top of page

PRIVACY POLICY

LYNSORA LTD
Last updated: 23 October 2026

​

1. Who We Are

​

LYNSORA LTD is a company incorporated in England and Wales providing non-regulated documentation and governance support to crypto-asset service providers (CASPs), payment institutions, FinTech businesses and other regulated or regulated-adjacent organisations operating across the United Kingdom, the European Economic Area (EEA), Switzerland and Canada.

Our services include documentation architecture, documentary consistency review, governance documentation support, evidence mapping and related written outputs.

​

LYNSORA LTD does not provide legal advice, regulated compliance consultancy, regulatory representation, licensing or authorisation services, audit or assurance, investment advice or outsourced regulated functions.

​

For the purposes of applicable data protection law:

​

Data Controller
LYNSORA LTD
Company No: 16816940
Registered Office: 128 City Road, London, EC1V 2NX, United Kingdom
Email: contact@lynsora.com
UK ICO Registration: ZC118488

​

Unless otherwise stated in a client agreement or data processing agreement, LYNSORA LTD acts as an independent controller of personal data processed for its own business activities.

2. Scope of This Privacy Policy

​

This Privacy Policy explains how LYNSORA LTD collects, uses, stores, discloses and protects personal data or personal information in connection with:

​

  • use of our website;

  • enquiries and contact forms;

  • prospective client communications;

  • business development activities;

  • proposals and engagement discussions;

  • client onboarding and engagement administration;

  • delivery and management of our documentation and governance support services;

  • invoicing, accounting and business administration; and

  • other legitimate business operations.

 

In this Policy, “personal data” includes “personal information” where that term is used under applicable Canadian privacy law.

​

3. Applicable Data Protection Frameworks

​

Depending on the circumstances of the processing and the location of the relevant individual, our processing may be subject to one or more of the following:

​

  • the UK General Data Protection Regulation (UK GDPR);

  • the Data Protection Act 2018;

  • the Data (Use and Access) Act 2025 and amendments made by it to UK data protection law;

  • Regulation (EU) 2016/679 (EU GDPR), where applicable;

  • the Swiss Federal Act on Data Protection (FADP), where applicable;

  • the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), where applicable; and

  • applicable Canadian provincial private-sector privacy legislation, including legislation in Alberta, British Columbia and Québec, where applicable.

 

The application of a particular privacy regime depends on the relevant processing activity and circumstances. Nothing in this Policy should be interpreted as stating that every listed regime applies to every processing activity carried out by LYNSORA LTD.

​

We aim to apply consistent principles of transparency, purpose limitation, data minimisation, accuracy, security and appropriate retention across our processing activities.

​

4. Our Role as Controller or Processor

​

When LYNSORA LTD acts as Controller

We normally act as a controller when processing personal data for our own purposes, including:

​

  • operating and securing our website;

  • receiving and responding to enquiries;

  • managing prospective client relationships;

  • conducting targeted B2B business development;

  • preparing proposals and engagement documentation;

  • administering client relationships;

  • managing contracts, invoicing and payments;

  • maintaining business and project records;

  • complying with legal and corporate obligations; and

  • protecting our legal and commercial interests.

 

When LYNSORA LTD acts as Processor

In limited circumstances, an agreed client engagement may require LYNSORA LTD to process personal data strictly on behalf of, and on documented instructions from, a client.

​

Where LYNSORA LTD acts as a processor, appropriate data processing terms will be agreed before such processing begins, where required by applicable law.

​

Our standard working model is based on data minimisation. Clients are requested to anonymise or redact personal data contained in documents or evidence wherever reasonably practicable before providing those materials to us.

 

5. Personal Data We May Collect

Depending on your interaction with us, we may process the following categories of personal data.

​

Professional and identification information

This may include:

  • name and surname;

  • job title or professional role;

  • employer or organisation;

  • business function;

  • professional profile information; and

  • details of an authorised representative or signatory.

 

Business contact information

This may include:

  • business email address;

  • business telephone number;

  • company name;

  • company website; and

  • other professional contact information.

  • ​

Enquiry and communication information

This may include:

  • information submitted through our website or online enquiry forms;

  • emails and other written correspondence;

  • project enquiries;

  • instructions and clarifications;

  • feedback and approvals; and

  • other information you choose to provide to us.

 

Engagement and administrative information

This may include:

  • proposal and engagement information;

  • contractual records;

  • project references;

  • invoicing and payment information;

  • transaction references;

  • records relating to contract administration; and

  • information reasonably required to establish or manage a business relationship.

