ELLAYA PRIVACY POLICY

Effective Date : 11th June 2025

*Last Updated : 11th June 2025

Welcome to Ellaya www.ellaya.co.uk We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect your information when you use our platform

This policy applies to all users of Ellaya, including Buyers, Sellers, and visitors.

1.Data Controller

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller responsible for your personal data is:

Ellaya Limited
Suite 201 Quantrill House
2 Dunstable Road
Luton, LU1 1DX
United Kingdom
📧 Email: info@ellaya.co.uk
đź“ž Tel: +44 20 7100 5454

As the data controller, we determine the purposes and means by which your personal data is collected, used, stored, and shared when you use the Ellaya platform.

We are registered in the United Kingdom and operate a digital platform that enables users to manage personal and business tasks, interact socially, and engage in e-commerce and service-based transactions.

If you have any questions or concerns about how we handle your personal information, or if you wish to exercise your data protection rights, you can contact us using the details above.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at www.ico.org.uk.

2. Information We Collect

Depending on how you use Ellaya, we collect and process various types of personal data to operate the platform, provide services, and comply with legal obligations. This includes data you actively provide, data we collect automatically, and data received from third parties (where lawful).

We may collect the following categories of personal information:

A. Identity and Contact Data

Collected when you create or update your account, register for a service, or contact support.

B. Account, Security & Authentication Data

Used to manage access and protect your account.

C. Transaction and Payment Data

Collected when you make or receive payments, book a ride, or conduct business.

D. Communications and Messaging Data

Generated through your interactions on the platform.

E. Scheduling and Smart Assistant Data

Collected and used by Ellaya’s intelligent scheduling tools.

F. Personal Vault and Databank Content

Voluntarily uploaded or stored by you.

Ellaya does not access vault content unless explicitly authorised by the user for troubleshooting or legal compliance.

G. Technical, Device and Usage Data

Collected automatically when you access the platform.

H. Cookies and Tracking Technologies

Collected as part of analytics, personalisation, and platform optimisation.

See our Cookies Policy for full details and management tools.

I. Marketing and Engagement Data

Collected when you sign up for newsletters, campaigns, or promotions.

J. Third-Party Integration Data

Collected when you link external services or platforms.

We only access the data necessary to provide the feature you enable, and you can revoke access at any time.

K. Sensitive or Special Category Data (only with consent)

We do not intentionally collect sensitive data, but it may be submitted voluntarily in vault files, messages, or calendar notes. Examples may include:

We process such data only with your explicit consent and under strict security controls. Please avoid uploading unnecessary sensitive content.

3. How We Use Your Information

We collect and use your personal data to provide you with a secure, functional, and personalised experience on the Ellaya platform. The way we use your data depends on your role (e.g. Buyer, Seller, user of scheduling, storage, ride, or messaging features), and is always based on a lawful basis under the UK GDPR.

We may use your information for the following purposes:

A. To Provide, Operate, and Manage the Platform

Lawful basis: Contractual necessity; Legitimate interests

B. To Personalise and Improve User Experience

Lawful basis: Legitimate interests; Consent (for non-essential personalisation)

C. To Facilitate Communication and Social Interaction

Lawful basis: Contractual necessity; Legitimate interests

D. To Provide Customer Support and Dispute Resolution

Lawful basis: Contractual necessity; Legitimate interests; Legal obligation

E. To Market Our Services and Engage With You

Lawful basis: Consent; Legitimate interests (for service notices)

You can opt out of marketing at any time by adjusting your preferences or clicking “unsubscribe” in any message.

F. To Analyse, Audit, and Maintain Platform Security

Lawful basis: Legitimate interests; Legal obligation

G. To Store, Index, and Secure Vault and Scheduling Data

Lawful basis: Contractual necessity; Consent (where you upload sensitive content)

H. To Comply With Legal, Regulatory, and Tax Obligations

Lawful basis: Legal obligation; Legitimate interests

4. Legal Bases for Processing

Under the UK General Data Protection Regulation (UK GDPR), we must have a lawful basis for collecting and using your personal data. The legal basis we rely on depends on the specific purpose for which we process your data. These include:

A. Contractual Necessity

We process your personal data where it is necessary to enter into or perform our contract with you. This applies when:

đź“Ś If you do not provide data required for these purposes, we may not be able to provide our services to you.

