventing fraud and abuse and maintaining the security and integrity of our services (Article 6(1)(f) UK GDPR). Where a cookie is strictly necessary for a service you have requested, it is used without requiring consent, in line with PECR.

Device and browser characteristics. With your consent, we may separately collect more detailed information about your device and browser, such as screen characteristics, hardware details, and other technical signals, which may, when combined, contribute to recognising the same device across visits. This is used to strengthen fraud detection and to understand how our pages perform, and is collected only where you have given consent through the cookie banner. Further detail, including the specific tool involved once confirmed, is set out in our Cookie Policy. Legal basis: consent, which you can withdraw at any time.

What we do not do. We do not sell your personal data. We do not use the technical and device information described in this Section to build an advertising profile about you, or to identify you personally beyond information you choose to provide, such as your name and email address.

• Sub-processors and service providers who support our own operations (cloud hosting, email, CRM, payments, ticketing) under written contracts: the current categories are published in our Sub-processors document, with 30 days' notice of material changes.
• Professional advisers (accountants, auditors, lawyers, insurers) under confidentiality, where needed.
• Authorities, regulators, and law enforcement where we are legally required, applying the minimisation approach in Section 16.
• A buyer or successor in a merger, acquisition, or asset sale, under confidentiality and with notice to you where required.

We do not sell personal data, and we do not share it with third parties for their own advertising.

We are UK-based. Where personal data is transferred outside the UK or EEA (for example to a sub-processor operating globally, or because a Client's own AWS workloads sit in a non-UK/EEA region) we rely on adequacy regulations where they exist, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, together with transfer risk assessments where required. Details are available on request.

We protect personal data with technical and organisational measures including encryption in transit and at rest, least-privilege access with multi-factor authentication, logging and monitoring, vulnerability management, staff training, and a documented incident response process, as summarised in our Security Overview.

No system is perfectly secure; if a breach affects your data and risks your rights, we will notify you and the regulator as required by law.

• Enquiry and marketing data: for as long as needed to respond and follow up, or until you ask us to stop, plus a suppression record so we do not contact you again.
• Engagement and contractual records: for the term of the engagement and typically up to 7 years afterwards, to meet legal, accounting, and tax obligations.
• Client system data processed as processor: for as long as the Client instructs, deleted or returned at the end of the engagement per our Data Processing Agreement.
• Billing and tax records: 6 years plus the current year, as UK law requires.
• Support and general communications: 24 months after the matter is closed.
• Server and security logs: 12 months, longer where an investigation requires.
• Recruitment data: a limited period after a hiring decision, unless you ask us to keep it on file for future roles.

Under UK GDPR, you have the right to:

• Access your personal data and get a copy of it
• Correct inaccurate or incomplete data
• Delete your data, where there's no overriding reason for us to keep it
• Restrict how we process your data while a dispute is being resolved
• Receive a copy of the data you gave us, in a portable format
• Object to processing based on our legitimate interests, and to direct marketing at any time
• Withdraw consent at any time, where processing is based on consent, this won't affect anything we did before you withdrew it

To exercise any right, please use our contact form. We may need to verify your identity. We respond within one month; for complex requests we may extend by up to two further months and will tell you why. This is free unless a request is manifestly unfounded or excessive. If you are unhappy with our response, you may also complain to the UK Information Commissioner's Office (ico.org.uk) or, in the EU, your local supervisory authority.

We do not make decisions producing legal or similarly significant effects about you based solely on automated processing

Our website and Services are directed at businesses and are not intended for children. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please use our contact form and we will delete it.

hybytes.com may link to third-party sites, including AWS Marketplace listings or partner pages, that we do not control. Their privacy practices are their own; we encourage you to read their notices.

Where we receive a request for personal data from any third party or public authority, we disclose only what we are legally obliged to provide, limit disclosure to the minimum necessary, and, where lawfully able to, notify the affected individual or Client first. For data we hold as a processor under a Statement of Work, we will not disclose it except on the Client's documented instructions or where required by law.

Every marketing email includes an unsubscribe link, and you can update your preferences at any time by filling out our contact form. Opting out of marketing does not stop service messages we must still send (for example, billing or changes to terms).

We may update this Privacy Policy from time to time. Material changes are notified by email or website notice before they take effect. The "last updated" date at the top shows the current version, always available at hybytes.com.

If you have any questions regarding this policy or our site, please feel free to contact us. You can fill out our contact form.