 

Information contained in client materials

Documents provided to us for an agreed engagement may contain limited personal data relating to employees, officers, contractors, customers or other individuals.

Clients are expected to remove, anonymise or redact personal data where it is not reasonably necessary for the agreed scope.

 

Website and technical information

Depending on your cookie preferences and use of the website, this may include:

  • IP address;

  • browser and device information;

  • security and technical logs;

  • website interaction information;

  • cookie identifiers; and

  • similar technical information.

More information is available in our Cookie Policy.

 

Special category or sensitive personal data

LYNSORA LTD does not seek or intentionally request special category, sensitive or highly sensitive personal data as part of its standard service model.

Such information should not be provided unless it is genuinely necessary for an agreed engagement and appropriate safeguards have been considered in advance.

​

6. How We Obtain Personal Data

We may receive personal data:

​

Directly from you

For example, when you:

  • contact us by email;

  • complete an enquiry form;

  • request information about our services;

  • communicate with us regarding a potential engagement;

  • enter into an agreement with us; or

  • provide information during an existing engagement.

 

From your organisation

Where you act for or work with a client or prospective client, your organisation or another authorised representative may provide your professional contact information to us.

​

Through our online forms

We currently use Tally BV to provide certain online enquiry forms.

Where you submit a Lynsora form through Tally, LYNSORA LTD acts as controller of the information collected through that form for Lynsora's purposes, while Tally acts as a service provider and processor in relation to the form-response data it processes on our behalf.

​

From publicly available professional and business sources

For legitimate B2B business development, client identification and business research, we may obtain limited professional contact information from publicly available sources such as:

​

  • official company websites;

  • public corporate registers;

  • public regulatory registers;

  • professional networking platforms;

  • publicly available professional profiles; and

  • other legitimate business information sources.

 

Where information has not been obtained directly from the individual, we use it only for purposes reasonably connected with the individual's professional role and subject to applicable privacy and electronic marketing requirements.

​

From service providers or professional contacts

We may also receive limited information through professional introductions, referrals or service providers where this is lawful and appropriate.

​

7. Purposes for Which We Process Personal Data

​

We may process personal data for the following purposes:

​

  • responding to enquiries;

  • assessing whether a proposed engagement falls within our service model;

  • preparing proposals and engagement documentation;

  • establishing and administering client relationships;

  • delivering agreed documentation and governance support services;

  • obtaining instructions, clarifications, feedback and approvals;

  • maintaining appropriate project and engagement records;

  • managing invoices, payments, accounting and taxation;

  • maintaining corporate and administrative records;

  • operating and securing our website and systems;

  • detecting or preventing fraud, misuse, security threats or unlawful activity;

  • managing disputes, complaints or legal claims;

  • protecting our contractual and commercial interests;

  • maintaining business continuity and internal records;

  • sending relevant B2B communications where permitted by applicable law; and

  • complying with applicable legal obligations.

 

We do not sell personal data.

​

8. Legal Bases for Processing

​

United Kingdom and EEA

Where the UK GDPR or EU GDPR applies, we may rely on one or more of the following legal bases.

​

Contract or pre-contractual steps

Where processing is necessary to enter into or perform a contract with an individual, or to take steps at that individual's request before entering into a contract.

​

Where an individual acts as a representative of a corporate client rather than being personally party to the contract, we may instead rely on legitimate interests.

​

Legal obligation

Where processing is necessary to comply with applicable legal obligations, including relevant corporate, tax, accounting, record-keeping or other statutory requirements.

​

Legitimate interests

Where processing is necessary for legitimate business interests and those interests are not overridden by the rights and freedoms of the individual.

These interests may include:

​

  • managing B2B client and prospective client relationships;

  • responding to business enquiries;

  • operating and improving our business;

  • maintaining appropriate engagement and evidential records;

  • protecting our systems and information;

  • preventing fraud or misuse;

  • establishing, exercising or defending legal claims; and

  • conducting proportionate and targeted B2B business development where permitted by applicable law.

 

Consent

Where consent is required, including for certain non-essential cookies or communications.

Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

​

Switzerland

​

Where the Swiss FADP applies, we process personal data in accordance with applicable requirements including the principles of lawfulness, good faith, proportionality, transparency, purpose limitation, accuracy and security.

