Privacy Policy

This policy explains how Gylds Limited ("Gylds", "we", "us" or "our") collects and uses personal data. It applies when you use the Gylds platform at gylds.com and our related services (the "Platform"), visit our website, or deal with us in other ways. It covers Individual Members, people who act for Organisation Members, Nominated Members, people invited to join, Visitors, and anyone who contacts us.

Words with capital letters have the meanings given in our Terms of Service. The key ones are repeated at the end of this policy. This policy is not part of our contract with you. We may update it from time to time (see section 20).

Summary of key points

1. Who we are and how to contact us

Gylds Limited is the controller of your personal data. It is a company registered in England and Wales with company number [●] and its registered office at [●].

For privacy questions or requests, contact [●name or role] at [●privacy email], or write to us at our registered office.

[EU representative: [●name, address, email]. To be confirmed before we open Gylds to users in the European Economic Area.]

[Türkiye data controller representative: [●]. To be confirmed before we open Gylds to users in Türkiye.]

2. Who this policy covers

This policy covers:

• Individual Members;
• people who act for an Organisation Member, such as the person who signs up or signs an Order Form;
• Nominated Members;
• people invited to join Gylds, including by an Organisation Member, before they join;
• Visitors to our public website; and
• anyone who contacts us, reports Content or is mentioned in a report.

3. What personal data we collect

We need your name, email address and professional details to create your Account. Without them, we cannot provide the Platform to you.

4. How we use your data, and our lawful bases

Data protection law requires us to have a lawful basis for each way we use personal data. The table below sets out ours under the UK GDPR and, where it applies, the EU GDPR.

When we rely on legitimate interests, we must balance our interests against your interests and rights. You can ask us for more information about how we do this, and you have the right to object (see section 12).

5. How anonymity and identity work

• Study responses. We design Studies so that other Members, including Study Owners and Organisation Members, see results only as Insights, not as individual responses linked to you. We apply minimum numbers of responses before results are shown.
• Posts, comments and messages. These may be shown with your name and profile details, or without them, depending on where you post and the Visibility Settings.
• What we can see. We can link all Content, including Study responses, to the Account that submitted it. Only people who work for or with us and need that access can see who contributed what, and they must keep it confidential.
• Content shown without your name is still personal data. Because we can link it to you, your data protection rights still apply to it.
• When we may disclose who contributed. We may do this where the law requires it (including under a court order), to regulators or law enforcement, to protect someone's safety, to establish or defend legal claims, or with your permission. Where the law allows and it is practical, we will tell you first.
• Limits. In small groups, other people may be able to guess who said what from the content itself. Anonymity on Gylds is a design feature, not a guarantee.

6. Insights and anonymised data

We combine Content from many Members to create Insights. We design Insights so that no individual or organisation can be identified from them. For example, we apply minimum numbers of responses before results are shown, and we remove or group details that could identify someone. Once data has been anonymised in this way, it is no longer personal data, so this policy and data protection rights no longer apply to it. We may keep Insights indefinitely, and we may share or publish them. If you ask us to delete your data, we will delete or anonymise your identifiable Content, but Insights already created will not change.

7. AI features

Some features of the Platform may use artificial intelligence, for example to summarise results, help design Studies or detect Content that breaks our Terms. These features are provided by third-party AI providers acting on our instructions, and we may send them the Content needed for the feature. We choose providers whose terms do not allow them to use your data to train their own models. We do not use AI, or any other automated process, to make decisions about you that have legal or similarly significant effects without human involvement. Any decision to suspend or close an Account is made or reviewed by a person.

8. Who we share your data with

• Other Members. As the Platform works: in line with Visibility Settings, and as Insights.
• Organisation Members. If you are a Nominated Member, we may tell the organisation that nominated you whether you have joined, and give it aggregated information about participation and Insights. We do not give it your individual Study responses, and we do not identify your Content to it, except as any other Member could see it.
• Circle Admins. When you ask to join a Circle, its Circle Admins may see your name and professional details so that they can consider your request.
• Service providers. Providers who act on our instructions, including for hosting and databases, authentication (including Google sign-in), email delivery, AI features, analytics and customer support. Also our professional advisers, such as lawyers, accountants and insurers. A list of our main service providers is available on request.
• Authorities and legal requests. Courts, regulators, law enforcement and other people where the law requires or permits it (see section 5).
• Business transfers. A buyer or investor, or their advisers, if we sell, restructure or finance our business, subject to confidentiality.
• Anyone else, with your permission.

