Privacy policy
Plain, honest detail on what we collect, why, and the control you have over it.
This notice explains what personal information NYAS collects when you use this website, get in touch, meet us, or when we find out about your business ourselves. It covers how we use that information, who helps us handle it, how long we keep it, and the rights you have over it. We keep it plain and honest.
Who we are
This site is run by NYAS Group Ltd (trading as Not Your Average Solutions), a company registered in England and Wales, company number 16146745. We are the data controller for the information described here, except where we say we are acting for a client.
We are registered with the Information Commissioner's Office (ICO), registration reference ZC200462.
For anything to do with your data, contact Hayley directly at hayley@nyas.co.uk. She reads every message herself. We are a small company and are not required to appoint a Data Protection Officer, so Hayley is your contact for everything in this notice.
The information we collect
Information you give us
When you fill in a form on this site (an enquiry, a call request, or a waitlist), or when you email or message us, we collect what you choose to send. That usually includes your name, email address, business name, business type, the department you want help with, and your message.
You do not have to give us anything. If you want a reply, we need a way to contact you. If you become a client, we need your billing details to invoice you, because the law requires us to keep proper accounts.
Information from other people and public sources
Sometimes we hear about you before you hear from us: someone you know introduces us, we meet you at an event, or we find your business while looking for companies we could help. In those cases we may hold your name, your job title, your business, how we came across you, and a work email, phone number or LinkedIn profile you have published for business contact. The section How we found you below explains this in full.
Information collected automatically
- Analytics: only if you accept analytics cookies, we use Google Analytics (loaded through Google Tag Manager) to see how the site is used, for example which pages are visited and roughly where visitors come from. Until you accept, these cookies are not set. See our Cookie policy.
- Heat maps: only if you accept analytics cookies, we use Microsoft Clarity to understand how visitors use our website, for example where people click and how far they scroll. You can withdraw consent at any time using Cookie settings. See our Cookie policy.
- Funding email: if you sign up for our weekly funding email, we collect your email address, your first name if you give it, and for the tailored version your answers about your business (such as its stage, size, region, sector and what it does). We use them only to confirm your sign up and to choose and send you funding opportunities. Our legal basis is your consent. We email you a link to confirm first, and every email has an unsubscribe link. If you do not confirm within 14 days we delete your details. If you unsubscribe we delete your name and answers at once and keep only your email address, so that we never email you again.
- Server logs: our hosting provider records standard technical data such as your IP address and browser type, to keep the site secure and running. This is normal for any website.
How we use your information, and our lawful basis
| What we do | Why (lawful basis under UK GDPR) |
|---|---|
| Reply to your enquiry and discuss how we might help | Legitimate interests, and taking steps to enter into a contract with you |
| Provide and manage services if you become a client, and take payment | Performance of our contract with you |
| Transcribe and summarise our calls, so we have an accurate record of what was agreed | Legitimate interests |
| Research businesses we might work with, and the people who run them, and contact them in their working role | Legitimate interests |
| Send the weekly funding email | Your consent (which you can withdraw any time) |
| Measure how the site is used, with analytics and heat maps | Your consent (which you can withdraw any time) |
| Keep the site and our systems secure and working | Legitimate interests |
| Meet our legal and accounting duties | Legal obligation |
Where we rely on legitimate interests, we have weighed our interest against your rights and kept to what a person in a working role would reasonably expect. You can object at any time and we will stop unless we have a compelling reason not to, which for marketing we never do.
We do not sell your data, and we do not make automated decisions about you that have legal or similarly significant effects.
Sensitive information
We never ask for health details or other sensitive information about you or anyone else, and we do not need it for anything we do. Conversations are human, though, and sometimes someone mentions an illness, a family event or something similar on a call, and the automatic call notes pick it up. When that happens, our system flags it, and Hayley removes it from the notes and the transcript. We do not use it, summarise it or pass it on.
Who we share it with
We only share your data with the providers we rely on to run the business, and only so they can act on our instructions. Each one is under contract to protect it.
