Landytech Privacy Notice

1. Introduction

Landy Tech Limited, trading as Landytech (“Landytech”, “we”, “us”, “our”), is committed to protecting your personal data.

This Privacy Notice explains how we collect, use, share, store and protect personal data when you visit www.landytech.com or otherwise interact with us in a marketing, recruitment or general-enquiry context.

We process personal data in accordance with applicable data protection laws, including:

• The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018
• The EU General Data Protection Regulation (Regulation (EU) 2016/679, the “EU GDPR”), where it applies to our processing of personal data of individuals in the European Economic Area
• The Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) and the corresponding ePrivacy rules in other jurisdictions

Other privacy notices

This Privacy Notice applies to the Landytech website and our general business activities. If you use our Sesame investment platform, there is a separate Sesame Privacy Notice that explains how data is handled on the platform itself.

Read the Cookie Notice and the Sesame Privacy Notice.

2. Who we are

Landy Tech Limited is the controller responsible for personal data collected through this website and through our wider marketing and recruitment activities. Our details are:

• Registered name: Landy Tech Limited (trading as Landytech)
• Registered office: 52A Cromwell Road, London, SW7 5BE, United Kingdom
• Companies House number: 11666126
• ICO registration number: ZA484082

We have offices in the United Kingdom, France (Paris) and India (Pune). Our Paris office serves as our principal establishment in the European Economic Area for the purposes of EU GDPR. We do not need to appoint an Article 27 EU GDPR representative because we have an EU establishment.

When we are a controller and when we are a processor

For the activities covered by this Privacy Notice (visiting our website, contacting us, marketing, events, recruitment), we are the controller of your personal data. This means we decide what data is collected, why, and how it is used.

When you access the Sesame investment platform as a user of an organisation that has subscribed to our services, we usually act as a data processor on behalf of that organisation. In that case, your employer (or the organisation that has given you access) is the controller of the personal data processed on the platform, and you should look at their privacy notice for information about how that data is used. The Sesame Privacy Notice explains how we handle data in our processor capacity.

3. What this notice covers

This Privacy Notice applies to personal data we collect and process when you:

• Visit or interact with www.landytech.com
• Contact us through the website, by email, by phone, by post, or through social media
• Sign up for our communications, events or webinars
• Use our chat widget or other interactive features
• Apply for a job through our website or are referred to us by a recruiter
• Are a business contact whose details we hold for sales, marketing or relationship-management purposes

4. The personal data we collect

We collect different categories of personal data depending on how you interact with us.

Contact data

Information that allows us to identify and contact you, including:

• Your name and job title
• Your business email address and telephone number
• Your postal address
• The name of your organisation or employer
• Your professional social-media profiles (for example, your LinkedIn URL)

Sources: you, your employer, or publicly available professional sources. We may also obtain business contact information from third-party sales-intelligence providers (see section 5).

Enquiry data

Information you provide when you make an enquiry with us, including your name, organisation, contact details, job title, and the content of your enquiry.

Account data

Where you create an account for any of our marketing services (for example, gated content downloads, event sign-ups, or our resource library), we process your account identifier, name, email address, organisation name, account creation and modification dates, preferences and marketing settings.

Communication data

The content of communications between you and us, including emails, chat messages, telephone records (where calls are recorded with notice), correspondence records and the associated metadata (time, date, channel).

Usage data

Information about how you use our website, including:

• Your IP address
• Approximate geographic location derived from your IP address
• Browser type and version, operating system, device type, language
• Referral source
• Pages visited, navigation paths, time spent and frequency of visits
• Mouse movements, clicks and scrolls (where you have consented to session recording)

We collect usage data through cookies and similar technologies. Full details, including the categories of data each cookie collects and the providers involved, are in our Cookie Notice. We only set non-essential cookies (analytics, session recording, marketing) where you have given us your consent.

Application data (recruitment)

If you apply for a role with us, we process:

• Your name, contact details and address
• Your LinkedIn profile, CV or résumé, and any cover letter or supporting documents
• Information about your skills, qualifications, work history and references
• Right-to-work documentation (which may include passport, visa or other immigration information)
• Information from any pre-employment screening or background checks we ask you to undergo, where appropriate to the role
• Information about your interactions with our recruitment process (interview notes, assessments)

Special category data

Some of the personal data we process is “special category data” under Article 9 UK GDPR — information about racial or ethnic origin, religious beliefs, health, sexual orientation, or trade-union membership, for example.

