Klyx Ltd Privacy Notice

How we use personal data on our website and in Klyx

Last updated 13 September 2026

1 Who we are

Klyx Ltd is the company responsible for Klyx, a project management platform that provides workspaces, projects, tasks, comments, files, user administration, single sign-on and related subscription services. In this notice, Klyx Ltd is referred to as Klyx, we, us or our.

Company details Klyx Ltd, company number 17108223, registered office at 3rd Floor Waverley House, 7-12 Noel Street, London, United Kingdom, W1F 8GQ.

Privacy contact support@klyx.tech.

Website www.klyx.tech

This notice applies when you visit our website, contact us, create or use a Klyx account, buy or administer a subscription, use a personal workspace, or interact with our support and security teams. It should be read with the Klyx Terms and Conditions and our Cookie Notice.

2 Our role for personal data

Klyx is the controller of personal data used to operate our website and business, manage accounts and subscriptions, process billing records, provide support, secure the service, communicate with users and understand product performance.

A business or organisational customer is normally the controller of personal data placed in its workspace, including task content, project notes, comments, files and records about its staff, customers or suppliers. Klyx processes that workspace data on the customer’s instructions as its processor. The customer decides what data is entered, why it is used, who may access it and how long it is needed. Our Data Processing Agreement applies to that processing.

If you use Klyx personally rather than through an organisation, Klyx is normally the controller of the personal data in your personal workspace. If another organisation invited you to Klyx, direct questions about its use of workspace content to that organisation first.

3 Personal data we collect

Account and identity data

We collect names, business or personal email addresses, usernames, organisation and workspace details, job roles, user roles, permissions, authentication status and account preferences. If your organisation uses single sign-on, we may receive an identifier, name, email address, group or role information and authentication events from its identity provider.

Subscription and payment data

We collect plan, trial, renewal, billing contact, invoice, tax, payment status and transaction information. Stripe processes Direct Debit mandates, bank details and related payment authentication data. Klyx does not need full bank credentials or payment-card details in project fields and asks users not to place them there.

Workspace content

We process project names, tasks, due dates, assignees, comments, files, activity history and other content entered by users. Project notes may contain sensitive information, including special-category personal data, if a customer chooses to enter it. Klyx is not designed as a specialist health, clinical, human-resources, banking or payment-card records system.

Technical and usage data

We collect IP address, device and browser information, operating system, timestamps, pages and features used, session and authentication events, audit logs, diagnostic information, error reports and security signals. We may use cookies and similar technologies as explained in our Cookie Notice.

Communications and support data

We collect enquiries, support messages, call or meeting details if applicable, feedback, complaints, security reports and records of our response. Please do not send unnecessary sensitive information in a support request.

Sources of data

We receive data directly from you, from the customer or workspace administrator who invites you, from your organisation’s identity provider, from Stripe and other service providers, and automatically from your use of our website and service. We may also receive business contact information from a colleague or publicly available professional source where lawful.

4 How and why we use personal data

Provide Klyx and manage accounts We use account, workspace and technical data to create accounts, authenticate users, operate workspaces, provide requested features and support users. Our legal bases are performance of a contract and our legitimate interests in providing and administering the service.

Manage trials subscriptions and payments We use account, subscription, billing and transaction data to operate the 30-day trial, manage monthly and annual plans, process renewals and add-ons, issue invoices and handle failed payments or refunds. Our legal bases are performance of a contract, compliance with tax and accounting duties, and our legitimate interests in collecting amounts due.

Secure and maintain the service We use authentication events, role information, audit logs, device data, IP addresses and diagnostic information to prevent misuse, investigate incidents, maintain backups, test restoration and protect Klyx and its users. Our legal bases are legitimate interests and, where applicable, legal obligations.

Provide support and communicate We use contact, account and support data to respond to requests, send service notices, explain changes, resolve access issues and administer complaints. Our legal bases are performance of a contract and legitimate interests.

Improve Klyx We use usage statistics, diagnostics and feedback to understand performance and improve the service. Where practicable, we aggregate or anonymise information before analysis. Our legal basis is legitimate interests. We ask for consent before using non-essential analytics cookies where required.

Comply with law and protect rights We may use and disclose relevant records to meet legal, regulatory, tax, audit and law-enforcement requirements, establish or defend legal claims, and enforce our contracts. Our legal bases are legal obligation and legitimate interests.

Marketing We may send marketing where you have consented or where applicable electronic-marketing law permits it. You can unsubscribe through any marketing email or contact support@klyx.tech. Service and security messages are not marketing and may continue while you have an account.

We do not currently provide AI features and do not send Customer Content to an AI provider for an undefined AI feature. If this changes, we will update this notice and explain the provider, data, purpose, legal basis, controls and any model-training position before the feature is used.