B. Legal Obligation

We may process your data where we are required to comply with a legal or regulatory obligation. This includes:

C. Legitimate Interests

We may process your data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This applies when we:

đź“Ś We always balance our interests against your privacy rights and give you control where appropriate.

D. Consent

We rely on your freely given, informed consent when:

đź“Ś You can withdraw your consent at any time using your account settings or by contacting us at info@ellaya.co.uk. Withdrawing consent does not affect processing already carried out.

E. Vital Interests (rare and limited)

In exceptional cases, we may process personal data to protect someone’s life or physical safety — for example, in the event of an emergency during a ride booking. This is only used where no other lawful basis applies.

5. Sharing Your Information

We treat your personal data with care and confidentiality. We do not sell your information. However, in the course of providing and supporting the Ellaya platform, we may need to share your data with trusted third parties. We only share what is necessary, and always under a lawful basis and with appropriate safeguards.

Your data may be shared with the following categories of recipients:

A. Other Users (Platform Functionality)

Depending on your activity and privacy settings:

We encourage all users to respect each other's privacy and use platform communication features responsibly.

B. Our Service Providers and Data Processors

We use carefully vetted third-party providers to support core services. These include:

All providers are contractually bound to process your data only on our instructions and in accordance with data protection law (Article 28 UK GDPR).

C. Ride-Booking and Integration Partners

If you use RideHub or any third-party integration:

We do not share personal vault or calendar data with third parties unless explicitly authorised by you.

D. Regulators, Authorities, and Legal Requests

We may disclose your data if required to:

We will assess the legitimacy of any such request and limit disclosure to what is legally required.

E. Business Transfers

In the event of a merger, acquisition, sale of assets, restructuring, or insolvency:

F. With Your Consent

We may share your data with third parties where you have explicitly authorised it — for example:

You can withdraw your consent at any time by contacting us.

6. International Transfers

Some of our service providers and technology partners are located, or process personal data, outside the United Kingdom. This means that your personal data may occasionally be transferred to, stored in, or accessed from countries that do not provide the same level of legal protection for personal data as the UK.

We take all necessary steps to ensure that such transfers comply with the UK General Data Protection Regulation (UK GDPR) and that your data remains protected.

A. Countries Outside the UK

We may transfer your personal data to countries outside the UK, including but not limited to:

B. Safeguards We Use

Whenever we transfer your data internationally, we ensure that an equivalent level of data protection is in place by using one or more of the following safeguards:

â—Ź Adequacy Decisions

We may transfer data to countries that the UK government has recognised as providing an adequate level of protection (e.g. EEA countries, Japan, Switzerland).

â—Ź International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses (SCCs)

For transfers to countries without an adequacy decision (such as the U.S.), we use:

These legally binding agreements impose contractual obligations on the recipient to protect your data in line with UK standards.

â—Ź Supplementary Measures (where required)

Where necessary, we apply additional technical, contractual, or organisational safeguards (such as encryption at rest, access restrictions, or pseudonymisation) in line with the guidance of the UK Information Commissioner’s Office (ICO).

C. Exceptions (Derogations under Article 49 UK GDPR)

In limited situations, we may rely on specific exceptions (derogations) to transfer data internationally, for example:

These exceptions are used only where strictly necessary and no other safeguard applies.

D. Your Rights and Controls

You have the right to request more information about international transfers of your personal data, including copies of relevant safeguards. To make such a request, contact us at privacy@ellaya.co.uk.

7. How We Protect Your Information

We take the security of your personal data seriously and implement a range of technical and organisational measures to protect it against unauthorised access, accidental loss, misuse, alteration, or disclosure.

Our approach is based on the confidentiality, integrity, and availability of your data, in line with our obligations under UK GDPR Article 32.