- Supabase, who host our client portal database, logins and file storage. The data is stored in London.
- Vercel, who host and run our client portal software. Our portal runs in their London region.
- Anthropic, who provide the AI models we use to analyse information and draft work. Under our commercial terms with them they do not train their models on our data.
- Google (Google Workspace for our email, calendar, video calls, call notes and document storage, and Google Analytics and Tag Manager for site analytics).
- Microsoft (Microsoft Clarity, for website heat maps, only if you accept analytics cookies).
- MailerLite, who send our weekly funding email for us, to people who have signed up and confirmed.
- Stripe, who process card payments. We never see or store your card details.
- Zapier, who send some of our automated emails.
- n8n, who run an automation that reads receipts and invoices sent to our email, for our accounts.
- Xero, who hold our accounting and invoicing records.
- Monzo, our bank. Payments you make to us appear in our bank feed with your name and reference.
- Canva, who host the design tools and brand templates we use to produce marketing material for clients.
- Granola, who provide the call notes app we use on some calls. It transcribes the call and writes notes, keeps them on servers in the United States, and does not keep the audio.
- Hostinger, who host this website and receive website enquiry forms.
When we publish on LinkedIn, Facebook, Instagram or YouTube, those platforms handle any data about people who interact with our posts under their own privacy notices, as separate controllers.
Some of these providers process data outside the UK, mainly in the United States and the European Union. Where they do, we rely on the safeguards allowed under UK data protection law: the UK's adequacy decisions (including for the European Union and, for certified US companies, the UK Extension to the EU US Data Privacy Framework), the International Data Transfer Agreement, or the UK Addendum to the standard contractual clauses.
If you are a business client, ask us for our full Sub-processor List. It sets out for each provider what it does, what data it holds, where it processes it, and which safeguard applies.
If we carry out a Discovery and Audit for you
When you buy a Discovery and Audit, we collect more detail about how your business runs. That includes the names and roles of the people who work with you, how long tasks take them, and information from systems you give us read only access to.
For that information you are the data controller and we are the processor. We only handle it under a signed Data Processing Agreement, and only to produce your audit.
- We record and transcribe our calls so we capture your figures accurately rather than from memory. We ask out loud at the start of every call and you can say no, in which case we take written notes instead. Recordings and transcripts are analysed using AI and deleted twelve months after your audit is delivered.
- We do not ask for salaries. We ask what it would cost to pay someone else to do a piece of work. That is a market rate, not anyone's personal pay.
- We never ask for passwords. Access is granted by connecting an account, by adding us as a named collaborator, or by an access token you can revoke whenever you like. During an audit everything we ask for is read only.
- If you do not become a client, we remove all access we were given within 30 days of delivering your audit, and we log that we have done it.
Meetings and calls
When we meet you on a video call, the call may be transcribed and summarised automatically. Google Meet tells everyone on the call when that is happening, and produces a set of notes and a written transcript afterwards. On some calls we use Granola, a call notes app on Hayley's computer or phone, which transcribes the call and writes notes. If you would rather it was not used, tell us and we will take written notes instead.
We keep a copy of those notes and that transcript, and we use them to write a summary of what was discussed, a list of what we agreed to do, and a running record of your account. Part of that summarising is done by an AI assistant, which reads the transcript and writes the summary. No decision about you is made by that assistant on its own, and nothing about you is used to train anybody's AI model.
Our lawful basis is legitimate interests: keeping an accurate record of what was agreed with clients and prospective clients, and being able to act on it. The call is one you chose to attend, you are told at the time that it is being transcribed, and the record covers only the business discussed.
The transcript is stored in our private Google Drive, in our own client portal, and in Granola where Granola was used, all restricted to our own login. Nobody outside NYAS Group Ltd sees it. If you would rather we did not transcribe a call, tell us before or during it and we will turn it off, or delete the transcript afterwards if one has already been made.
