Privacy Policy

This privacy policy explains how NowYoYo Limited ("we", "us", "our"), trading as NowYoYo or Switching for Business, collects, uses, and protects your personal data when you use this website at switchingforbusiness.com. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations (PECR).

The data controller for this website is: NowYoYo Limited Email: sales@nowyoyo.com Website: nowyoyo.com

2.1 Registration Data When you register on this site, we collect: Email address (verified via one-time passcode) Preferred name Registration date, last login date, and login count

2.2 Onboarding Data (MAP Sign-up) If you choose to sign up as a MAP customer, we additionally collect: Full name (first and last) Job title Contact phone number Company name and Companies House registration number Company registered address (via OS Places lookup) Meeting booking details

2.3 Technical Data We use Cloudflare Web Analytics, which collects anonymous, aggregated data about page views and visits. No personal data or cookies are used for analytics. Session cookies are used to keep you logged in after email verification.

We process your data under the following lawful bases: Consent (Article 6(1)(a)): Newsletter subscription and cookie preferences. Contract (Article 6(1)(b)): Processing necessary to provide the services you have requested, including MAP onboarding and booking consultations. Legitimate Interest (Article 6(1)(f)): Operating and securing our website, preventing fraud, and improving our services.

To verify your email address and create your account To send you a one-time verification code To send you a welcome email upon registration To send periodic updates about Switching for Business (if opted in) To facilitate meeting bookings with our team To process MAP onboarding applications To send onboarding data to our sales team for follow-up

We use the following third-party services to deliver our service. Each is bound by data processing agreements: Cloudflare, Inc. — Website hosting, CDN, edge computing (Workers), and analytics. Data may be processed at Cloudflare edge locations. Cloudflare Privacy Policy Mailgun Technologies, Inc. (Sinch) — Email delivery for verification codes, welcome emails, and newsletters. We use the EU region (api.eu.mailgun.net). Mailgun Privacy Policy Microsoft Corporation — Meeting bookings via Microsoft Graph API (Microsoft Bookings). Microsoft Privacy Statement Companies House — Company registration data lookup (publicly available data). Companies House Personal Information Charter Ordnance Survey — Address lookup via OS Places API. OS Privacy Policy

User accounts: Retained for as long as your account is active. You may request deletion at any time. OTP codes: Automatically deleted after 5 minutes. Session data: Expires after 30 days of inactivity. Onboarding data: Retained for the duration of the business relationship and as required by law. Admin sessions: Expire after 4 hours.

7.1 Essential Session cookie: Used to keep you logged in after email verification. This is strictly necessary for the site to function. Cookie consent preference: Stored in your browser's localStorage to remember your cookie choice. 7.2 Analytics (Optional) Cloudflare Web Analytics: If you accept analytics cookies, Cloudflare's privacy-friendly analytics script is loaded. This does not use cookies or collect personal data.

Under the UK GDPR, you have the following rights: Right of access: Request a copy of your personal data. Right to rectification: Request correction of inaccurate data. Right to erasure: Request deletion of your data ("right to be forgotten"). Right to restrict processing: Request limitation of how we use your data. Right to data portability: Request your data in a machine-readable format. Right to object: Object to processing based on legitimate interests. Right to withdraw consent: Withdraw your consent at any time (e.g., newsletter). To exercise any of these rights, please contact us at sales@nowyoyo.com.

Some of our third-party processors (Cloudflare, Microsoft, Mailgun) may process data outside the UK. Where this occurs, appropriate safeguards are in place, including Standard Contractual Clauses and adequacy decisions as applicable.

We implement appropriate technical and organisational measures to protect your personal data, including: Encryption in transit (HTTPS/TLS) Secure session management Bot protection (Cloudflare Turnstile) Rate limiting on authentication endpoints Cryptographically random verification codes

This website is not intended for use by individuals under the age of 18. We do not knowingly collect data from children.

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date.

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint Telephone: 0303 123 1113

For any questions about this privacy policy or your personal data, contact us at: NowYoYo Limited Email: sales@nowyoyo.com LinkedIn: NowYoYo on LinkedIn