Data-protection-first
On data-sensitive builds a DPIA comes before the first line of code: what data, why, for how long. A clear UK GDPR lawful basis on every form.
THE WORK
Local-business sites
·
Verification infrastructure
·
Data-protection systems
·
Cyber & AI governance
Booking discovery calls
Digital products for small UK ventures, compliant by default.
bygild builds the product and the part most studios skip: the data. Privacy, consent, and security designed in from the first line of code, not bolted on after launch.
From local-business sites to verification infrastructure. Hand-coded, UK-hosted, plain English.
Data-first
DPIA before code on sensitive builds
Hand-coded
No templates
UK-hosted
Built to UK GDPR
Featured build
KeyProof: the proof layer for car hire.
keyproof.co.uk · Verification infrastructure · bygild is the build partner
Verification infrastructure for UK car-hire firms, and the software that runs the hire on top of it. Before every handover the renter opens one link: identity and DVLA licence verification, an e-signed rental agreement, and timestamped photos of the car's condition, all landing in one record the firm can hand to an insurer. Behind that record sits the operator's day: bookings, an availability calendar, the money owed on each hire, fines tied back to the renter, and a record of every customer. Scoped data-protection-first, with a DPIA before the first line of code.
- Identity and DVLA licence verification, e-signed agreement
- Third-party identity provider: raw ID never sits in the platform
- Timestamped condition photos, before and after, in one record
- Bookings, calendar, money, fines and customer records in one portal
- DPIA-first scope, UK GDPR lawful basis, minimal retention
More work
Also live: Noor Hair & Beauty and the Vertex Tutors reference build.
See all work →
How every build ships
The governance layer is the point.
Most studios ship the product and leave the data as someone else's problem. These six standards apply to every bygild build, from a local-business site to verification infrastructure.
GDPR-aware by default
Consent banners, data-retention policy, subject-access-ready forms. Schedule 1 Article 28 DPA in every contract that touches client data.
Hold less, risk less
Data minimisation as a design rule. On KeyProof, identity is verified by a specialist third party so raw ID documents never sit in the platform at all.
UK-based, UK-hosted
Sites sit on London servers. Your data and your forms stay in the UK.
Accessibility as standard
WCAG 2.2 AA contrast, keyboard navigation, screen-reader labels. Reference build scores Lighthouse a11y 100.
No platform lock-in
Domain, hosting, source code are yours. Full source-code transfer on final payment.
Current focus
Cyber and AI governance.
Data protection, engineered
The studio's regulatory groundwork is authored in-house and applied to every build: a UK GDPR Article 28 Data Processing Agreement, PECR Regulation 22(2) consent records, GDPR Article 13 transparency notices, and a 90-day PII anonymisation routine that enforces the retention policy automatically.
AI governance for small firms
bygild maintains an AI Governance and Acceptable Use Policy mapped to the EU AI Act risk tiers, the NIST AI Risk Management Framework, and ISO/IEC 42001, and is building out this practice for UK SMEs that use AI but have no compliance function. Evidence systems and infrastructure, never legal advice.
The practice
The standards, the authored groundwork, and how it shows up in the work.
Read the full focus →
Get in touch
Tell us what you run,
and what it handles.
A free 30-minute call. No slides, no sales pressure. You leave with a clear sense of whether we are a fit, and a written proposal within one business day if we are.
Prefer to pick a time now? Book directly on Calendly.