Terms and Conditions
Last updated: October 2026
1. Definitions and interpretation
1.1 In these Terms the following definitions apply:
- Account means the account opened by the Customer to use the Service.
- Account Owner means the individual who opened the Account, or to whom the Account has been transferred, and who holds the account owner role.
- Annual Plan and Monthly Plan mean the subscription options described in clause 10.
- Authorised User means any individual whom the Customer allows to use the Service under the Account, including team members (location managers and technicians) and people given access.
- Business Day means a day other than a Saturday, Sunday or public holiday in England.
- Charges means the fees payable for the Service, as set out in the Price List.
- Connected Lock means a lock that is connected to the Service through the Customer's Lock Account and has not been archived.
- Contract means the contract between Traceable Access and the Customer formed under clause 2, comprising these Terms including Schedule 1.
- Customer means the business, organisation or individual acting in the course of a business that opens an Account.
- Customer Data means all data, including Personal Data, that the Customer or its Authorised Users enter into the Service, or that the Service receives from the Customer's Lock Account.
- Data Protection Legislation means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any other law relating to personal data that applies in the United Kingdom.
- DPA means the data processing terms set out in Schedule 1.
- Lock Account means the Customer's account with a lock manufacturer's cloud service, currently TTLock.
- Lock Provider means the provider of a Lock Account.
- Price List means our prices for the Service as published at dryn.co.uk and shown in the Service when the Customer subscribes or renews, as updated under clause 9.5.
- Read-only Period means the period of 30 days described in clause 12.4.
- Service means the dryn access management software made available by Traceable Access as software-as-a-service at app.dryn.co.uk, including any updates.
- Traceable Access, we, us and our mean Traceable Access Limited, a company registered in England and Wales under company number 12983816, whose registered office is at 16 Richford Gate, Richford Street, London W6 7HL.
- Trial means the free trial described in clause 8.
1.2 Clause headings do not affect interpretation. The words including, include and in particular are illustrative and do not limit the words before them. A reference to writing includes email. A reference to a law includes that law as amended or replaced.
1.3 Personal Data, controller, processor, data subject and processing have the meanings given in the UK GDPR.
2. Basis of the Contract
2.1 These Terms apply to the Customer's use of the Service. The Contract is formed when the Customer completes sign-up and confirms that it accepts these Terms.
2.2 The Service is supplied only to businesses. By accepting these Terms the Customer confirms that it is acting for the purposes of its trade, business, craft or profession, including the letting of property, and not as a consumer. The individual accepting these Terms confirms that they are authorised to bind the Customer.
2.3 These Terms are the only terms on which we supply the Service. They apply to the exclusion of any terms the Customer seeks to impose, or which are implied by trade, custom or course of dealing.
2.4 If Schedule 1 conflicts with the rest of these Terms on the processing of Personal Data, Schedule 1 prevails.
3. The Service
3.1 During the Contract we grant the Customer a non-exclusive, non-transferable right to use the Service, and to permit its Authorised Users to use it, for the Customer's internal business purposes.
3.2 The Service is an access management layer. It lets the Customer organise its sites, buildings, spaces and locks; issue and withdraw access codes; invite and manage Authorised Users; and view a record of access activity. It does so by sending the Customer's instructions to the Lock Provider's cloud service and recording the result.
3.3 The Service does not communicate with locks directly. Traceable Access does not supply, install, maintain or repair locks, gateways, keypads, Wi-Fi, mobile networks or any other hardware.
3.4 Remote actions depend on the lock's connection to the Lock Provider's service, which is outside our control.
3.5 The Service is not a safety system, an alarm, an emergency access system or a substitute for physical keys. The Customer must at all times keep an independent means of entry to every space for emergencies and for failure of a lock, gateway, network, the Lock Provider's service or the Service.
3.6 We will provide the Service with reasonable skill and care. We will make reasonable efforts to keep the Service available, but do not guarantee that it will be uninterrupted or free from error. We may suspend the Service for planned maintenance, giving notice where reasonably practicable, and for urgent maintenance or security reasons without notice.
4. Lock Accounts and third-party services
4.1 The Customer's Lock Account belongs to the Customer and is governed by the Customer's own agreement with the Lock Provider. Traceable Access is not a party to that agreement and is not responsible for the Lock Provider's acts, omissions, availability, security or handling of data.
4.2 By connecting a Lock Account the Customer authorises Traceable Access to access it and to act on it, on the Customer's behalf and with the same rights as the Customer holds, for the purpose of providing the Service.
4.3 Changes made directly in the Lock Provider's app or service, outside the Service, are made by the holder of the Lock Account and are the Customer's responsibility.
4.4 Fingerprints and cards must be enrolled at the lock in person. Only access codes can be issued fully remotely.
5. Accounts and Authorised Users
5.1 The Customer must provide accurate and complete information when opening the Account and keep it up to date.
5.2 The Account Owner controls who may join the Account as a team member and the role and sites assigned to each. The Customer is responsible for all use of the Account by its Authorised Users, and for their compliance with these Terms, as if it were its own.
5.3 The Customer must ensure that each Authorised User keeps their sign-in details confidential. The Customer must tell us promptly at hello@dryn.co.uk if it suspects unauthorised use of the Account.
5.4 The Customer must not seek to circumvent any security control of the Service.
6. Customer obligations and acceptable use
6.1 The Customer shall:
- (a) only give access to spaces that it is legally entitled to control, and only to people it is entitled to admit;
- (b) comply with all laws that apply to its use of the Service, including housing, landlord and tenant, consumer, equality and Data Protection Legislation;
- (c) give the people whose data it enters into the Service the information required by Data Protection Legislation;
- (d) not enter special category data (for example health information) or criminal offence data into the Service, including in names, labels or notes;
- (e) maintain its locks, gateways and connectivity, and its Lock Account in good standing.
6.2 The Customer shall not, and shall ensure that its Authorised Users do not:
- (a) use the Service to enter, or allow anyone to enter, premises unlawfully, or to harass, unlawfully evict or monitor any person;
- (b) attempt to access data belonging to another customer of Traceable Access;
- (c) probe, scan or test the security of the Service without our prior written consent;
- (d) introduce any virus or harmful code, or interfere with the operation of the Service;
- (e) copy, modify, reverse engineer, decompile or create derivative works of the Service, except as permitted by law;
- (f) resell, sub-license or make the Service available to any third party other than its Authorised Users.
7. Customer Data and data protection
7.1 As between the parties, the Customer owns all Customer Data. The Customer grants Traceable Access a non-exclusive licence to use Customer Data for the purpose of providing and supporting the Service.
7.2 In respect of Personal Data about the Customer's Authorised Users and the people to whom it gives access, the Customer is the controller and Traceable Access is the processor. That processing is governed by the DPA in Schedule 1.
7.3 Traceable Access is the controller of Personal Data about the Customer's own representatives that we use to administer the Account, take payment and communicate with the Customer. We process it as described in our Privacy Policy.
7.4 The Customer warrants that it has a lawful basis for all Personal Data it enters into the Service or causes the Service to process, and for the instructions it gives in respect of it.
7.5 Customer Data is retained, anonymised and deleted in accordance with the DPA.
7.6 We may use anonymised and aggregated data that does not identify the Customer or any individual to operate, secure and improve the Service.
8. Free Trial
8.1 A new Account starts with a free Trial of 14 days. A valid payment card is required to start the Trial. No Charges are taken during the Trial.
8.2 If the Customer has not connected a lock when the Trial ends, the Account will close automatically.
8.3 If the Customer has a Connected Lock when the Trial ends, the plan chosen at sign-up begins and Charges become payable under clause 9, unless the Customer has cancelled before the Trial ends.
8.4 We will send a reminder before the Trial ends, stating the first amount that will be charged.
8.5 Each Customer may have one Trial. We may refuse a further Trial.
9. Charges and payment
9.1 The Customer shall pay the Charges in accordance with the Price List in force at the time. Charges are calculated by reference to the plan chosen and the number of Connected Locks.
9.2 Charges are payable in advance, in pounds sterling, by card or other method offered through our payment provider, Stripe. The Customer authorises us to take each payment from its chosen payment method when due.
9.3 Traceable Access is not currently registered for VAT, and no VAT is charged. If we register for VAT, VAT will be added to the Charges at the applicable rate from the date of registration, and we will give notice by email.
9.4 If a payment fails, or the Customer's bank requires the Customer to approve a payment, we will email the Account Owner a link to pay or approve it. If a payment remains unpaid for 14 days after it falls due, we may stop lock management under clause 11.
9.5 We may increase the Charges by giving the Account Owner at least 30 days' notice by email. An increase takes effect from the start of the Customer's next billing period, or for an Annual Plan from its next renewal. The Customer may cancel before the increase takes effect.
9.6 Except as expressly set out in these Terms, Charges are non-refundable.
10. Annual and Monthly Plans
10.1 Annual Plan.
- (a) The Charges for an Annual Plan are paid at the start of each year for the number of Connected Locks on that day. This number is the Customer's paid places for the year.
- (b) Replacing one Connected Lock with another, within the paid places, carries no extra Charge.
- (c) If the number of Connected Locks rises above the paid places during the year, the additional locks are charged immediately, pro rata for the rest of the year, and the paid places increase accordingly.
- (d) Archiving or disconnecting a lock during the year does not reduce the paid places and gives no refund.
- (e) We will email the Account Owner at least 7 days before each renewal. On renewal the paid places are reset to the number of Connected Locks on the renewal date.
10.2 Monthly Plan. The Charges for a Monthly Plan are paid each month for the number of Connected Locks. Changes in the number of Connected Locks are reflected in the Charges as shown in the Service.
10.3 The Customer may move from a Monthly Plan to an Annual Plan where the Service allows it.
11. Suspension
11.1 We may suspend lock management, or the Customer's access to the Service, in whole or part, if:
- (a) any Charges remain unpaid as described in clause 9.4;
- (b) the Customer or an Authorised User materially breaches clause 6;
- (c) we reasonably believe suspension is necessary to protect the security or integrity of the Service, other customers or any person, or to comply with law.
11.2 We will give notice before suspending where reasonably practicable, and will restore the Service promptly once the cause is resolved.
11.3 During any suspension, the Customer may still sign in, view its records and remove access. Access codes already on the locks continue to work, and can be managed through the Lock Provider's app.
12. Term, cancellation and closure
12.1 The Contract starts when it is formed under clause 2.1 and continues until the Account is closed under this clause 12.
12.2 Cancellation by the Customer. The Customer may cancel at any time in the billing section of the Service. Cancellation takes effect at the end of the billing period already paid for: the current month for a Monthly Plan, or the current year for an Annual Plan. No refund is given for any unused part of a billing period.
12.3 Cancelling lock management only. Where the Service allows the Customer to cancel the per-lock service while keeping the Account open:
- (a) lock management stops at the end of the period paid for;
- (b) the Customer may still sign in, view its records and remove access;
- (c) the Customer may restart lock management from within the Service.
12.4 Read-only Period. When the Customer's subscription ends, the Account becomes read-only for 30 days. During the Read-only Period:
- (a) Authorised Users may sign in, view and export Customer Data, and remove or restrict access;
- (b) no new access may be given and the set-up cannot be changed;
- (c) the Account Owner may resubscribe, which restores the Account in full.
12.5 Closure. At the end of the Read-only Period the Account closes. Before closing it, we will email the Account Owner a list of the access codes still active on each lock, showing the lock, the holder and the validity dates but not the code itself. On closure, all Authorised Users lose access to the Service and the connection to the Lock Account ends.
