LAYRR — Privacy Notice

Last updated: 3 September 2026 Applies to: layrr.co and all associated subdomains

1. Who we are

LAYRR is a trading name of We Are Nium Ltd, a company registered in England and Wales (company number 14150518), with its registered office at:

126 Olympic Avenue Milton Park Oxfordshire OX14 4SA United Kingdom

We are the "controller" of the personal data described in this notice. That means we decide why and how your personal data is used.

For any privacy question, or to exercise the rights set out in section 8, contact us at hello@layrr.co.

We are registered with the Information Commissioner's Office (ICO) under registration number 00014380952.

2. What this notice covers

This notice explains what personal data we collect when you visit our website, contact us, apply for a role, or engage with us commercially — and what we do with it. It does not cover third-party websites we link to; those have their own notices.

3. The personal data we collect

Information you give us directly

What When Name, work email, employer, job title, phone number You use a contact form, email us, or request information Message content and any attachments You correspond with us CV, work history, education, right-to-work information You apply for a role with us Business contact and contractual details You are a customer, supplier, partner or investor contact

Information we collect automatically

What Notes IP address, browser type and version, operating system, device type Collected via server logs Pages visited, referring URL, time and duration of visit Collected via analytics — see section 6 Cookie identifiers See section 6

Information from third parties

We may receive your business contact details from your employer, a mutual introduction, a professional network such as LinkedIn, a recruitment agency, or publicly available sources such as Companies House.

We do not knowingly collect data from anyone under 18, and we do not collect special category data (such as health or biometric data) through this website.

4. Why we use your data, and our lawful basis

Under UK GDPR we must have a lawful basis for each use. Ours are:

Purpose Lawful basis Responding to your enquiry or correspondence Legitimate interests — running and growing our business Managing a commercial relationship (customers, suppliers, partners) Performance of a contract, or legitimate interests where you are a contact at a corporate counterparty Sending updates about our technology and company news Consent, or the "soft opt-in" for existing business contacts. You can withdraw at any time Recruitment and assessing applications Legitimate interests, and taking steps prior to entering a contract of employment Investor relations and fundraising correspondence Legitimate interests Website security, fraud prevention, and service reliability Legitimate interests — protecting our systems Analytics to understand and improve the site Consent (via our cookie banner) Meeting legal, tax, export control and regulatory obligations Legal obligation

Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You can ask us for details of that assessment.

5. Who we share your data with

We do not sell your personal data. We share it only with:

  • Service providers acting on our instructions — website hosting, email, cloud storage, CRM, analytics, and IT support. Each is bound by a written contract requiring appropriate security and permitting use only for our purposes.

  • Professional advisers — lawyers, accountants, auditors and insurers, where necessary.

  • Prospective or actual investors, buyers or funders, and their advisers, in connection with a financing, acquisition or reorganisation.

  • Regulators, law enforcement or courts, where we are legally required to do so.

Our principal processors are our website host (Squarespace), our email provider, our CRM, and our website analytics provider.

6. Cookies and analytics

We use cookies and similar technologies. Strictly necessary cookies — those required for the site to function and stay secure — are set without consent. All other cookies, including analytics and any marketing cookies, are set only if you accept them via our cookie banner.

The cookies we use are:

Cookie / provider Type Purpose Duration crumb (Squarespace) Strictly necessary Prevents cross-site request forgery Session ss_cvisit, ss_cvr, ss_cid (Squarespace) Analytics Distinguishes visitors and measures site usage Up to 2 years ga, ga_<id> (Google Analytics) Analytics Distinguishes visitors and measures site usage 2 years _gid (Google Analytics) Analytics Distinguishes visitors 24 hours

Squarespace may set additional cookies if you use particular features of the site, such as a form or a members area. A current list is published in Squarespace's own cookie documentation.

You can change or withdraw your cookie preferences at any time by emailing cookies@layrr.co, or by clearing or blocking cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site working.

7. International transfers

Some of our service providers are based outside the UK, including in the United States and the European Economic Area. Where personal data leaves the UK, we make sure it is protected by one of the following:

  • a UK adequacy decision covering the destination country;

  • the ICO's International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum; or

  • another safeguard permitted under UK GDPR.

You can request a copy of the relevant safeguard from hello@layrr.co.

8. Your rights

You have the right to:

  • access the personal data we hold about you;

  • rectify data that is inaccurate or incomplete;

  • erase your data in certain circumstances;

  • restrict how we process your data;

  • object to processing based on legitimate interests, and to direct marketing at any time;

  • portability — receive certain data in a machine-readable format;

  • withdraw consent where consent is our basis, without affecting processing carried out before withdrawal.

To exercise any of these, email hello@layrr.co. We will respond within one month. We may ask you to verify your identity first. There is normally no charge.

If you are unhappy with how we have handled your data, please tell us so we can put it right. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

9. How long we keep your data

Data Retention Website enquiries and correspondence [24 months] from last contact Unsuccessful job applications [6–12 months] after the decision, unless you agree to us keeping it longer Customer, supplier and partner records Duration of the relationship plus [6] years, to meet contractual and tax obligations Marketing contacts Until you unsubscribe, plus a suppression record so we do not contact you again Server logs and analytics [12–26 months]

Where a legal or regulatory obligation requires longer retention, we keep the data for that period.

10. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls on a need-to-know basis, supplier due diligence, and staff confidentiality obligations. No transmission over the internet is completely secure, so we cannot guarantee absolute security of data sent to us.

11. Changes to this notice

We may update this notice from time to time. The current version is always available at layrr.co/privacy, and the "last updated" date at the top shows when it changed. Where changes are significant, we will notify you directly if we hold your contact details.

12. Contact

Privacy enquiries: hello@layrr.co Post: We Are Nium Ltd (trading as LAYRR), 126 Olympic Avenue, Milton Park, Oxfordshire, OX14 4SA, United Kingdom