Data Protection

We aim to follow the main UK GDPR and GDPR principles. That means processing should be lawful, fair, and easy to understand. We keep purposes limited and we avoid collecting more than we need. We work to keep data accurate and not keep it forever without a reason. We protect integrity and confidentiality, and we take responsibility for how our systems behave.

We design flows to ask for what the current feature needs. Sign-in needs a phone number and a one-time code. Higher risk features may need identity checks. We do not ask for bank details until you are ready to withdraw. If a field is not helping you connect safely, we prefer not to keep it. That habit reduces risk for everyone.

Security controls include encrypted connections for traffic on the open internet. Our interfaces require proper authentication before they return private data. Sign-in uses one-time codes instead of long lived passwords sitting in the clear. Sensitive fields such as bank details for withdrawals get extra protection. We also watch for abuse patterns so we can respond when something looks wrong.

Only authorised roles can reach production systems and personal data. Access is based on need to know, not curiosity. We review who has access as people join or leave the team. Actions in sensitive areas may be logged so we can investigate issues. If access is no longer needed, we remove it.

Vendors that process data for us include cloud hosting, payments, verification, messaging delivery, and analytics. We expect them to meet security and contract standards that match their role. They should only use the data to provide the service we hired them for. We review major partners when we start or renew a relationship. If a vendor cannot meet our bar, we look for another path.

If a personal data breach happens, we assess the risk quickly. Where the law requires notice, we tell the people affected and the relevant authority within the required timelines. We also work to contain the issue and learn from it. You may receive clear guidance on steps you should take, such as watching for odd messages. We treat breach response as a serious duty, not a checkbox.

You can ask about your data by emailing hello@partneryn.com. Please include your phone number or username so we can find the right account. We may need to verify it is really you before we release information. We aim to reply within the timelines that apply to your region. Complex requests may take longer, and we will say so if that happens.

Retention follows the purposes in our Privacy Policy. Account data stays while your account is active and for a short wind down after deletion where needed. Payment and fraud records may stay longer because finance and safety rules require it. When a retention period ends, we delete or anonymise the data. We revisit these periods as the product and laws evolve.

Some processing may happen outside the United Kingdom or European Economic Area. When that is true, we use safeguards the law accepts. That can include approved contract clauses between companies. We choose regions and partners with care. Ask us if you need a clearer picture of a specific flow.

For data protection questions, write to hello@partneryn.com. Mention Data Protection in the subject so we can route it quickly. Include enough detail for us to help without guessing. Related reading lives on the Privacy Policy and Cookies pages. We will answer in plain language whenever we can.