Privacy Notice - Repyield

Contact details

Email: privacy@repyield.com

What information we collect, use, and why

To provide and improve products and services for clients

Names and contact details
Addresses
Payment details (including card or bank information for transfers and direct debits)
Transaction data (including details about payments to and from you and details of products and services you have purchased)
Information relating to compliments or complaints
Account access information
Website user information
Business information about prospective clients, such as public ratings and review activity
Contact details of a client's own customers, processed on the client's instructions

For the operation of client or customer accounts

Names and contact details
Purchase or service history
Account information, including registration details
Marketing preferences
Access details for a client's booking or customer-management systems

For information updates or marketing purposes

Names and contact details
Addresses
Marketing preferences
Business category and public review information

To comply with legal requirements

Name
Contact information
Identification documents
Client account information
Any other personal information required to comply with legal obligations
Tax documentation for cross-border withholding requirements

For dealing with queries, complaints or claims

Names and contact details
Payment details
Account information
Purchase or service history
Customer or client accounts and records
Financial transaction information
Correspondence
Records of opt-out or data protection requests

Lawful bases and data protection rights

Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.

Which lawful basis we rely on may affect your data protection rights, set out in brief below. If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the details above.

Right of access: you can ask us for copies of your personal information, and details about where we get it from and who we share it with.
Right to rectification: you can ask us to correct or complete inaccurate or incomplete information.
Right to erasure: you can ask us to delete your personal information.
Right to restriction of processing: you can ask us to limit how we use your personal information.
Right to object to processing: you can object to the processing of your personal data.
Right to data portability: you can ask us to transfer your information to another organisation, or to you.
Right to withdraw consent: where we rely on consent, you can withdraw it at any time.

Our lawful bases for each purpose

Providing and improving products and services for clients

Contract: we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Operation of client or customer accounts

Contract: we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Information updates or marketing purposes

Legitimate interests: all of your data protection rights may apply, except the right to portability.

We use publicly available business contact details to identify and contact relevant business decision-makers about our services, with a clear opt-out honoured at any time.

Complying with legal requirements

Legal obligation: all of your data protection rights may apply, except the right to erasure, the right to object, and the right to data portability.

Dealing with queries, complaints or claims

Legitimate interests: all of your data protection rights may apply, except the right to portability.

We use contact and account details to respond properly to queries, complaints, or claims raised with us.

Where we get personal information from

Directly from you
Publicly available sources
Client organisations, under a written agreement.

How long we keep information

Cold-outreach lead data (no response received): up to 12 months from last contact, after which it is deleted or archived.
Contacts who have opted out: kept indefinitely on our suppression list, solely to ensure the opt-out continues to be honoured.
Client account and billing records: for the duration of the client relationship, and for 6 years afterwards to meet UK tax and accounting requirements.
End-customer data processed on behalf of clients: for the period specified in our data processing agreement with the relevant client.
Correspondence relating to complaints, queries, or data protection requests: for 2–3 years, to demonstrate that requests were properly handled.

Who we share information with

Data processors

Email marketing and outreach software providers, based in the US.
CRM and marketing automation software providers, based in the US.
Web data extraction and automation platform providers, based in the EU and US.
Cloud storage and productivity software providers, based in the US.
Payment processing providers, based in the UK.

Others we share personal information with

Professional or legal advisors
Organisations we're legally obliged to share personal information with
Third parties: Client organisations

Sharing information outside the UK

Where necessary, our data processors will share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the details above.

Category	Country	Safeguard
CRM and marketing automation software providers	United States	Adequacy Regulations / UK Data Bridge
Email marketing and outreach software providers	United States	Addendum to the EU Standard Contractual Clauses (SCCs)
Web data extraction and automation platform providers	EU and United States	Addendum to the EU Standard Contractual Clauses (SCCs)
Cloud storage and productivity software providers	United States	Addendum to the EU Standard Contractual Clauses (SCCs)

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us: