Privacy Policy
Last updated: October 2026
1. Introduction
1.1 This Privacy Policy explains how Traceable Access Limited collects and uses personal data in connection with dryn. dryn is our access management service for smart locks, available at app.dryn.co.uk and described at dryn.co.uk.
1.2 It applies to:
- (a) our customers and the people who act for them, such as account owners and team members;
- (b) people who are given access to a space through dryn, such as residents, tenants, guests, staff and contractors;
- (c) visitors to our website and anyone who contacts us.
2. Who we are
2.1 dryn is provided by Traceable Access Limited (we, us, our), a company registered in England and Wales under company number 12983816. Our registered office is at 16 Richford Gate, Richford Street, London W6 7HL.
2.2 You can contact us about this policy or your personal data at hello@dryn.co.uk, or by post at our registered office.
3. Our role: controller or processor
3.1 Where we are the controller. We decide how and why personal data is used for:
- (a) data about our customers and their account owners and team members, used to run accounts, take payment, give support and communicate with them;
- (b) data about website visitors and people who contact us.
3.2 Where we are the processor. Our customers use dryn to manage access to their own premises. For the personal data of the people they give access to, and of their team members as users of their account, the customer is the controller and we are its processor. We process that data only on the customer's instructions, under the data processing terms in Schedule 1 of our Terms and Conditions.
3.3 If you were given access by a landlord, host, employer, care provider or other organisation, that organisation is responsible for your personal data in dryn. Please contact them first about how your data is used or to exercise your rights. If you contact us, we will pass your request to them and help them respond.
4. The personal data we collect
| Category of person | Personal data | Source |
|---|---|---|
| Account owners and team members | Name, email address, telephone number (optional), organisation name and address, role and assigned sites, password (held only in hashed form), records of sign-in and actions taken in dryn, IP address | You, or the account owner who invited you |
| Account owners: billing | Billing name and address, plan, invoices and payment history. Card details are collected and held by our payment provider, Stripe, not by us | You and Stripe |
| People given access | Name; email address or telephone number if provided; the spaces you may enter; your access codes and their validity periods; references to any card or fingerprint enrolled at a lock (not the fingerprint itself); records of when and how a lock was used | The customer who gave you access, and the customer's lock system |
| People who contact us | Name, contact details, the content of your message | You |
| Website and app visitors | IP address, browser and device type, pages requested and time of request | Your device |
4.1 We do not intend to collect special category data, such as health information, or criminal offence data. Our customers agree not to enter it into dryn.
5. How we use personal data and our lawful bases
5.1 Where we are the controller, we use personal data as follows:
| Purpose | Lawful basis under UK GDPR Article 6 |
|---|---|
| To open and operate customer accounts, connect lock accounts and provide the service | Performance of a contract |
| To take payments, issue invoices and keep financial records | Performance of a contract; legal obligation |
| To send service messages, such as invitations, security notices, trial and renewal reminders and payment notices | Performance of a contract; legitimate interests in running the service |
| To provide support and respond to enquiries | Legitimate interests in helping our customers |
| To keep dryn secure, prevent misuse and fraud, and maintain a reliable record of access | Legitimate interests in a secure and trustworthy service |
| To tell existing customers about new dryn features | Legitimate interests (soft opt-in under PECR); you can opt out at any time |
| To comply with law, and to establish, exercise or defend legal claims | Legal obligation; legitimate interests |
5.2 Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that balancing.
5.3 Where we are a processor, the customer decides the lawful basis for using your data. Usually this is its contract with you, its legitimate interests in controlling access to its premises, or a legal obligation.
6. Cookies
6.1 dryn uses only strictly necessary cookies and similar storage, to keep you signed in and to keep the service secure. These do not require consent under PECR.
6.2 We do not use advertising cookies or third-party analytics on dryn.co.uk or in the dryn app. If we introduce them, we will ask for your consent first and update this policy.
7. Who we share personal data with
7.1 We share personal data only as needed to provide dryn, and we do not sell it.
7.2 Our service providers (sub-processors). They act on our instructions under written contracts that protect your data:
| Provider | Service | Location of processing |
|---|---|---|
| Supabase | Database, sign-in and server functions | Ireland (EU); support access from other countries when needed |
| Vercel | Hosting of the dryn web app | United States and other countries |
| Resend | Sending emails from dryn | United States (account data and delivery logs) |
| Stripe | Payments and subscriptions (account owners only) | United States and other countries |
| Hostinger | Hosting of the dryn.co.uk website | Hostinger's data centres; transfers protected as in section 8 |
7.3 Lock manufacturers. Customers connect their own account with a lock manufacturer, currently TTLock (Hangzhou Sciener Intelligent Control Technology Co., Ltd). To carry out a customer's instructions, dryn sends that manufacturer's cloud the details needed to create, change or remove access: the name the customer gives a code, its validity dates and the lock concerned. The manufacturer holds that data under its own agreement with the customer and its own privacy policy, which we do not control. We recommend that customers label codes with a first name or a reference, not a full name.
7.4 Others. We may also disclose personal data:
- (a) to our professional advisers, such as lawyers and accountants;
- (b) to the police, regulators or courts where the law requires it or to protect the rights and safety of any person;
- (c) to a buyer or successor if our business, or part of it, is sold or restructured, subject to this policy.
8. International transfers
8.1 dryn's main database is in Ireland. The UK has recognised the EU as providing adequate protection for personal data.
8.2 Some of our providers process personal data in the United States. Where they do, the transfer is protected by:
- (a) the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified; or
- (b) the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the Information Commissioner.
8.3 You can ask us for a copy of the relevant safeguards by emailing hello@dryn.co.uk.
8.4 Lock manufacturers may process data in other countries, including outside the UK and EU, under their own terms with the customer. Customers using dryn connect to the manufacturer's European server where one is available.
9. How long we keep personal data
9.1 We keep personal data only for as long as necessary for the purposes in this policy. Deleting an item in dryn hides it immediately.
9.2 We keep account data while the account is open. When an account closes, we keep it only for as long as needed to deal with queries, disputes or legal claims, and then anonymise or delete it.
9.3 Billing records are kept for 6 years from the end of the financial year to which they relate, as required for tax purposes.
9.4 Enquiries and support messages are kept for up to 2 years after the last contact.
9.5 Server logs, email delivery logs and backups are deleted on our providers' standard cycles.
9.6 Where we are a processor, the customer may instruct us to delete or return data sooner. We may keep data for longer where needed for a legal claim, a regulatory investigation or where the law requires it.
10. Security
10.1 We use appropriate technical and organisational measures to protect personal data, including encryption and role-based access controls, and we review them regularly.
10.2 No system is completely secure. If a personal data breach occurs that is likely to result in a risk to you, we will notify the ICO within 72 hours where required. We will also notify you, or the customer responsible for your data, as the law requires.
11. Your rights
11.1 Under UK data protection law you have the right to:
- (a) be informed about how your personal data is used;
- (b) access your personal data;
- (c) have inaccurate data corrected;
- (d) have your data erased in certain circumstances;
- (e) restrict how your data is used in certain circumstances;
- (f) object to processing based on legitimate interests, and to direct marketing at any time;
- (g) data portability, where processing is based on contract or consent and carried out by automated means;
- (h) withdraw consent at any time, where we rely on consent.
11.2 To exercise your rights, email hello@dryn.co.uk. We may ask you to confirm your identity. We will respond within one month, which may be extended by two further months for complex requests. There is normally no charge.
11.3 Some rights are limited by law. For example, we may refuse to erase records needed to establish or defend legal claims, or that we must keep by law.
11.4 Where we are a processor (section 3.2), we will refer your request to the customer responsible and help it to respond.
12. Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
13. Children
dryn is a business service and is not directed at children. Customers may give access to a household that includes children. In that case the customer is responsible for that data and must hold only what is necessary.
14. Complaints
If you have a concern, please contact us first at hello@dryn.co.uk and we will try to resolve it. You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; ico.org.uk/make-a-complaint.
15. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated. If we make a significant change, we will tell account owners by email.