12.6 Codes stay on locks. We do not remove access codes from the Customer's locks when the Account closes. They continue to work, so that occupants are not locked out, and the Customer remains responsible for managing them through the Lock Provider's app.
12.7 Termination by either party. Either party may terminate the Contract with immediate effect by written notice if the other party:
- (a) commits a material breach that cannot be remedied, or does not remedy a remediable breach within 14 days of written notice;
- (b) becomes insolvent, enters administration or liquidation, makes an arrangement with its creditors, or suffers any similar event.
12.8 Unused Accounts. We may close an Account that has had no Connected Lock for 12 consecutive months, after sending the Account Owner at least two warning emails, the last at least 30 days before closure.
12.9 Consequences. On closure or termination:
- (a) all rights granted to the Customer end;
- (b) any Charges that are due remain payable;
- (c) Customer Data will be kept, and then anonymised or deleted, in accordance with the DPA.
Clauses 7, 12.5, 12.6, 12.9, 13, 14, 16, 17 and 19 survive closure or termination.
13. Intellectual property
13.1 Traceable Access and its licensors own all intellectual property rights in the Service, including its software, design, documentation and the dryn name and brand. No rights are granted to the Customer except those expressly set out in these Terms.
13.2 If the Customer or an Authorised User gives us suggestions or feedback about the Service, we may use them freely and without payment.
14. Confidentiality
14.1 Each party shall keep confidential all information of the other party that is marked confidential or would reasonably be regarded as confidential, including Customer Data and the non-public workings of the Service. It shall use that information only to perform or receive the Service.
14.2 Clause 14.1 does not apply to information that:
- (a) is or becomes public other than through breach of this clause;
- (b) was lawfully known to the recipient before disclosure;
- (c) is independently developed;
- (d) must be disclosed by law or by a court or regulator, in which case the disclosing party shall, where lawful, give the other party prompt notice.
15. Warranties and disclaimers
15.1 Each party warrants that it has full power and authority to enter into the Contract.
15.2 Except as expressly stated in these Terms, the Service is provided "as is". All warranties, conditions and other terms implied by statute or common law are excluded to the fullest extent permitted by law, including those of satisfactory quality and fitness for a particular purpose.
15.3 Traceable Access gives no warranty, and accepts no responsibility, for:
- (a) any lock, gateway, network or other hardware;
- (b) the Lock Provider's service, data handling or availability;
- (c) any act or omission of an Authorised User, or of any person given access by the Customer.
16. Limitation of liability
16.1 Nothing in the Contract limits or excludes either party's liability for:
- (a) death or personal injury caused by its negligence;
- (b) fraud or fraudulent misrepresentation;
- (c) any other liability that cannot be limited or excluded by law.
16.2 Subject to clause 16.1, Traceable Access shall not be liable, whether in contract, tort (including negligence), breach of statutory duty or otherwise, for any:
- (a) loss of profits, revenue, rent, business, contracts or anticipated savings;
- (b) loss of goodwill or reputation;
- (c) loss or corruption of data, except to the extent caused by our breach of the DPA;
- (d) indirect or consequential loss.
16.3 Subject to clause 16.1, Traceable Access shall not be liable for any loss arising from:
- (a) the failure, malfunction or unavailability of any lock, gateway, network or Lock Provider service;
- (b) changes made outside the Service;
- (c) the Customer's failure to keep an independent means of entry under clause 3.5;
- (d) access given or withdrawn on the Customer's instructions;
- (e) any event beyond our reasonable control.
16.4 Subject to clause 16.1, Traceable Access's total aggregate liability arising under or in connection with the Contract in each period of 12 months shall not exceed the greater of:
- (a) the total Charges paid by the Customer in the 12 months before the event giving rise to the claim; and
- (b) £500.
16.5 The Customer acknowledges that the Charges reflect the allocation of risk in this clause 16. This clause 16 is reasonable in the light of the low cost of the Service and the Customer's control over its locks, Lock Account and premises.