5 Special category data

Project notes may contain information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetics, biometrics used for identification, sex life or sexual orientation. This information receives additional legal protection.

For an organisational workspace, the customer must identify an Article 6 lawful basis and an Article 9 condition before entering special-category data. The customer must limit collection, assign access carefully and meet any requirement for a data protection impact assessment or appropriate policy document. Klyx processes the information under the customer’s instructions and the Data Processing Agreement.

For a personal workspace where Klyx acts as controller, do not enter special-category data unless it is necessary and you have a lawful reason to do so. We may restrict or remove information that Klyx is not designed or legally permitted to process.

6 Sharing personal data

We share personal data only where needed for the purposes in this notice. Recipients may include:

Stripe and other payment, invoicing and fraud-prevention providers;
cloud hosting, storage, backup and content-delivery providers;
identity, single sign-on and authentication providers selected by Klyx or the customer;
email, customer-support and service-communication providers;
analytics, logging, error-monitoring and security providers, subject to cookie consent where required;
professional advisers, auditors and insurers;
regulators, courts, law-enforcement bodies and other parties where disclosure is legally required or necessary to protect rights; and
a buyer, investor or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection measures.

We require processors to protect personal data, keep it confidential and use it only under our instructions.

7 International transfers

Production Customer Content is hosted and backed up in the United Kingdom or European Economic Area. Some providers or support operations may process personal data elsewhere. A transfer outside the United Kingdom or European Economic Area will use an applicable adequacy decision or legally recognised safeguards, such as the UK International Data Transfer Agreement or UK Addendum and, for EEA data, the European Commission’s Standard Contractual Clauses. We carry out any required transfer assessment.

You can ask support@klyx.tech for more information about the safeguards relevant to your data.

8 Retention and deletion

We keep personal data only for as long as needed for the purposes described above, including legal, accounting, security and dispute-resolution requirements.

Active account and workspace data is kept while the subscription or account remains active.
After a subscription ends, the customer may export Customer Content for 90 days. We then delete it from active systems unless law or a dispute requires longer retention.
Billing, invoice and tax records are normally retained for the period required by applicable tax and company law.
Security logs, support records, consent records and website analytics are kept according to the periods stated or criteria based on security, operational and legal need.

We may retain anonymised information that can no longer identify an individual.

9 Cookies and online tracking

Our website and service may use strictly necessary cookies for authentication, security, preferences and core operation. We may also use analytics or other optional technologies. Where consent is required, optional cookies will remain off until you choose to allow them. You can change your choice through [COOKIE SETTINGS LINK].

Our Cookie Notice at [COOKIE NOTICE URL] identifies each cookie or technology, its provider, purpose and duration. Browser controls may also block cookies, although blocking necessary cookies can prevent Klyx from working correctly.

10 Security

We use appropriate technical and organisational measures designed to protect personal data. Confirmed controls include role-based permissions, multi-factor authentication, activity or audit logs, regular backups and restore testing. Customers must configure roles and authentication appropriately, protect credentials and promptly remove users who no longer require access.

No online service can guarantee absolute security. If you believe an account or personal data has been compromised, contact support@klyx.tech promptly.

11 Your rights

Depending on the law and circumstances, you may have rights to:

receive information about our processing and obtain a copy of your personal data;
correct inaccurate or incomplete personal data;
ask us to erase personal data or restrict its use;
object to processing based on legitimate interests;
receive personal data you provided in a structured, commonly used and machine-readable format and, where applicable, transmit it to another controller;
withdraw consent at any time, without affecting earlier lawful processing; and
complain to a data-protection supervisory authority.

To exercise a right, contact support@klyx.tech. We may need information to verify your identity and may ask you to direct a workspace-content request to the customer that controls that workspace. We normally respond within one month, subject to lawful extensions or exceptions.

You have the right to object at any time to direct marketing. Use the unsubscribe link in an email or contact support@klyx.tech.

In the United Kingdom, you can complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. If you live in the European Economic Area, you may also complain to the supervisory authority where you live or work, or where an alleged infringement occurred.

12 Automated decisions

Klyx does not currently make decisions about individuals based solely on automated processing that produce legal or similarly significant effects. We will update this notice before introducing such processing.

13 Children

Klyx is not directed to children and users must be at least 18 to create or purchase an account. We do not knowingly collect personal data directly from children. If you believe a child has provided data to us, contact support@klyx.tech.

14 Changes to this notice

We may update this notice when our service, providers or legal obligations change. We will post the current version on our website and change the date above. If a change materially affects how we use personal data, we will provide an additional notice where appropriate.

15 Contacting Klyx

Privacy enquiries and rights requests support@klyx.tech.

Security reports support@klyx.tech.

Postal address Klyx Ltd, 3rd Floor Waverley House, 7-12 Noel Street, London, United Kingdom, W1F 8GQ.