​

Where consent, an overriding private or public interest, contractual necessity, legal requirement or another justification is required under Swiss law, we rely on the appropriate basis having regard to the circumstances.

​

Canada

​

Where Canadian private-sector privacy law applies, we collect, use and disclose personal information only for appropriate and identified purposes and obtain consent where required.

​

Where permitted by applicable law, processing may also take place without consent or on another legally recognised basis or exception.

The precise requirements may vary depending on whether PIPEDA or applicable provincial legislation applies.

​

9. Business Development and Marketing Communications

LYNSORA LTD conducts limited and targeted B2B business development.

​

We may use professional contact information obtained directly from an individual, from their organisation or from legitimate publicly available professional sources where the communication is relevant to the individual's business role and is permitted by applicable law.

​

Our approach depends on the jurisdiction concerned.

​

Where applicable electronic marketing law requires consent, implied consent, an existing relationship or another recognised basis for sending a commercial electronic message, we will seek to operate within those requirements.

​

Marketing and business development messages will identify LYNSORA LTD and provide an appropriate method to opt out of future communications.

​

If you ask us not to contact you for marketing or business development purposes, we may retain limited information on a suppression record so that your preference can continue to be respected.

​

10. Service Providers and Other Recipients

​

We may disclose personal data to third parties where reasonably necessary for the purposes described in this Policy.

These may include:

​

  • website hosting and infrastructure providers;

  • online form providers;

  • email and communications providers;

  • cloud storage and technology providers;

  • accounting and administrative service providers;

  • banking or payment service providers;

  • professional advisers;

  • insurers;

  • contractors supporting our business under appropriate confidentiality obligations; and

  • courts, regulators, law enforcement bodies or other competent authorities where disclosure is legally required or otherwise lawful.

 

Our current principal website platform is provided by Wix.com, and certain online forms are provided by Tally BV.

Service providers may process information only to the extent necessary to provide their services and subject to applicable contractual, confidentiality and data protection requirements.

We do not disclose personal data to third parties for the purpose of allowing them to sell their own products or services to you.

​

11. International Data Transfers

​

LYNSORA LTD is established in the United Kingdom and works with organisations and technology providers operating internationally.

​

As a result, personal data may in some circumstances be processed or accessed outside the country in which it was originally collected.

​

Where applicable data protection law restricts international transfers, we use an appropriate lawful transfer mechanism.

​

Depending on the relevant jurisdiction, this may include:

​

  • an applicable adequacy decision or adequacy regulation;

  • European Commission Standard Contractual Clauses;

  • the UK International Data Transfer Agreement or UK Addendum;

  • contractual safeguards recognised under Swiss data protection law; or

  • another transfer mechanism permitted by applicable law.

 

Where appropriate, supplementary technical, contractual or organisational safeguards may also be used.

​

Our website provider, Wix, operates internationally and may process information through infrastructure or service providers located in different jurisdictions.

​

Tally is established in Belgium and states that form-response data is stored in Europe, although certain supporting subprocessors may operate in other jurisdictions.

​

Where Canadian privacy law applies, personal information may also be processed by service providers outside Canada and may therefore be subject to the laws of the jurisdiction in which those service providers operate.

​

12. Data Minimisation

​

We aim to collect only the personal data reasonably necessary for the relevant purpose.

In particular:

​

  • clients should avoid providing unnecessary personal data in project materials;

  • documents should be anonymised or redacted where reasonably practicable;

  • customer, employee or transaction-level personal data should not be provided merely for illustrative purposes if anonymised evidence is sufficient; and

  • sensitive information should not be provided unless specifically necessary and agreed.

 

We may request that unnecessary personal information be removed or replaced before project materials are used.

​

13. Data Retention

​

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to meet contractual, legal, accounting, evidential and legitimate business requirements.

​

Retention periods depend on the nature of the information and the reason for processing it.

​

As a general approach:

​

  • enquiry and prospective client information is retained only for a reasonable period following the last substantive interaction, unless an ongoing business relationship, legitimate business reason or legal requirement justifies longer retention;

  • engagement and contractual records may normally be retained for up to six years following the end of the relevant engagement where appropriate for contractual, evidential or legal-claims purposes;

  • accounting and tax records are retained for the period required by applicable law, normally at least six years where relevant;

  • marketing and business development contact information is retained only while there is a lawful and legitimate reason to retain it;

  • suppression information may be retained for as long as reasonably necessary to ensure that an opt-out request continues to be respected; and

  • website and technical information is retained in accordance with the relevant operational, security and cookie settings and the practices of the relevant technology providers.