17. Indemnity
17.1 The Customer shall indemnify Traceable Access against all losses, damages, costs (including reasonable legal fees) and fines arising from any third-party claim or regulatory action resulting from:
- (a) the Customer giving or withdrawing access to premises unlawfully;
- (b) the Customer's breach of clause 6 or of Data Protection Legislation;
- (c) the Customer Data, or the Customer's instructions in respect of it.
17.2 Traceable Access shall notify the Customer promptly of any such claim, allow the Customer to conduct its defence at the Customer's cost, and give reasonable assistance.
18. Changes
18.1 We may change the Service to improve it, to respond to changes by a Lock Provider, or for security or legal reasons. If a change materially reduces the functionality of the Service, we will give at least 30 days' notice where reasonably practicable. The Customer may then cancel and receive a pro-rata refund of Charges prepaid for the unused period.
18.2 We may amend these Terms by giving the Account Owner at least 30 days' notice by email. Changes needed for legal or security reasons may take effect sooner. If the Customer does not accept a change, it may cancel before the change takes effect. Continued use of the Service after that date constitutes acceptance.
19. General
19.1 Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control. This clause does not apply to the Customer's obligation to pay the Charges.
19.2 Assignment. The Customer may not assign or transfer the Contract without our prior written consent. We may assign the Contract to an affiliate or to a successor to our business on notice to the Customer.
19.3 Subcontracting. We may use subcontractors and sub-processors to provide the Service, subject to the DPA. We remain responsible for them.
19.4 Notices. We will send notices to the Account Owner's email address registered on the Account. The Customer must send notices to hello@dryn.co.uk. An email is treated as received at 9.00 am on the next Business Day after sending.
19.5 Entire agreement. The Contract is the entire agreement between the parties about its subject matter. Each party confirms that it has not relied on any statement not set out in the Contract. Nothing in this clause limits liability for fraud.
19.6 Third-party rights. No one other than the parties has any right under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of the Contract.
19.7 Severance. If any provision is found invalid or unenforceable, it shall be modified to the minimum extent necessary to make it valid, and the rest of the Contract is unaffected.
19.8 Waiver. A failure or delay in exercising a right is not a waiver of it.
19.9 No partnership. Nothing in the Contract creates a partnership, joint venture or agency between the parties.
19.10 Governing law and jurisdiction. The Contract, and any dispute or claim arising out of or in connection with it, including non-contractual disputes or claims, is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.
Schedule 1: Data Processing Terms (DPA)
This Schedule forms part of these Terms. It sets out the terms required by Article 28 of the UK GDPR for the Personal Data that Traceable Access processes on the Customer's behalf. In this Schedule, paragraph references (S1.1 and so on) are to paragraphs of this Schedule.
1. Roles and scope
S1.1 The Customer is the controller, and Traceable Access is the processor, of the personal data described in Annex A (Customer Personal Data).
S1.2 This Schedule does not apply to personal data for which Traceable Access is controller, such as data about the Customer's representatives used to administer the Account and take payment. That data is covered by our Privacy Policy.
2. Instructions
S2.1 We process Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by law. In that case we will inform the Customer before processing, unless the law prohibits it.
S2.2 These Terms, this Schedule and the Customer's use and configuration of the Service are the Customer's complete instructions. Further instructions must be agreed in writing.
S2.3 We will tell the Customer promptly if, in our opinion, an instruction infringes Data Protection Legislation.
3. Confidentiality
S3.1 We ensure that everyone authorised to process Customer Personal Data is bound by a duty of confidentiality.
S3.2 Our personnel access Customer Personal Data only where necessary to provide, support or secure the Service, at the Customer's request, or where required by law.
4. Security
S4.1 We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 UK GDPR, including the measures in Annex B. We may update those measures provided the overall level of security is not reduced.
5. Sub-processors
S5.1 The Customer gives general written authorisation for us to engage the sub-processors listed in Annex C.
