Last updated: 26 September 2025
Version: 1.01. Who We Are
This Privacy Policy explains how Yarro Ltd (“Yarro”, “we”, “us”, “our”) collects, uses, shares, and protects personal data. It also outlines the rights individuals have under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.
Company name: Yarro LtdCompany number: 16634091Registered address: 2 Hurst Close, Over Hulton, Bolton, BL5 1DT, United KingdomEmail for privacy enquiries: [email protected]Supervisory authority: Information Commissioner’s Office (ICO), United KingdomICO registration number: ZB990388We are registered with the Information Commissioner’s Office and operate under the laws of England and Wales.2. Scope of This Policy
This policy applies to:
Visitors to our website (www.yarro.ai)Individuals whose data we process on behalf of our clients (for example, tenants, landlords, and contractors)In most cases we act as a data processor, processing personal data only on the documented instructions of our clients (the data controllers). When you visit our website or communicate with us directly, we act as a data controller.3. Personal Data We Collect
We may collect and process the following categories of personal data:
Contact information: name, email address, phone number, and similar details.Property-related information: addresses and descriptions of maintenance issues (when provided via our services).Communication data: content of WhatsApp messages, emails, or other correspondence processed on behalf of clients.Technical information: IP address, browser type, operating system, and other basic diagnostic data when you visit our site.We do not intentionally collect special category data (such as health data) or data relating to children.4. How We Use Personal Data
We use personal data for the following purposes:
To provide our services: enabling communication workflows, triaging maintenance issues, and delivering automation tools.To respond to enquiries: answering questions you send to us.To improve and develop our services: analysing aggregated data to improve system performance.To comply with legal obligations: maintaining records required by law.For marketing (present or future): sending news, updates, or offers where you have consented or where we have a legitimate interest. You can opt out at any time by contacting us or following unsubscribe instructions.We do not use personal data for automated decision-making that produces legal or similarly significant effects.5. Lawful Bases for Processing
We rely on the following lawful bases under UK GDPR:
Contract: when processing is necessary to perform a contract with our clients.Legitimate interests: to deliver and improve our services and communicate with clients and prospects, balanced against individuals’ rights.Consent: where required, such as for marketing communications.Legal obligations: where processing is required to meet legal or regulatory requirements.6. Sharing Personal Data
We only share personal data with trusted third parties who help us deliver our services. These sub-processors include:
Twilio (messaging infrastructure)Meta Platforms, Inc. (WhatsApp Business)OpenAI (AI processing services)n8n Cloud (workflow automation)Google Workspace (email and collaboration tools)A current list of sub-processors is maintained at www.yarro.ai/subprocessors.
We may also share personal data with regulators, authorities, legal advisers, or as required by law.7. International Data Transfers
Some of our sub-processors are based outside the UK and the European Economic Area (“EEA”). Where data is transferred internationally, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Addendum or Standard Contractual Clauses.8. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this policy:
Service data (e.g., maintenance communication records): up to 36 months from the date of ticket closure, after which it is securely deleted or anonymised.Client and contractual records: up to 7 years to meet legal and accounting obligations.Marketing data: until you withdraw consent or object to processing.Website diagnostic logs: typically retained for no longer than 12 months.9. Your Data Protection Rights
Individuals have the following rights under UK GDPR:
Access: to request a copy of personal data we hold.Rectification: to request correction of inaccurate or incomplete data.Erasure: to request deletion of personal data (“right to be forgotten”).Restriction: to request restriction of processing.Portability: to receive personal data in a structured, commonly used format.Objection: to object to processing based on legitimate interests or direct marketing.Rights in relation to automated decision-making and profiling: you have the right not to be subject to decisions based solely on automated processing.To exercise any of these rights, contact us at [email protected]. We will respond within one month, subject to legal allowances.10. Security
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.11. Complaints
If you are unhappy with how we handle your data, please contact us first at [email protected].
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Website: www.ico.org.ukPhone: +44 (0)303 123 111312. Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The latest version will always be available at www.yarro.ai/privacy-policy.
© Yarro. All rights reserved.