Kybrium

Privacy

Privacy notice

Last updated: 8 May 2026.

This notice explains how Cherya Holdings Limited collects and uses personal data when you visit https://kybrium.com or send us an enquiry. It is written to align with the UK General Data Protection Regulation and the Data Protection Act 2018.

Who we are

Kybrium is a trading name of Cherya Holdings Limited, a private company limited by shares, registered in England and Wales (company number 17203315). Registered office: 167-169 Great Portland Street, 5th Floor, London W1W 5PF. The data controller is Cherya Holdings Limited. You can contact us at contact@kybrium.com.

What we collect

Enquiry form. When you complete the contact form, we collect the information you provide (name, company, work email, project details, and any optional context fields you choose to fill).

Operational logs. Our hosting provider records short-lived server logs (IP address, user agent, request timestamp) for security and operations.

Analytics. We use Umami Cloud, a privacy-friendly, cookieless analytics service. Umami records aggregate page views without persistent identifiers, and we do not track you across sites.

What we do not collect

We do not use Google Analytics, advertising pixels, or session replay tools. We do not store marketing or advertising cookies, and we do not sell or share personal data with advertisers or data brokers.

How we use your data

  • To reply to your enquiry, scope work, and prepare a quote.
  • To stay in touch during an active or pending engagement.
  • To prevent abuse of the contact form (rate limiting and bot protection).
  • To understand, in aggregate, which pages help visitors find us.

Lawful basis

For enquiries: necessary to take steps you requested prior to a contract (UK GDPR Art 6(1)(b)), and our legitimate interests in operating our business (Art 6(1)(f)). For abuse prevention and analytics: legitimate interests in keeping the site available and understanding aggregate use.

Who processes your data on our behalf

  • Vercel — website hosting.
  • Resend — transmits enquiry emails to our inbox.
  • Cloudflare — bot protection (Turnstile) on the contact form.
  • Upstash — rate-limit records (short-lived).
  • Umami Cloud — aggregate analytics with no personal identifiers.

Some processors are based outside the UK. Where transfers occur, they are protected by adequacy decisions, the UK-US Data Bridge, Standard Contractual Clauses, or equivalent mechanisms.

Retention

  • Enquiry data: up to 24 months after our most recent contact with you, then deleted. If you become a client, retention is governed by your engagement agreement.
  • Operational logs: typically deleted within 30 days.
  • Rate-limit records: deleted within hours.

Your rights

Under UK GDPR you have the right to access your data, correct inaccuracies, ask for deletion, restrict or object to processing, request portability, and withdraw consent where consent is the lawful basis. To exercise any of these, email contact@kybrium.com.

You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Cookies

The site uses no marketing or analytics cookies. The contact form may set a short-lived security cookie when Cloudflare Turnstile is invoked. We do not display a cookie banner because we do not use non-essential cookies.

Changes to this notice

If we change this notice, we will update the date above. Material changes will be flagged at the top of this page for at least 30 days.