S5.2 We will notify the Account Owner by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable grounds relating to data protection within that period. If we cannot resolve the objection, the Customer may terminate the Contract and receive a pro-rata refund of Charges prepaid for the unused period.
S5.3 We impose on each sub-processor, by written contract, data protection obligations no less protective than those in this Schedule, and remain liable to the Customer for its performance.
S5.4 The Customer's Lock Provider is not a sub-processor of Traceable Access. The Customer holds its Lock Account under its own agreement with the Lock Provider, and the Service passes the Customer's instructions to the Lock Provider on the Customer's behalf.
6. International transfers
S6.1 We will not transfer Customer Personal Data outside the United Kingdom unless the transfer is covered by UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement or Addendum issued by the Information Commissioner.
7. Assistance
S7.1 Taking into account the nature of the processing, we will assist the Customer by appropriate technical and organisational measures in responding to requests from data subjects. The Service allows the Customer to view, export, correct and remove access and personal data. We will forward to the Customer within 5 Business Days any request we receive directly from a data subject, and will not respond to it ourselves except on the Customer's instructions.
S7.2 We will provide reasonable assistance with the Customer's obligations under Articles 32 to 36 UK GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to us. We may charge reasonable fees for assistance beyond the standard functionality of the Service.
8. Personal data breaches
S8.1 We will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
S8.2 The notice will describe, so far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available.
9. Return and deletion
S9.1 During the Read-only Period described in clause 12.4, the Customer may export Customer Personal Data using the Service.
S9.2 After the Account closes, we will delete or anonymise Customer Personal Data within a reasonable period, and in any event within 12 months of closure, unless the law requires us to keep it.
S9.3 Backups are overwritten on their normal cycle. We will confirm deletion in writing on request.
10. Audit
S10.1 We will make available to the Customer all information reasonably necessary to demonstrate compliance with Article 28 UK GDPR, subject to appropriate confidentiality undertakings.
S10.2 The Customer, or an independent auditor bound by confidentiality, may audit our compliance with this Schedule once in any 12-month period, on at least 30 days' written notice, during business hours and at the Customer's cost. Additional audits may take place where required by a supervisory authority or following a personal data breach.
11. Liability and precedence
S11.1 Each party's liability under this Schedule is subject to the limitations and exclusions in clause 16, except where the law does not permit this.
S11.2 If this Schedule conflicts with the rest of these Terms on the processing of personal data, this Schedule prevails.
Annex A: Details of processing
| Item | Detail |
|---|---|
| Subject matter | Provision of the dryn access management Service |
| Duration | The term of the Contract and the period in paragraph S9 |
| Nature and purpose | Storing, organising and displaying access data; transmitting the Customer's instructions to its Lock Provider; recording and displaying access activity; sending invitations and service emails |
| Categories of data subjects | The Customer's residents, tenants, guests, visitors, staff, contractors and team members |
| Categories of personal data | Name; email address and telephone number where provided; spaces assigned; access codes and their validity periods; references to cards or fingerprints enrolled at a lock (not biometric data); records of lock use; notes entered by the Customer |
| Special category data | None. The Customer must not enter special category data into the Service |
Annex B: Security measures
- Encryption of data in transit and at rest.
- Role-based access controls, so that each user sees only what their role permits.
- Encryption of credentials used to connect to Lock Accounts; Lock Account passwords are not stored.
- Hosting with providers that maintain recognised security certifications.
- Prompt patching of known vulnerabilities in the software we use.
A more detailed description of our security measures is available to customers on request, under confidentiality.
Annex C: Approved sub-processors
| Sub-processor | Service | Location |
|---|---|---|
| Supabase | Database, sign-in and server functions | Ireland (EU) |
| Vercel | Hosting of the dryn web app | United States |
| Resend | Email delivery | United States (account data and logs) |
| Stripe | Payments (Account Owner data only) | United States and other countries |
Company details
Traceable Access Limited, company number 12983816, 16 Richford Gate, Richford Street, London W6 7HL. Contact: hello@dryn.co.uk.