How we found you: businesses we might work with
If we have contacted you without you contacting us first, this section is for you. It explains where your details came from, what we hold and what you can do about it.
Where your details came from. One or more of these: someone who knows you introduced us; we met you at an event; or we found your business in public sources. Those public sources are the Companies House register, your own website, your business's social media accounts, LinkedIn, recent news and press about the business, and public review sites. If you ask, we will tell you which one applies to you.
What we hold. For the people who run the business: name, job title, the business, how we came across you, a public LinkedIn profile, and a work email or phone number where you have given it to us or published it for business contact. We also keep a record of any messages between us.
What we do not collect. Nothing private, and nothing about anyone's personal life. Companies House publishes directors' month and year of birth; we do not keep it.
How we do it. Some of this research is done by an AI research assistant that reads public web pages and suggests what it found. Hayley checks it before anything is saved, and nothing about a person is saved without her choosing to. Nothing about you is used to train anybody's AI model.
Why, and our lawful basis. Legitimate interests: finding out whether we are a good fit for a business before either of us spends time on it, contacting you in your working role about it, and keeping an accurate record of who we are talking to. We only hold what is relevant to that.
Who sees it. Only us. It is held in our own client portal, restricted to our own login, and in our private Google Drive, using the providers listed above. It is never sold or shared for anyone else's marketing.
Your say. Email hayley@nyas.co.uk and we will tell you what we hold and where it came from, delete it, or stop contacting you. If you ask us not to contact you, we stop, full stop. We keep a record of your request, with enough detail to recognise you (your name, business and contact details), so that we never contact you again by mistake.
How long we keep it
- Enquiries that do not become clients: kept for up to 24 months from your last contact, then deleted.
- Research on businesses and people who do not become clients: deleted 24 months after our last contact, or straight away if you ask. If you become a client, it becomes part of your client record. If you ask us not to contact you, we keep a record of that request so that we never contact you again.
- Client records: kept for the length of our work together, and afterwards for six years, because that is how long we must keep financial records for HMRC and Companies House.
- Funding email sign ups: kept while you are subscribed. Unconfirmed sign ups are deleted after 14 days. After you unsubscribe, only your email address is kept, so we never email you again.
- Analytics data: Google Analytics keeps it for no longer than 14 months. Microsoft Clarity keeps its data for no longer than 13 months.
- Audit records for businesses who do not become clients: deleted 12 months after the audit is delivered.
- Meeting notes and transcripts: deleted 12 months after the call, or 12 months after your audit is delivered where the call was part of one. The summary of what was agreed is kept with your client record.
- Access you granted us to your systems: revoked within 30 days if you do not proceed, and the revocation is logged.
Keeping it safe
We follow the Cyber Essentials controls, use two step sign in on every system that holds your data, and restrict our client portal so each client can only ever see their own information. If something ever went wrong that put your information at risk, we would tell the ICO within 72 hours where the law requires it, and we would tell you directly and without delay if it was likely to affect you.
Your rights
Under UK GDPR you have the right to:
- be told how your information is used, which is what this notice is for;
- ask for a copy of the personal data we hold about you;
- ask us to correct anything that is wrong;
- ask us to delete your data;
- ask us to restrict or stop using it;
- object to us using it, including for our legitimate interests. If you object to us contacting you about our services, we always stop;
- ask for your data in a portable format;
- withdraw your consent at any time, for analytics using the cookie controls on the site, and for the funding email using the unsubscribe link. This does not affect anything we did before you withdrew it.
To use any of these, email hayley@nyas.co.uk. It is free. We will respond within one month, and if a request is unusually complex we will tell you within that month if we need longer.
Complaints. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk. We would appreciate the chance to put things right first.
Children
This site and our services are meant for businesses and are not aimed at anyone under 18. We do not knowingly collect data about children.
Changes to this notice
If we change how we handle your data, we will update this page and change the date at the top. Please check back from time to time.
Contact
NYAS Group Ltd, by email at hayley@nyas.co.uk.