Privacy Policy

This notice explains what I do with personal information when you visit this website, get in touch, or become a client.

Who I am

This site is run by Andreas Chrysostomou, trading as Chrysós Systems, a sole trader based at 10 Thornapple View, Bury St Edmunds, IP28 8WF.

I am the data controller for the information described in this notice, which means I decide how and why it is used.

Email: [email protected]

Phone: +44 7972 348 772

Registered with the Information Commissioner’s Office, registration number ZC235413.

What this notice covers, and what it does not

This notice covers information about you: visitors to this site, people who enquire, and my own clients.

It does not cover the personal data inside systems I build and run for my clients. Where I host a client’s website, CRM or booking system, that data belongs to them and they decide what happens to it. In that situation they are the data controller and I am their data processor, working under a written data processing agreement. If you are a customer of one of my clients, their privacy notice is the one that applies to you.

What I collect and why

If you use the contact form or email me

I collect your name, email address, phone number if you give it, and whatever you write in your message. I use it to reply to you, to answer your question, and to prepare a quote if you want one. My lawful basis is legitimate interests, specifically responding to somebody who has asked me to, and where we go on to discuss working together, taking steps at your request before entering a contract.

If you book a call

I collect your name, email address and the time you have chosen, so I can hold the appointment and send you a confirmation and a reminder. My lawful basis is taking steps at your request before entering a contract.

If you become a client

I collect your business and contact details, the information I need to build and run what you have asked for, and billing information. I use it to deliver the work, to support it, and to invoice you. My lawful basis is performance of our contract. I also keep invoices and related records to meet my tax and accounting obligations, where my lawful basis is legal obligation.

If you sign up for emails

If I ever offer a mailing list, I will collect your name and email address on the basis of your consent, recorded at the point you give it. Every email will have an unsubscribe link, and unsubscribing takes effect immediately.

Website and security logs

My hosting provider records technical information such as IP addresses and browser type, to keep the site running and to protect it against abuse. My lawful basis is legitimate interests, specifically the security of the site.

Where I get your information from

Almost always from you directly, when you fill in a form, book a call, or email me. Occasionally somebody refers you and passes on your name and email so that I can get in touch. If that happens and you would rather I did not hold your details, tell me and I will delete them.

Do you have to give me this information?

No. There is no legal requirement to give me anything. If you want a quote or want me to do work for you, I need enough to reply to you and to write a contract, and without it I will not be able to help. Nothing more than that.

Automated decisions

I do not make decisions about you by automated means, and I do not profile you. Everything is decided by a person, and that person is me.

Cookies

This site uses only the cookies it needs to work: keeping the site secure, remembering your progress through a form, and making booking work. These do not need your consent because the site cannot function without them.

I do not currently use analytics or advertising cookies. If that changes, I will update this notice and ask for your consent before any such cookie is set. You can also block or delete cookies in your browser settings, though parts of the site may then stop working properly.

Who else sees your information

I use a small number of suppliers to run my business. They only process your information on my instructions, under a written contract.

- GoHighLevel. Website hosting, forms, booking and CRM. Based in the United States.

- Google Workspace. Email and file storage.

- Namecheap. Domain registration.

- Stripe and GoCardless. Payment processing, if you pay me by card or Direct Debit. They handle your payment details directly and I never see your full card number.

- My accountant. Invoices and financial records.

I will also share information where I am legally required to, or where I need to in order to establish, exercise or defend a legal claim, including notifying my insurers.

I do not sell your information, and I never share it for anybody else’s marketing.

Where your information is held

Some of my suppliers are based outside the United Kingdom, mainly in the United States. Where that happens, the transfer is covered by the safeguards required under UK data protection law, which in practice means standard contractual clauses with the UK addendum, or the provider’s certification under the UK extension to the EU-US Data Privacy Framework. You can ask me for details of the safeguards in place for any specific supplier.

Artificial intelligence

I use AI tools in my own work, for example to help draft copy, write code and prepare documents. Where I do, the tools are configured so that what I put into them is not used to train the providers’ models.

I do not put my clients’ customer data into AI tools. Where a client asks me to build something that uses AI, it runs on developer access under a data processing agreement, in accounts belonging to that client, and it is set out in writing before anything is built.

How long I keep it

- Enquiries that do not lead to work: up to twelve months, then deleted.

- Client records and correspondence: for the length of our work together and six years afterwards, which matches the limitation period for a contract claim.

- Invoices and accounting records: six years after the end of the tax year they relate to, as HMRC requires.

- Mailing list: until you unsubscribe, and then a suppression record so I do not email you again by mistake.

Your rights

Under UK data protection law you have the right to:

- ask for a copy of the personal information I hold about you

- ask me to correct anything that is wrong

- ask me to delete it, where there is no good reason for me to keep it

- ask me to restrict how I use it while a concern is being sorted out

- object to me using it where my basis is legitimate interests

- ask me to transfer it to you or somebody else in a machine-readable format, where it was provided by you and is processed by automated means

- withdraw your consent at any time, where consent is the basis I am relying on

Email me at [email protected] and I will respond within one month. There is no charge. I may need to confirm who you are before I act, which is a protection for you rather than an obstacle.

Complaints

If you are unhappy with how I have handled your information, please tell me first and I will try to put it right. You also have the right to complain to the Information Commissioner’s Office at any time.

ico.org.uk  ·  0303 123 1113

Changes to this notice

I will update this page when what I do changes. If the change is significant I will say so at the top. This version was published on 29th August 2026.