A. Technical Security Measures

We use appropriate technical safeguards to secure your data, including:

B. Organisational and Administrative Controls

We also enforce strong internal policies to maintain your privacy, such as:

C. Platform-Specific Protections

Because Ellaya includes features such as messaging, scheduling, personal vaults, and e-commerce:

D. Security Incident Response

We maintain a formal incident response protocol. In the event of a data breach that poses a risk to your rights or freedoms:

E. Your Role in Keeping Data Secure

You also play a role in safeguarding your data. We encourage you to:

8. Your Rights

As a user of Ellaya, you have rights under the UK General Data Protection Regulation (UK GDPR) in relation to your personal data. These rights empower you to understand, control, and, where appropriate, limit how we use your information.

You can exercise these rights at any time by contacting us at privacy@ellaya.co.uk. We will respond to all valid requests within one month, unless the request is particularly complex, in which case we may extend the deadline by up to two additional months (we will inform you if this happens).

A. Right to Access (Article 15)

You have the right to request:

B. Right to Rectification (Article 16)

If your data is inaccurate or incomplete, you can request that we:

We may need to verify the accuracy of the new data you provide.

C. Right to Erasure (Right to Be Forgotten) (Article 17)

You may request that we delete your personal data where:

đź“Ś Note: This right may not apply if we are required to retain the data for legal, contractual, or regulatory purposes (e.g. tax records, dispute defence).

D. Right to Restrict Processing (Article 18)

You can ask us to temporarily restrict the processing of your personal data if:

E. Right to Data Portability (Article 20)

You have the right to receive a copy of the personal data you provided to us in a structured, commonly used, and machine-readable format, and to ask us to transfer it directly to another controller (where technically feasible).

This applies only to data processed by automated means and on the basis of consent or contract.

F. Right to Object (Article 21)

You can object to the processing of your personal data where we rely on:

We will stop processing your data unless we have compelling legitimate grounds that override your interests or if we need it for legal claims.

G. Right to Withdraw Consent (Article 7)

Where we rely on your consent to process personal data (e.g. for email marketing, optional cookies, or third-party integrations), you have the right to withdraw that consent at any time.

Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.

H. Right to Lodge a Complaint (Article 77)

If you are concerned about how we handle your data, you have the right to lodge a complaint with the UK’s data protection authority:

Information Commissioner’s Office (ICO)
www.ico.org.uk
Phone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We encourage you to contact us first so we can resolve your concerns directly.

9. Cookies & Tracking

We use cookies to improve your experience, personalise content, and analyse traffic. You can manage your cookie preferences via our Cookie Banner or your browser settings.

For full details, see our Cookies Policy.

10. Data Retention

We only retain your personal data for as long as is necessary to fulfil the purposes for which we collected it — including to provide our services, comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements.

Once data is no longer required for those purposes, we securely delete or anonymise it.

A. General Retention Periods

We apply the following standard retention periods:

Data Category Retention Period
Account data (including profile info) Retained while your account is active, and for up to 6 years after closure (for legal and tax reasons)
Order and transaction history 6 years from transaction date (for HMRC/tax compliance)
Messaging and conferencing data Up to 12 months unless subject to abuse reporting or dispute
Personal vault data Retained until you delete it or close your account
Calendar and scheduling data Retained for as long as you use scheduling services
Customer support messages 3 years from resolution date
Email marketing preferences and consent logs Up to 6 years (for audit and accountability)
Analytics and behavioural data Anonymised after 12–24 months, where not required for service operations

đź“Ś If you delete your account, we will securely delete or anonymise your personal data within a reasonable period, unless we are legally required to retain it.

B. Legal and Regulatory Obligations

We may retain certain information longer where necessary to:

C. Data Minimisation and Anonymisation

Where appropriate, we:

D. Your Right to Request Deletion

You may request that we delete your personal data at any time (see Section 8 – Your Rights). We will honour your request where:

Certain deletions may be deferred where legal or contractual obligations require continued retention.

11. Third-Party Links

Our platform may contain links to external websites. We are not responsible for the privacy practices of third-party sites. Please read their policies separately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a new “Last Updated” date. Continued use of the platform signifies your acceptance of the updated policy.