Legal
Privacy Policy
Thanks for your interest in Loyston. Your privacy matters to us, so we've kept this policy as short and clear as we can. It explains what we collect, why, and the choices you have.
Version 1.2 · Last updated 22 October 2026
The short version
- We collect what you give us when you get in touch, share feedback or join our beta, plus security data and, only with your consent, website analytics.
- We use it only for essential business purposes: replying to you, running the beta and working together. We never sell or share it.
- Your feedback answers are never shared. Any summary report we publish uses only combined, anonymised results, so no person or organisation can be identified.
- You're in control: email getintouch@loyston.com any time to see, correct or delete your information.
Who are we?
Loyston is an AI readiness platform provided by Johnson Macadam Ltd, “JML”, ("Loyston", "we", "us" or "our").
- Company number: 04927479
- Registered address: 6 Brunswick Street, Carlisle, Cumbria CA1 1PN, United Kingdom
- ICO registration number: C2066721
We are the controller of the personal information described in this policy. That means we decide how it is used and we are responsible for looking after it. This policy covers our website, loyston.com, our founding BETA programme and the emails we exchange with you.
We follow the principles of the UK GDPR and the EU GDPR, together with the UK Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) and applicable United States federal and state privacy and data security laws.
Put simply: we collect only what we need, use it only for essential business purposes, keep it safe and don't keep it for longer than necessary.
What do we collect?
- When you register interest on our website: your name, work email, organisation, role and any message you choose to send, plus the page you submitted the form from and the date and time you submitted it.
- When you share feedback on our "Have your say" form: your sector, organisation size and country or region, your answers and any comments. If you ask for the summary report or want to join the BETA, also your name, work email, organisation and role, plus your BETA answers (such as your goals, timescales and where your AI runs today). We also record the date and time, the page you used and your consent.
- When we email each other: the emails we exchange, including your contact details and anything you choose to include.
- When you visit our website: our web host keeps basic server logs (your IP address, browser type, the pages you request and timestamps). We use these to keep the site secure.
- Security tools: our security provider processes technical information about visits to our website (such as IP address and browser details) to detect and block attacks, spam and abuse.
- Website analytics, only if you accept analytics cookies: information about how you use our site, such as the pages you visit, how you arrived, your device and browser type, and your approximate location (worked out from your IP address).
That's everything. We don't buy information about you from anyone else.
Why do we use it?
We use your information only for the essential business purposes below. Data protection law asks us to name a "lawful basis" for each one, so we've set those out too.
| What we use it for | Our lawful basis |
|---|---|
| Responding to your enquiry | Legitimate interests (replying to people who contact us), or taking steps at your request before entering into a contract |
| Learning from your feedback to shape what we build, and producing a summary report of combined, anonymised results | Legitimate interests (understanding what matters to organisations like yours) |
| Sending you the summary report, if you ask for it | Consent, which you can withdraw at any time |
| Running the BETA programme | Taking steps before entering into a contract, and then performing that contract |
| Following up with you about your enquiry or the beta | Legitimate interests |
| Contracts and invoicing | Performing our contract with you or your organisation |
| Meeting our legal, tax and accounting obligations | Legal obligation |
| Keeping our website and systems secure, including security cookies and tools | Legitimate interests |
| Understanding how our website is used, so we can improve it (analytics) | Consent, which you can withdraw at any time |
| Optional marketing updates, only if you ask for them | Consent, which you can withdraw at any time |
Where we rely on legitimate interests, we have weighed our interests against your rights, and you can object at any time. We'll only send you marketing emails if you have opted in, and every one will include an easy way to unsubscribe. You can also just email us.
Who do we share it with?
We do not sell or share your personal information. That includes "selling" and "sharing" as US state privacy laws define them, so we never share it for cross-context behavioural advertising.
Your individual feedback answers are never shared outside Loyston. Our summary reports only ever use combined, anonymised results from many responses, and we leave out any group too small to keep people and organisations anonymous.
We use trusted service providers ("processors") who handle information on our behalf, under contract, and only on our instructions:
- Google (Google Workspace): our email, and the Google Sheets where enquiries and feedback from our website forms are stored (using Google Apps Script).
- Zen Internet: our UK web host, which runs loyston.com and keeps the server logs.
- Website security tools that help protect loyston.com from attacks, spam and abuse.