We only process special category data where one of the conditions in Article 9(2) UK GDPR and (where relevant) Schedule 1 of the Data Protection Act 2018 is met. In practice, the only times we process special category data are:

• Equal-opportunities monitoring during recruitment, where you choose to provide information about ethnicity, gender, disability or other protected characteristics. This is processed for the purpose of monitoring equality of opportunity (Article 9(2)(b) UK GDPR and Schedule 1 Part 1 Paragraph 8 DPA 2018). Providing this information is always optional and the data is held separately from your application file.
• Accessibility or health information you provide when asking for adjustments to our recruitment process or to our website (Article 9(2)(b) UK GDPR and Schedule 1 Part 1 Paragraph 8 DPA 2018).
• Information you provide that we need for the establishment, exercise or defence of legal claims (Article 9(2)(f) UK GDPR).

We maintain an appropriate policy document covering our processing of special category data, in line with Schedule 1 Part 4 Paragraph 39 of the Data Protection Act 2018. A copy is available on request from our DPO.

Criminal-records data

Where the role you have applied for involves a regulated activity or is otherwise subject to background checks (for example, roles in finance-adjacent functions), we may carry out a check that includes criminal-records information. We rely on Schedule 1 Part 2 of the Data Protection Act 2018 for this processing and only do so where it is necessary, proportionate and lawful. We will tell you in advance if such a check is required.

5. Personal data we receive from third parties

In a business-to-business context, we sometimes obtain professional contact information about you from third parties. This may include your name, job title, employer organisation and professional contact details.

The third-party sources we use include:

• Sales-intelligence providers and data brokers (for example, providers of B2B contact databases)
• Event organisers, webinar partners and referral sources, where you have registered for an event or webinar in which we are involved
• Publicly available sources such as company websites, regulator registers, news media, and professional networking platforms like LinkedIn

When we receive your personal data from a third party for the first time, we will provide you with this Privacy Notice (or a link to it) within a reasonable period — and in any case no later than one month — in line with Article 14(3) of the UK GDPR. Where we contact you directly, we will provide the notice in our first communication.

6. How we use your personal data and our legal basis

Under data protection law, we need a lawful basis for everything we do with your personal data. The table below summarises the main purposes for which we use personal data and the lawful basis that applies. The Article references are to the UK GDPR; the corresponding EU GDPR provisions are the same.

Where we rely on legitimate interests, we have weighed those interests against your rights. You can ask us for a copy of our legitimate interests assessment by contacting our DPO.

7. Who we share your personal data with

We may share your personal data with:

• Other members of the Landytech corporate group, where this is necessary for the purposes set out in this notice
• Service providers who help us run our business, including hosting and infrastructure providers, IT support, CRM and marketing platforms, analytics providers, chat and conferencing tools, applicant tracking systems, payment administration providers, and professional advisers
• Insurers and brokers
• Law-enforcement and regulatory authorities, where we are required to disclose information by law or by a court order
• Professional advisers (legal, accounting, tax, audit)
• Parties involved in any actual or proposed corporate transaction (for example, a merger, acquisition, refinancing or restructuring)

Where third parties process personal data on our behalf, we put in place written agreements that meet the requirements of Article 28 of the UK GDPR (and Article 28 of the EU GDPR where applicable).

Our Cookie Notice lists the specific third-party providers whose cookies and tags are present on our website.

8. International transfers

Some of our service providers are located outside the United Kingdom and the European Economic Area, in particular in the United States and India (where our Pune office is located).

When we transfer personal data outside the United Kingdom or the European Economic Area, we make sure that an appropriate safeguard is in place. The safeguards we rely on include:

• UK and EU adequacy regulations for transfers to countries (or sectors within countries) that the United Kingdom or the European Commission has formally recognised as providing an adequate level of protection
• The UK Extension to the EU–US Data Privacy Framework, for transfers to US-based recipients that are certified to the framework and have opted into the UK Extension
• The UK International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's Standard Contractual Clauses, where the recipient is not covered by an adequacy decision or the Data Privacy Framework
• The European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), for transfers from our Paris establishment that fall within EU GDPR

For transfers to India and other countries that are not covered by an adequacy decision, we carry out a Transfer Risk Assessment in line with guidance from the Information Commissioner's Office (ICO) and the European Data Protection Board (EDPB), and we put in place additional technical, contractual and organisational measures where necessary.

