Privacy Policy

1. Personal data we collect

1.1 Cylvy® does not intentionally collect or require special-category personal data, criminal-offence data or other similarly sensitive personal information. The Services are not designed or authorised for the submission of such data, and users must not provide it through the Services.

1.2 We may collect business contact and professional information, including your name, job title, employer, professional contact details, public professional-profile information, company information and related sales or CRM records.

1.3 We may obtain this information from publicly available professional and company sources, including LinkedIn, and from business-information and data-enrichment services such as Apify and Cognism.

1.4 We use this information to identify relevant prospective business contacts and buying committees; understand prospective customer organisations; develop and manage sales opportunities; maintain business-development and CRM records; and conduct relevant B2B marketing and outreach concerning Cylvy® and related Silver Agency services.

1.5 Silver Agency Ltd acts as controller for this processing. We rely on our legitimate interests in identifying and communicating with relevant prospective business customers, developing our business and marketing our services.

1.6 Our outreach is directed to people in relevant professional roles at companies, limited liability partnerships, public bodies and other corporate organisations. We do not use this process to conduct unsolicited electronic marketing to sole traders or ordinary partnerships unless we have an appropriate permission to do so.

1.7 Where we obtain your information from a public or third-party source rather than directly from you, we will provide or make available the relevant privacy information within the period required by applicable data-protection law. This may include providing a link to this Privacy Policy in our first communication with you.

1.8 You may object at any time to our use of your personal data for direct marketing. If you object or unsubscribe, we will stop using your information for that purpose. We may retain limited information on a suppression list where necessary to ensure that your preference continues to be respected.

1.9 Business contact and marketing prospect information is retained for up to 24 months unless it is no longer required sooner or you object to its use for direct marketing. Limited suppression information may be retained for longer where necessary to ensure that an opt-out continues to be respected.

2. How and why we use personal data (purposes & lawful bases)

2.1 Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask for details of that balancing test.

2.2 We do not rely on consent as the basis for delivering the core Service; acceptance of the Terms is a contractual acknowledgement, not GDPR consent.

3. Marketing communications

3.1 We only send marketing where we have a lawful basis. You can opt out at any time via the unsubscribe link in any marketing email or by contacting privacy@cylvy.com. For US recipients, our marketing emails comply with CAN-SPAM (accurate headers, a postal address, and a working opt-out honoured promptly).

4. Sharing your personal data

4.1 We share personal data with:

• We use third-party service providers to support our operations. Where a provider processes Customer Personal Data on behalf of Silver Agency Ltd in providing the Cylvy® Services, the principal providers referred to in the Terms are Google Cloud Platform, Stripe, WorkOS and Mailgun. Details are provided in our Sub-processors List at https://cylvy.com/terms-of-service/?document=sub-processors.

• • Other providers support Silver Agency Ltd’s own business and marketing activities, including Apify and Cognism for professional-contact discovery and enrichment.

• • Website, consent and analytics providers include CookieYes for consent management; Google Tag Manager for consent-aware tag orchestration; a self-hosted RudderStack data plane for consented event collection and routing; Google Analytics 4 for server-side audience and Site-performance reporting; and a self-hosted Mautic platform for consented engagement measurement and marketing automation. WordPress, WP Engine and Cloudflare support Site operation, hosting and security. These providers support Silver Agency Ltd’s controller-side website, analytics and marketing activities and do not therefore necessarily appear in the Customer Data Sub-processors List.

• • Professional advisers, auditors, and authorities where required by law.

• • A buyer or successor in connection with a merger, acquisition, or reorganisation, subject to this policy.

4.2 We do not sell personal data or share it with third parties for cross-context behavioural advertising. See the US section for further information.

4.3 CookieYes provides our consent banner and records consent choices. Google Analytics and other non-essential analytics or marketing-measurement technologies do not load until the relevant consent has been given. You can reopen Cookie Settings and change or withdraw consent at any time using the CookieYes privacy-preferences button displayed on the Site. Further details, including the technologies, purposes and durations, are set out in our Cookie Policy at https://cylvy.com/terms-of-service/?document=cookie-policy.

4.4 If you consent to analytics, a self-hosted RudderStack data plane collects Site page-view and usage events and routes consented events to Google Analytics 4 using the GA4 Measurement Protocol. The current configuration does not load Google’s browser analytics library and does not create \_ga cookies. If you consent to the applicable marketing-measurement category, our self-hosted Mautic platform measures engagement with Cylvy® content and supports marketing automation. We do not use third-party advertising or remarketing cookies.

5. International transfers

5.1 We are UK-based but some sub-processors are outside the UK (for example in the US/EU). Where personal data is transferred outside the UK, we use an appropriate safeguard, such as the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum, and carry out a transfer risk assessment where required.

6. Retention

6.1 We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, meet our legal and accounting obligations, protect the security of the Services, resolve disputes and enforce our agreements. Our normal retention periods are:

• • Account and profile information: for the duration of the account and for up to 12 months after the account is closed.

• • Customer workspace data, prompts, files and outputs: for the duration of the applicable customer agreement. Following termination, Customer Personal Data will be returned or deleted in accordance with the Terms of Service and Data Processing Agreement and will normally be deleted from active systems within 30 days.

