Privacy Notice

1. Who we are

The data controller for kayjasolutions.com, our Operations Check diagnostic, and our business automation kits and services is Kayja Solutions Ltd (registered in England & Wales under company number 15562258, registered office: 92 Sheldon Road, Chippenham, Wiltshire, SN14 0BX).

Kayja Solutions Ltd is registered with the UK Information Commissioner's Office (ICO) under registration reference ZC200419. You can contact us regarding data protection at admin@kayjasolutions.com or kolao@kayjasolutions.com.

2. What data we collect and use

Depending on how you interact with us, we may collect and process:

• Your name, business name, role, and business email address
• Your business phone number, website URL, postcode or town, and trade or service category where you provide them
• Your answers to our free Operations Check diagnostic or written service intake questions
• Your enquiry messages, call booking details, and our correspondence history with you
• Messages you send to our website chatbot, plus an irreversibly hashed form of your IP address used solely for abuse prevention
• Purchase, payment, delivery, refund, and dispute records if you buy a digital kit or service from us
• Publicly available corporate business information (for UK limited companies and LLPs) used for limited B2B relevance checks
• Consent, opt-out, suppression, and unsubscribe records

We do not ask for special-category (sensitive) personal data. Please do not submit passwords, bank login details, or sensitive personal health or criminal records through our forms or chat.

3. If you buy a product or service from us

When you purchase a digital kit, diagnostic, or service from Kayja Solutions Ltd (such as the Trade Cashflow Follow-Up Kit or our Digital Operations Diagnostic), we collect and use the following information:

• What we collect: Your name, business name, work email address, billing address or postcode (where provided at checkout), the product or service purchased, the amount and currency paid, the date and time of the transaction, the Stripe payment reference, any written intake answers you submit for a service review, and records of delivery, refund requests, or payment disputes.
• Payment card security (Stripe): All card and wallet payments are processed directly by Stripe (Stripe Payments UK Ltd / Stripe Payments Europe, Limited). We never see, collect, or store your full debit or credit card number, CVV security code, or bank login details. Stripe acts as our payment processor to complete your transaction and also acts as an independent data controller for payment network compliance, security, and fraud prevention. You can read Stripe's Privacy Policy at https://stripe.com/gb/privacy.
• Why we use purchase data and our lawful basis (UK GDPR):

1. Contract (Article 6(1)(b)): To confirm your payment, send your receipt, deliver your purchased files or written report, provide customer support, and handle any refund request.
2. Legal obligation (Article 6(1)(c)): To keep accurate company accounting, invoicing, and tax records under the Companies Act 2006 and HMRC requirements.
3. Legitimate interests (Article 6(1)(f)): To reconcile payments, prevent fraud, and respond to any payment query or chargeback dispute.

• No unwanted marketing: We use your checkout details to deliver your purchase and send transactional receipts or service updates. We will not use your purchase details to send unrelated marketing emails without your separate permission.

4. How we use enquiry, diagnostic, and booking data (and lawful bases)

• Responding to enquiries and Operations Check submissions (Article 6(1)(b) pre-contract steps or Article 6(1)(f) legitimate interests): We use your contact details and responses to generate your diagnostic results, answer your questions, and follow up on your request.
• Booking meetings (Article 6(1)(b) contract / pre-contract steps): If you book a call with us, we use your details to schedule, confirm, reschedule, or cancel that meeting.
• Correspondence and CRM records (Article 6(1)(f) legitimate interests): We use Customer Relationship Management (CRM) software to record and store correspondence with our team and prepare short internal summaries of enquiries so we can respond accurately and maintain continuity of service. This does not involve automated decision-making with legal or similarly significant effects.
• Website chatbot (Article 6(1)(f) legitimate interests): Before starting a chat, we ask for your name and email address so we can follow up on your enquiry. Those contact details are stored in our CRM and are not shared with the AI language model. Chat messages are processed using a third-party AI provider (USA) to answer your question, and raw chat transcripts are deleted within 30 days.
• Direct marketing (Article 6(1)(a) consent or Article 6(1)(f) B2B legitimate interests): Website marketing opt-in checkboxes are optional and unchecked by default. For individual subscribers, sole traders, and traditional partnerships, we only send marketing emails with explicit opt-in consent.

5. Business-to-business (B2B) outbound contact to UK limited companies

Kayja Solutions Ltd carries out a small volume of individually researched B2B email outreach to UK registered corporate subscribers (Ltd, PLC, or LLP companies only). We never send cold emails to sole traders, unincorporated partnerships, or personal consumer addresses unless a verified limited company publishes that address on its own corporate website as its official business contact.

Our lawful basis for this corporate B2B contact is legitimate interests (Article 6(1)(f) UK GDPR): our commercial interest in introducing relevant workflow and cashflow tools to UK companies, balanced against low-frequency, business-relevant contact. Every message clearly identifies Kayja Solutions Ltd, links to this Privacy Notice, and includes a simple opt-out (reply "unsubscribe" or click the opt-out link). If you opt out, we stop immediately and retain only a minimal suppression record so we never contact you again.

6. Service providers and international transfers

We use trusted service providers to run our website and deliver our services, including Stripe (payment processing), IONOS and cloud hosting providers (website and application hosting), Resend (transactional and business email delivery), Cal.com (meeting scheduling), and a third-party AI provider (USA) for chatbot responses and internal enquiry summaries. We never sell your personal data.

Where a service provider processes data outside the UK or European Economic Area (EEA), we rely on UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses (SCCs).

7. How long we keep your data (Retention)

• Purchase, payment, invoice, refund, and dispute records: Kept for 6 years plus the current financial year from the transaction date, as required by UK company and tax law (Companies Act 2006 section 388 and HMRC rules).
• Written service intake answers and tailored review reports: Kept for 12 months from delivery so we can answer follow-up questions or support you if you upgrade, and then deleted unless you become an ongoing client.
• General enquiries and diagnostic submissions (unconverted): Deleted or anonymised 12 months after our last active contact with you.
• Researched B2B corporate prospects who do not respond or engage: Deleted within 90 days of the final outreach message (or within 30 days if researched and not contacted).
• Raw website chatbot logs: Deleted within 30 days of the conversation.
• Opt-out and unsubscribe suppression records: We keep a minimal suppression record indefinitely so we can respect your opt-out and ensure we do not contact you again.

8. Cookieless website analytics

We use a self-hosted instance of Plausible Analytics to measure aggregate website traffic (for example, how many visitors view our pages or complete the Operations Check). Plausible is completely cookieless, does not track you across other websites, and stores no personal data.

9. Your data protection rights and how to complain

Under UK GDPR, you have the right to request access to your personal data, correction of inaccurate data, erasure (where we are not legally required to keep the record, such as the mandatory 6-year retention period for tax and accounting records under Article 17(3)(b)), restriction of processing, or data portability. You also have an absolute right to object to direct marketing at any time.

To exercise any of your rights, email admin@kayjasolutions.com or kolao@kayjasolutions.com.

If you are unhappy with how we have handled your data, please contact us first so we can resolve it promptly. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/ or by calling 0303 123 1113.