You can request more information about the safeguards we use, or for a copy of the relevant standard contractual clauses or transfer agreements, by contacting our DPO at dpo-office@cranium.eu.

9. How long we keep your personal data

We keep your personal data only for as long as we need it for the purposes for which we collected it, including to satisfy any legal, regulatory, tax, accounting or reporting requirements.

Our typical retention periods are:

We may keep personal data for longer where there is a legal or regulatory reason to do so, where there is an ongoing dispute, or where we need it to establish, exercise or defend legal claims. Once the retention period has ended, we delete or anonymise the personal data.

10. Automated decision-making and profiling

We do not use solely automated decision-making (decisions made without meaningful human involvement) to make decisions about you that produce legal effects or similarly significantly affect you, in the sense of Article 22 UK GDPR.

We do use some profiling for marketing personalisation — for example, we may tailor the content of our emails or website to your industry or job role based on what you have told us or what you have viewed. This profiling does not produce legal or similarly significant effects, and you can object to it at any time using the contact details in section 13.

Some of our products include AI-based features (for example, the Sesame aLi agent). The Sesame Privacy Notice explains how those features handle personal data on the platform.

11. Your rights

You have a number of rights over your personal data under the UK GDPR and (where it applies) the EU GDPR. They include:

• Right to be informed about how we use your personal data — this notice is part of how we meet that obligation.
• Right of access — you can ask us for a copy of the personal data we hold about you and for information about how we use it.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure (the “right to be forgotten”) — you can ask us to delete your personal data in certain circumstances.
• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
• Right to object to processing — you can object to processing based on legitimate interests, and you have an absolute right to object to direct marketing under Article 21(2) UK GDPR.
• Right to data portability — in some cases, you can ask us to transfer your data to another organisation or to you.
• Right to withdraw consent — where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of any processing we carried out before you withdrew it.
• Right to lodge a complaint with a supervisory authority — see section 12.

How we handle your requests

You can exercise any of your rights free of charge by contacting our DPO using the details in section 13. We may need to verify your identity before responding, particularly where the request involves sensitive data.

We will normally respond within one month of receiving your request. Where a request is particularly complex, or where you have made several requests, we may extend this by up to a further two months, in which case we will tell you within the first month and explain why.

Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on it. We will explain our reasoning if this is ever the case.

12. How to complain

If you are unhappy with how we handle your personal data, please contact us first so that we can try to resolve the issue. You can also lodge a complaint with a data protection supervisory authority.

In the United Kingdom, the supervisory authority is the Information Commissioner's Office:

• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Telephone: +44 (0)303 123 1113
• Web: ico.org.uk

If you are in the European Economic Area, you can lodge a complaint with your local data protection authority. A list of national authorities is available on the European Data Protection Board's website at EDPB list of national authorities. This includes the Commission nationale de l'informatique et des libertés (CNIL) in France, where our Paris office is located.

13. Children's data

Our website and services are not intended for children. We do not knowingly collect personal data from anyone under the age of 16. If you believe a person under 16 has provided us with personal data, please contact us and we will take steps to delete it.

14. Third-party websites

Our website contains links to third-party websites, including social-media platforms. We are not responsible for the privacy practices of those websites or platforms. We encourage you to read their privacy notices before sharing any personal data with them.

15. Changes to this Privacy Notice

We review this Privacy Notice regularly, and update it whenever the way we handle personal data changes in a material way. When we make changes, we update the version number and the date at the top of this notice. Where the changes are significant, we will tell you in a more prominent way (for example, by email or by displaying a banner on our website).

16. How to contact us

General privacy enquiries

Email: privacy@landytech.com
Post: Landy Tech Limited, 52A Cromwell Road, London, SW7 5BE, United Kingdom

Our Data Protection Officer

Our external Data Protection Officer can be contacted directly. You are welcome to contact the DPO instead of, or in addition to, our general privacy team.

Email: dpo-office@cranium.eu
Post: CRANIUM SA – DPO Office Landytech, Excelsiorlaan 43, 1930 Zaventem, Belgium