• • Backup copies: deleted Customer Personal Data may remain in encrypted backups until those backups expire through the normal backup lifecycle, normally within 90 days. Backup data is not restored except where required for service recovery, security or legal purposes.

• • Billing, transaction and accounting records: for six years from the end of the financial year to which the records relate, or for longer where required by law.

• • Security, access and application logs: for up to 12 months, unless a longer period is reasonably necessary to investigate a security incident, suspected fraud, misuse or a legal claim.

• • Support and service communications: for up to 24 months after the relevant request or matter is closed, unless longer retention is reasonably required to resolve an ongoing issue.

• • Business contact and marketing prospect information: for up to 24 months, unless it is no longer required sooner or the individual objects to its use for direct marketing.

• • Marketing suppression information: limited information may be retained for as long as necessary to ensure that an objection or unsubscribe request continues to be respected.

• • Cookies and similar technologies: for the periods stated in our Cookie Policy.

6.2 Where Silver Agency Ltd processes Customer Personal Data on behalf of a customer, retention and deletion are also governed by the customer’s instructions, the applicable agreement and the Data Processing Agreement.

6.3 We may retain information for longer where required by law, where necessary to establish, exercise or defend legal claims, or where deletion is temporarily restricted for security, fraud-prevention or regulatory reasons. When personal data is no longer required, we delete or anonymise it securely.

7. Security

7.1 Silver Agency Ltd uses technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures used in connection with the Cylvy® Services include:

• • hosting through Google Cloud Platform infrastructure in the European Union and United States;

• • encryption of data at rest and protection of data in transit using HTTPS, TLS or equivalent encrypted communications;

• • authentication and user-management services provided through WorkOS;

• • role-based restrictions on access to production systems and personal data;

• • multi-factor authentication for relevant administrative access;

• • application, authentication, administrative and security logging and monitoring;

• • automated backup and recovery measures;

• • vulnerability, dependency and configuration management;

• • bot and abuse-protection measures using Google reCAPTCHA; and

• • measures designed to support the availability, recovery, deletion and resilience of relevant systems and data.

7.2 Access to personal data is limited to authorised personnel who require access for their role and who are subject to appropriate confidentiality obligations.

7.3 No method of electronic transmission or storage is completely secure. Although we use measures designed to protect personal data, we cannot guarantee absolute security.

8. Your rights (UK / EU)

8.1 Subject to conditions, you have the right to: access your data; request rectification or erasure; restrict or object to processing; data portability; and to withdraw consent where we rely on it. Where we rely on consent for cookies or similar technologies, you can change or withdraw that consent at any time using the CookieYes privacy-preferences button displayed on the Site. Where we process data as a processor on a Customer's behalf, please direct requests to that Customer; we will assist them as required.

8.2 To exercise your rights, contact privacy@cylvy.com. We will respond within the statutory timeframe (normally one month). You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we ask that you contact us first.

9. United States - California (CCPA/CPRA) and other states

9.1 This section applies to California residents and, where relevant, residents of other US states with similar laws.

9.2 Notice at collection. We collect the categories of personal information in Section 1 for the business and commercial purposes in Section 2.

9.3 Categories disclosed. In the past 12 months we may have disclosed identifiers, commercial information, internet or usage activity, and professional information to Sub-processors used to provide and secure the Cylvy® Services, to controller-side service providers supporting our business and marketing activities, and to cookie and analytics providers as described in this Privacy Policy and our Cookie Policy.

9.4 Sale and sharing of personal information. Silver Agency Ltd does not sell personal information or share it with third parties for cross-context behavioural advertising. We do not use personal information to create matched, custom or lookalike advertising audiences, and we do not use advertising or retargeting technologies that track individuals across different businesses, websites or services. If our practices change in the future, we will update this Privacy Policy and provide any notices, choices or opt-out mechanisms required by applicable law before beginning the relevant processing.

9.5 Sensitive personal information. We do not use sensitive personal information for purposes that trigger the right to limit; if this changes we will provide a "Limit the Use of My Sensitive Personal Information" control.

9.6 Your US rights. Subject to the law, you may request: to know/access the personal information we hold; to delete it; to correct it; to opt out of sale/sharing; and to non-discrimination for exercising these rights. You may use an authorised agent. To make a request, contact privacy@cylvy.com or use https://cylvy.com/data-request. We will verify your identity before responding.

10. Children

10.1 The Service is for business use and is not directed to children. We do not knowingly collect data from anyone under 16.

11. Automated decision-making

11.1 We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing without human involvement.

11.2 AI features produce analysis and Output for users to review and use. The Service does not make solely automated decisions about individuals that produce legal or similarly significant effects.

12. Changes to this policy

12.1 We may update this policy. The "Effective date" and "Version" show the latest version; for material changes we will provide additional notice (e.g. email or in-product).

13. Contact

• • Privacy / data protection: privacy@cylvy.com

• • Post: Silver Agency Ltd, 6 Manor Park Business Centre, Mackenzie Way, Cheltenham, Gloucestershire, GL51 9TX, United Kingdom.

• • EU representative: Not currently required.

13.1 Company details (Companies Act 2006): Silver Agency Ltd · Company No. 05489754 · Registered office: 6 Manor Park Business Centre, Mackenzie Way, Cheltenham, Gloucestershire, GL51 9TX, United Kingdom.