Legal
Privacy Policy
This Privacy Policy explains how Acornya Ltd collects, uses, stores, and shares your personal data when you use our website and services. It also describes the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and how to exercise them.
1. Who We Are
Acornya Ltd ("Acornya", "we", "us", "our") is a limited company registered in England and Wales (Company No. 17185415). Our registered office address is:
Office 18695182–184 High Street North
East Ham
London
E6 2JA
United Kingdom
We are the data controller for personal data collected through our website at acornya.com and any related services (collectively, the "Service").
For all data protection enquiries, please contact us at cto@acornya.com.
2. Personal Data We Collect
We collect personal data in the following ways:
Information you provide directly
- Email address (when you join our waitlist or contact us)
- Name (optional, when provided)
- Any information you choose to include in messages to us
Information collected automatically
- IP address and approximate geographic location
- Browser type, version, and device information
- Pages visited and time spent on the Service
- Referring URL and search terms used to find our site
- Cookie identifiers and similar tracking technologies
We do not knowingly collect personal data from individuals under the age of 16. If you believe we have inadvertently collected data from a minor, please contact us immediately at cto@acornya.com.
3. Lawful Basis for Processing
Under UK GDPR (UK General Data Protection Regulation) and the Data Protection Act 2018, we rely on the following lawful bases to process your personal data:
| Purpose | Lawful Basis |
|---|---|
| Managing waitlist registrations and sending product updates | Consent (Article 6(1)(a) UK GDPR) |
| Responding to enquiries and support requests | Legitimate interests — providing customer service |
| Website analytics and performance monitoring | Legitimate interests — improving our Service |
| Preventing fraud and ensuring security | Legitimate interests — protecting our users and systems |
| Complying with legal obligations | Legal obligation (Article 6(1)(c) UK GDPR) |
Where we rely on legitimate interests, we have carried out a Legitimate Interests Assessment (LIA) and determined that your interests and fundamental rights do not override our interests. You have the right to object to processing based on legitimate interests — see Section 7 for how to exercise this right.
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
4. How We Use Your Data
We use the personal data we collect to:
- Maintain and manage our early-access waitlist
- Send you updates about Acornya product launches and announcements (only with your consent)
- Respond to your enquiries and provide support
- Understand how the Service is used so we can improve it
- Detect, investigate, and prevent fraudulent or illegal activity
- Comply with applicable legal and regulatory obligations
- Enforce our Terms and Conditions
We will not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent.
5. Sharing Your Data
We do not sell, rent, or trade your personal data. We may share it with:
Service providers (data processors)
Third-party companies that help us operate the Service — for example, cloud hosting providers, email delivery services, and analytics platforms. These parties process data only on our documented instructions and are bound by data processing agreements that meet UK GDPR requirements.
Legal and regulatory authorities
Where we are required to do so by law, court order, or to cooperate with regulatory bodies such as the Information Commissioner's Office (ICO).
Business transfers
In the event of a merger, acquisition, or sale of all or part of our assets, your data may be transferred to the relevant third party. We will notify you before your data is transferred and becomes subject to a different privacy policy.
6. International Data Transfers
Your personal data may be transferred to and processed in countries outside the UK. When we transfer data internationally we ensure appropriate safeguards are in place, including:
- Transfers to countries with UK adequacy regulations in force (e.g. the European Economic Area under the UK–EU adequacy decision)
- Standard Contractual Clauses (SCCs) approved by the ICO or the UK International Data Transfer Agreement (IDTA) where adequacy decisions do not apply
- Other legally approved transfer mechanisms as permitted under UK GDPR Chapter V
You may request details of the specific safeguards in place for any transfer by contacting us at cto@acornya.com.
7. Your Rights Under UK GDPR
As a data subject under UK GDPR you have the following rights. These rights are not absolute and may be subject to exemptions in certain circumstances.
Right of access
You may request a copy of all personal data we hold about you (a Subject Access Request). We will respond within one calendar month.
Right to rectification
You may request that we correct inaccurate or incomplete personal data.
Right to erasure ('right to be forgotten')
You may request that we delete your personal data where there is no compelling reason for its continued processing.
Right to restriction of processing
You may request that we restrict processing of your personal data in certain circumstances.
Right to data portability
Where processing is based on consent or contract and is carried out by automated means, you may receive your data in a structured, commonly used, machine-readable format.
Right to object
You may object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
Rights related to automated decision-making
You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.
Right to withdraw consent
Where processing is based on consent, you may withdraw it at any time by contacting us or using the unsubscribe link in any marketing email.
To exercise any of these rights, please submit a request to cto@acornya.com. We may need to verify your identity before processing your request.
If you are not satisfied with how we handle your data or your rights request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AFTel: 0303 123 1113
Web: ico.org.uk
8. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal obligations.
| Data Type | Retention Period |
|---|---|
| Waitlist email addresses | Until you unsubscribe or request deletion, then 30 days |
| Support / enquiry correspondence | 3 years from last contact |
| Website analytics data | 26 months (anonymised after 13 months) |
| Security and fraud logs | 12 months |
| Financial and legal records | 7 years (as required by UK law) |
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction, including:
- Encryption of data in transit (TLS 1.2+) and at rest
- Access controls and role-based permissions for staff
- Regular security assessments and vulnerability testing
- Incident response procedures including ICO notification within 72 hours of discovering a notifiable breach
No method of transmission over the internet is 100% secure. If you have concerns about a potential security incident, please contact us immediately at cto@acornya.com.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Notify waitlist members by email where the changes are significant
- Obtain fresh consent where required by UK GDPR
We encourage you to review this page periodically to stay informed about how we protect your information.
12. Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact:
Acornya LtdOffice 18695
182–184 High Street North
East Ham
London
E6 2JA
United Kingdom
Email: cto@acornya.com
We aim to respond to all data protection enquiries within 5 business days, and within one calendar month for formal rights requests.