We do not sell your personal data.

9. International transfers

We are based in the United Kingdom. Some of our service providers store or access data in other countries, including the United States and countries in the European Economic Area. When we transfer personal data outside the UK or the European Economic Area, we make sure a lawful safeguard is in place, such as adequacy regulations or standard contractual clauses (or their UK equivalents) approved for this purpose. You can ask us for details and for a copy of the relevant safeguard.

10. How long we keep your data

We keep personal data only for as long as we need it. Normally, this means:

We may keep data for longer where the law requires it, or where we need it to establish, exercise or defend legal claims.

11. How we protect your data

We use technical and organisational measures appropriate to the risk, such as access controls, encryption, and restricting access to people who need it. No system is completely secure, so we cannot guarantee the security of your data. If a personal data breach is likely to result in a high risk to you, we will tell you, as the law requires. Please help by keeping your login details secure.

12. Your rights

Under the UK GDPR, and the EU GDPR where it applies to you, you have the right to:

• access your personal data and receive a copy;
• correct inaccurate or incomplete data;
• delete your data (the "right to be forgotten");
• restrict how we use your data;
• object to our use of your data where we rely on legitimate interests. You can object to direct marketing at any time, for any reason;
• data portability: receive data you gave us in a commonly used, machine-readable format, where we use it on the basis of contract or consent;
• withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it; and
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you.

To exercise your rights, email [●privacy email] or use your Account settings where this is available. We may need to confirm your identity. We will respond within the time limits the law sets, which is usually one month. For complex requests this can be extended by up to two further months, and we will tell you if it is. Using your rights is usually free.

Some rights have exceptions. For example, we may need to keep some data to comply with the law or to defend legal claims. We cannot give you other people's personal data, such as the identity of someone who reported your Content, where doing so would affect their rights.

If you live outside the UK and the European Economic Area, you may have rights under local law. Contact us, and we will respond as that law requires.

13. Complaints

If you have a concern about how we use your personal data, please contact us first at [●privacy email] so that we can try to resolve it.

You also have the right to complain to a data protection authority:

• in the UK, the Information Commissioner's Office (ico.org.uk, telephone 0303 123 1113);
• in the European Economic Area, the data protection authority in the country where you live or work; and
• in Türkiye, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

14. Emails, marketing and invitations

• Service messages. We send the messages needed to run your Account. You cannot opt out of essential messages while your Account is open, but you can manage non-essential notifications.
• Marketing. We send marketing only with your consent, or where the law otherwise allows. You can opt out at any time using the unsubscribe link or by contacting us.
• Invitations. If a Member or Organisation Member invites you, we use your name and email address only to send the invitation and, where applicable, one reminder. If you do not join, we delete your details within [90] days. You can ask us not to contact you again.

15. Cookies

We use cookies and similar technologies. Our Cookie Policy explains which ones and how you can control them.

16. Children

Gylds is only for people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we learn that we have done so, we will delete it.

17. Sensitive information

We do not want special category data on Gylds, and our Terms prohibit Members from posting it about any identifiable person, including themselves. Special category data means information about health, racial or ethnic origin, religion or beliefs, political opinions, trade union membership, sex life or sexual orientation, genetics or biometrics. The same applies to information about criminal convictions or offences. If we find such information, we may remove or Quarantine it.

In Health Circles, information that could identify a patient must never be posted.

If joining a particular Circle could itself reveal special category data about you, for example a Circle for members of a trade union, we will ask for your explicit consent before you join it.

18. Organisations and the people they nominate

If an Organisation Member nominates you, it gives us your name, work email address and role so that we can invite you. The organisation is responsible for having a lawful basis to share your details and for telling you that it has done so.

We and the organisation are separate controllers. We use your details to invite you and, if you join, as described in this policy. If you do not join within [90] days, we delete your details, unless the organisation nominates you again.

19. Users in other countries

[If you are in Türkiye: a Turkish-language information notice under the Personal Data Protection Law No. 6698 is available at [●]. To be completed before we open Gylds to users in Türkiye.]

20. Changes to this policy

We may update this policy. The date at the top shows when it was last updated. If we make significant changes, we will tell you by email or on the Platform.

Key terms used in this policy

These terms have the same meanings as in our Terms of Service.