Legal

Data Protection

Last updated: June 2025 · Kyros Technologies Ltd

Kyros Technologies Ltd is committed to protecting personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our commitment

We understand that the data entrusted to us — particularly the identity documents and personal details of security professionals — requires the highest standards of care. We take this responsibility seriously.

This page outlines our data protection framework, the safeguards we have in place, and how we ensure ongoing compliance.

Data controller

Kyros Technologies Ltd is the data controller for all personal data processed through the Kyros platform. For all data protection matters, contact us at info@kyros.tech.

Principles we follow

All personal data processed by Kyros is handled in accordance with the following principles:

LawfulnessAll processing has a valid legal basis under UK GDPR

Purpose limitationData is collected for specified, explicit and legitimate purposes only

Data minimisationWe only collect what is necessary for the purposes stated

AccuracyWe take steps to keep personal data accurate and up to date

Storage limitationData is not kept longer than necessary

SecurityAppropriate technical and organisational measures are in place

Technical safeguards

We employ the following technical measures to protect personal data:

All data in transit is encrypted via HTTPS/TLS
Data at rest is encrypted within our cloud infrastructure (Supabase / AWS)
Authentication uses industry-standard secure tokens and magic link verification
Access to personal data is restricted on a need-to-know basis
Verification documents (ID, SIA licences) are stored in isolated, access-controlled storage buckets
Security headers are enforced across all web properties (HSTS, CSP, X-Frame-Options)

Third-party processors

We use a limited number of trusted third-party processors to operate the platform:

Supabase — database, authentication and file storage (hosted on AWS, EU region)
Stripe — payment processing (PCI-DSS compliant)
Netlify — website hosting

All processors are subject to data processing agreements and are required to maintain appropriate security standards.

Special category data

Kyros processes certain categories of sensitive personal data as part of guard verification, including identity documents and biometric data (selfie photos for identity matching). This data is processed solely for the purpose of verifying eligibility to work as a security professional and is handled with additional safeguards.

Data breach procedure

In the event of a personal data breach, Kyros will:

Contain and assess the breach as a matter of urgency
Notify the ICO within 72 hours where required under UK GDPR
Notify affected individuals without undue delay where there is a high risk to their rights and freedoms
Document all breaches, including those not reportable, in our internal breach register

Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict and port your personal data. You also have the right to object to processing and to withdraw consent where processing is based on consent.

To make a request, contact us at info@kyros.tech. We will respond within 30 calendar days.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Contact

For all data protection matters: info@kyros.tech