- Website analytics to help us monitor and improve how our websites perform, only if you accept analytics cookies.
We will also disclose information if the law requires us to, for example to meet our tax obligations.
Where is your information processed?
Your information is processed by us in the UK and US, and our service providers may also process it in the EU and the US. Whenever it moves outside the UK or EU, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or UK Addendum, the EU Standard Contractual Clauses (SCCs), or the UK-US Data Bridge where it applies. Just ask if you would like more detail.
How long do we keep it?
- Enquiries that don't go further: deleted after 24 months.
- Feedback form answers: kept for 24 months from when you send them, then deleted or fully anonymised. If you ask us to delete your feedback sooner, we will.
- Client records (such as contracts, invoices and related correspondence): kept for 6 years after our relationship ends, for UK tax and legal reasons.
- Website server logs: kept for a reasonable period for essential business purposes.
- Analytics data: kept for a reasonable period for essential business purposes.
When we no longer need information, we delete it securely.
How do we keep it safe?
We use reasonable technical and organisational measures to protect your information against loss, misuse and unauthorised access, including limiting access to the people who need it. No system is ever perfectly secure, but if something goes wrong we'll act quickly and tell you and the regulator where the law requires us to.
Do we use cookies and similar technologies?
Yes. Cookies are small files stored on your device, and similar technologies (such as scripts and pixels) work in much the same way. We use two kinds:
- Strictly necessary and security cookies (always on): these keep our website working and secure, for example by protecting it from attacks and spam, and by remembering your cookie choice. The law allows us to use these without asking, because the site can't work properly without them.
- Analytics cookies (only if you say yes): these help us understand how visitors use our site so we can improve it.
Your choice. When you first visit, our cookie banner lets you accept or reject analytics cookies. In line with PECR, analytics cookies stay switched off unless and until you click accept. If you're in the US, you can opt out at any time. Wherever you are, you can change your mind using the "Cookie settings" link at the bottom of every page, or through your browser settings.
We honour Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a request to opt out and won't load analytics. We treat Do Not Track signals the same way.
What are your rights?
Under UK and EU data protection law, you have the right to:
- Access the personal information we hold about you
- Correct anything that is wrong or incomplete
- Delete your information
- Restrict how we use it
- Object to how we use it, including to marketing at any time
- Portability: receive your information in a portable format, or have it sent to someone else
- Withdraw your consent at any time, where we rely on it (this doesn't affect anything we did before)
To use any of these rights, email getintouch@loyston.com. It's free, and we'll respond within one month. If a request is complex we may need longer, as the law allows, and we'll let you know. We may ask you to confirm your identity first.
If you're unhappy with how we've handled your information, please talk to us first so we can put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. If you're in the EU, you can contact your local data protection authority.
Are you in the US?
If you live in California or another US state with a consumer privacy law, you have the right to:
- Know what personal information we collect, use and disclose, and get a copy of it
- Delete your personal information
- Correct inaccurate personal information
- Opt out of the sale or sharing of your personal information (we don't sell or share it, but you're welcome to tell us)
- Non-discrimination: we will never treat you differently for using your rights
In the last 12 months we have collected these categories of personal information: identifiers (name, work email address and IP address); professional information (organisation and role); internet activity (website server logs, security data and, if you accept analytics cookies, how you use our site); and the content of messages and feedback you send us (including sector, organisation size and location). We collect them directly from you and from your browser when you visit our website. We use them only for the purposes in "Why do we use it?", disclose them only to the service providers listed above, and keep them as set out in "How long do we keep it?". We don't collect sensitive personal information.
To make a request, email getintouch@loyston.com. You can also ask an authorised agent to make a request for you. We'll need to verify your identity, and we'll respond within one month.
What about children?
Loyston is a service for businesses and professionals. It isn't aimed at children under 16, and we don't knowingly collect their information. If you think a child has given us information, let us know and we'll delete it.
Will this policy change?
We'll update this policy if what we do with personal information changes, for example if we start using a new analytics or security provider. Each version is dated, and if we make a significant change we'll make it clear here.
Version 1.2. Last updated 22 October 2026.
How can you contact us?
Questions, requests or feedback? We'd love to hear from you.
- Email: getintouch@loyston.com
- Post: Johnson Macadam Ltd, 18 Ray Park Avenue, Maidenhead, Berkshire SL6 8DS, UK
- Website: loyston.com