Privacy policy

Last updated: 30 September 2026

Welcome to Hytro Limited's Privacy and Cookies Notice. This Notice explains how we look after your personal data when you visit our website, buy our products, take our education courses or otherwise interact with us, and tells you about your privacy rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies, the EU General Data Protection Regulation (EU GDPR).

Hytro Limited ("we", "us" or "our") is the controller and responsible for your personal data. We are registered in England and Wales under company number 12161623, with our registered office at 2 Park Court, Pyrford Road, West Byfleet, Surrey, KT14 6SD, England. This Notice covers hytro.com and our education platform at education.hytro.com.

If you have any questions about this Notice, including any requests to exercise your legal rights, please contact dataprotection@hytro.com.

You have the right to complain at any time to the Information Commissioner's Office (ICO), the UK supervisory authority (www.ico.org.uk). If you are in the EU or EEA, you may also complain to your local supervisory authority.

1. The data we collect about you

Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer the following kinds of personal data:

  • Identity Data - first name, last name, similar identifier.
  • Contact Data - billing address, delivery address, email address and telephone numbers.
  • Financial Data - payment card details, processed by our payment providers; we do not store full card numbers ourselves.
  • Transaction Data - details about payments and the products, courses and services you have purchased from us.
  • Technical Data - IP address, login data, browser type and version, time zone and location, operating system, and other technology on the devices you use.
  • Profile Data - your username and password, purchases, your interests and preferences, and your answers to our quizzes, consultation requests and surveys (for example: the sport you play or coach, your role, and your training goals).
  • Education Data - if you enrol on one of our courses: your account details, course progress and completion records, so that we can deliver the course and issue certification.
  • Usage Data - how you use our website and courses, and content you submit such as product reviews and support conversations.
  • Marketing and Communications Data - your preferences in receiving marketing from us.

We do not intentionally collect any Special Categories of Personal Data (such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, or genetic and biometric data), and we ask that you do not include health information in quiz or consultation answers. Where United States customers use a health spending eligibility service (HSA/FSA) at checkout, any health-related attestation is collected and processed by that provider under its own privacy notice, not by us. We do not collect any information about criminal convictions and offences.

2. How is your personal data collected?

  • Direct interactions. You give us your data when you purchase products, create an account, enrol on a course, complete our product-finder quiz, request a consultation or team enquiry, join a waitlist, download our course syllabus, sign up to our emails, leave a review, or contact us by chat or email.
  • Automated technologies. As you interact with our websites, we automatically collect Technical Data using cookies and similar technologies (see section 5).
  • Third parties. We receive Contact, Financial and Transaction Data from our e-commerce and payment providers, and Transaction Data from our fulfilment and delivery partners.

3. How we use your personal data

We will only use your personal data where the law allows us to. Most commonly: where we need to perform a contract with you; where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests; where you have given consent; and where we need to comply with a legal obligation.

Purpose/Activity

Type of data

Lawful basis

To register you as a customer or course participant

Identity, Contact

Performance of a contract

To process and deliver your order or course, manage payments, and collect money owed to us

Identity, Contact, Financial, Transaction

(i) Performance of a contract (ii) Legitimate interests (to recover debts due to us)

To manage our relationship with you, including notifying you of changes to our terms or this Notice

Identity, Contact, Profile

(i) Performance of a contract (ii) Legal obligation (iii) Legitimate interests (keeping records updated)

To recommend suitable products and protocols and respond to consultation or team enquiries, using your quiz or form answers

Identity, Contact, Profile

Legitimate interests (responding to your request and tailoring our recommendation); consent where required for related marketing

To deliver our education courses, track progress and issue certification (including continuing-education records)

Identity, Contact, Education

Performance of a contract

To administer and protect our business and websites (troubleshooting, testing, hosting, security, fraud prevention)

Identity, Contact, Technical

(i) Legitimate interests (running our business, security) (ii) Legal obligation

To publish product reviews you choose to submit

Identity, Usage

Legitimate interests (showing genuine customer feedback); the review is published under the name you provide

To use analytics to improve our website, products and marketing

Technical, Usage

Consent (analytics cookies via our cookie banner); legitimate interests for aggregated, cookieless measurement

To send you marketing about our products, education and research

Identity, Contact, Marketing and Communications, Profile

Consent, or the soft opt-in for similar products where permitted; you can opt out at any time

Marketing

You may receive marketing from us if you have requested it, purchased from us, or given us your details through our quiz, waitlists or downloads, and you have not opted out. Every marketing email contains an unsubscribe link, and you can opt out at any time by using it or contacting us. Opting out of marketing does not affect data we process to fulfil an order or provide a course.

4. Who we share your personal data with

We share personal data with the following categories of service providers, who act on our instructions and only for the purposes described above:

  • E-commerce platform: Shopify (store hosting, checkout, payments including Shop Pay).
  • Payment providers: the payment method you choose at checkout, which may include Shopify Payments, PayPal, Klarna, Apple Pay, Google Pay and major card schemes.
  • Fulfilment and delivery: our third-party fulfilment partner and supported carriers.
  • Customer support: Gorgias (chat, contact forms and support tickets)
  • Reviews: Yotpo (collecting and displaying product reviews).
  • Marketing and CRM: ActiveCampaign (email marketing), Pipedrive (Sales CRM) and Zapier.
  • Education: the learning platform that hosts our courses at education.hytro.com.
  • Analytics: Google Analytics
  • Sizing and eligibility tools: our size-recommendation app, and for US customers, the HSA/FSA eligibility provider offered at checkout.
  • Professional advisers and authorities where required by law.
  • Business transfers: third parties to whom we may sell, transfer or merge parts of our business or assets; any new owner may use your personal data in the same way as set out in this Notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law, and we do not allow our service providers to use your personal data for their own purposes.

5. Cookies and similar technologies

We use cookies and similar technologies on our websites. When you first visit, a cookie banner lets you accept or decline non-essential cookies, and you can change your choices at any time through the banner's settings. We use:

  • Strictly necessary cookies - set by Shopify to run the store: keeping your cart, signing you in securely, remembering your region and currency, and recording your cookie choices. These do not require consent.
  • Analytics cookies (with your consent) - Google Analytics cookies (such as _ga and _ga_*) that help us understand how the site is used.
  • Functional cookies - set by our support chat (Gorgias) and reviews (Yotpo) tools when you use those features.
  • Advertising cookies (only with your consent, where in use) - used to measure and improve our advertising.

6. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They only process your personal data on our instructions and are subject to a duty of confidentiality. We have procedures to deal with any suspected personal data breach and will notify you and the regulator where we are legally required to do so.

7. Data retention

We only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including satisfying any legal, tax, accounting or reporting requirements. In broad terms: order and transaction records are kept after the transaction for tax and legal purposes; education and certification records are kept for as long as needed to evidence your certification; marketing profiles are kept until you unsubscribe or after a prolonged period of inactivity; and support conversations are kept only as long as needed to resolve and evidence the matter. We may retain data for longer in the event of a complaint or prospective legal claim.

8. Your legal rights

Under data protection law you have rights, in certain circumstances, to: request access to your personal data; request correction; request erasure; object to processing; request restriction of processing; request transfer of your data; and withdraw consent at any time where we rely on consent. If you wish to exercise any of these rights, contact dataprotection@hytro.com.

9. Residents of the United States

If you are a resident of a US state with a comprehensive privacy law, you may have rights to know, access, correct and delete personal information we hold about you, and to opt out of certain sharing. We do not sell your personal information. To exercise these rights, contact dataprotection@hytro.com.

10. Changes to this Notice

We keep this Notice under review and will post any changes on this page with an updated date at the top.