 

Information may be retained for a longer period where reasonably necessary for actual or anticipated legal proceedings, regulatory requirements, fraud prevention or another lawful purpose.

​

When personal data is no longer required, it is deleted, anonymised or otherwise securely disposed of as appropriate.

​

14. Data Security

​

We use appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, alteration or disclosure.

​

Depending on the nature of the information and processing, these measures may include:

​

  • access controls;

  • account and authentication controls;

  • data minimisation;

  • confidentiality requirements;

  • appropriate security features made available by technology providers;

  • controlled access to project and administrative information;

  • secure transmission methods where appropriate;

  • incident-management procedures; and

  • appropriate contractual requirements for service providers.

 

No electronic system or transmission method can be guaranteed to be completely secure. We therefore apply measures proportionate to the nature and sensitivity of the information processed.

​

15. Personal Data Breaches

​

If we become aware of a personal data breach, we will assess the circumstances and potential impact.

Where required by applicable law, we will:

  • notify the relevant supervisory or privacy authority;

  • notify affected individuals; and

  • take appropriate steps to contain, investigate and mitigate the incident.

We maintain internal procedures intended to support timely assessment and response.

​

16. Your Privacy Rights

​

Your rights depend on the privacy law applicable to the relevant processing.

​

Depending on the circumstances, you may have the right to:

​

  • request access to personal data held about you;

  • request correction of inaccurate or incomplete information;

  • request deletion of personal data where applicable;

  • request restriction of processing where applicable;

  • object to certain processing;

  • request portability of certain personal data where applicable;

  • withdraw consent where processing is based on consent;

  • object to or opt out of direct marketing;

  • obtain information about how your personal data is used and disclosed; and

  • lodge a complaint with an applicable privacy or supervisory authority.

 

We do not currently use personal data to make solely automated decisions that produce legal effects or similarly significant effects on individuals.

To exercise a privacy right, contact:

contact@lynsora.com

 

We may need to request sufficient information to verify your identity and identify the information concerned before acting on a request.

We will respond within the timeframe required by the law applicable to the request.

​

17. Complaints and Supervisory Authorities

​

If you have a concern about how LYNSORA LTD processes your personal data, you are encouraged to contact us first at:

contact@lynsora.com

​

We will review privacy complaints and respond in accordance with applicable requirements.

​

Depending on where you are located and which law applies, you may also have the right to complain to an appropriate supervisory authority, including:

​

  • the UK Information Commissioner's Office (ICO);

  • an EU or EEA data protection supervisory authority;

  • the Swiss Federal Data Protection and Information Commissioner (FDPIC);

  • the Office of the Privacy Commissioner of Canada (OPC); or

  • an applicable Canadian provincial privacy commissioner.

 

Your right to complain to a competent authority is not affected by contacting us first.

​

18. Cookies and Similar Technologies

​

Our website uses cookies and similar technologies.

​

Strictly necessary technologies may be used where required for operation, security or functionality of the website.

​

Where required by applicable law, non-essential cookies or similar technologies are activated only after the relevant consent has been obtained through our cookie consent or preference mechanism.

​

Further information about the categories of cookies we use, their purposes and how preferences can be managed is available in our Cookie Policy.

​

19. Third-Party Websites

​

Our website may contain links to third-party websites or services.

​

LYNSORA LTD is not responsible for the privacy practices of third parties operating independently from us. We recommend reviewing the privacy information provided by the relevant third party before providing personal information to them.

​

20. Children

​

Our website and services are intended for business and professional use.

​

LYNSORA LTD does not knowingly seek to collect personal data from children.

​

If we become aware that personal data relating to a child has been provided to us where it is not reasonably necessary or appropriate, we will take reasonable steps to remove it.

​

21. Changes to This Privacy Policy

​

We may update this Privacy Policy from time to time to reflect changes in:

​

  • our services or business operations;

  • technology providers;

  • data processing activities;

  • applicable law or regulatory guidance; or

  • our internal practices.

 

The current version will be published on our website together with the date of the latest update.

Material changes may be highlighted where appropriate.

​

22. Contact

 

For privacy-related enquiries, requests or complaints, please contact:

LYNSORA LTD
128 City Road
London
EC1V 2NX
United Kingdom

Email: contact@lynsora.com
Company No: 16816940
UK ICO Registration: ZC118488

​

bottom of page