Data-protection-first
On data-sensitive builds a DPIA comes before the first line of code: what data, why, for how long. A clear UK GDPR lawful basis on every form.
THE WORK
Local-business sites
·
Verification infrastructure
·
Data-protection systems
·
Cyber & AI governance
Booking discovery calls
Digital products for small UK ventures, compliant by default.
bygild builds the product and the part most studios skip: the data. Privacy, consent, and security designed in from the first line of code, not bolted on after launch.
From local-business sites to verification infrastructure. Hand-coded, UK-hosted, plain English.
Data-first
DPIA before code on sensitive builds
Hand-coded
No templates
UK-hosted
Built to UK GDPR
Featured build
KeyProof: the proof layer for car hire.
keyproof.co.uk · Verification infrastructure · bygild is the build partner
Verification infrastructure for UK car-hire firms, and the software that runs the hire on top of it. Before every handover the hirer opens one link: identity verification, a DVLA licence share code the firm checks on gov.uk, an e-signed rental agreement, and timestamped photos of the car's condition, all landing in one record the firm can hand to an insurer. Behind that record sits the operator's day: bookings, an availability calendar, the money owed on each hire, fines tied back to the hirer, and a record of every customer. Scoped data-protection-first, with a DPIA before the first line of code.
- Identity verification, DVLA licence share code, e-signed agreement
- Third-party identity provider: raw ID never sits in the platform
- Timestamped condition photos, before and after, in one record
- Deposits held on the firm's own Stripe: KeyProof never holds the money
- Bookings, calendar, money, fines and customer records in one portal
- DPIA-first scope, UK GDPR lawful basis, minimal retention
More work
Also live: Noor Hair & Beauty and the Vertex Tutors reference build.
See all work →
How every build ships
The governance layer is the point.
Most studios ship the product and leave the data as someone else's problem. These six standards apply to every bygild build, from a local-business site to verification infrastructure.
GDPR-aware by default
Consent banners, data-retention policy, subject-access-ready forms. A Schedule 1 Article 28 DPA drawn up for every engagement that touches client data.
Hold less, risk less
Data minimisation as a design rule. On KeyProof, identity is verified by a specialist third party so raw ID documents never sit in the platform at all.
UK-based, UK-hosted
A UK-registered host, UK GDPR by design, and every data processor named in the privacy policy.
Accessibility as standard
WCAG 2.1 AA contrast, keyboard navigation, screen-reader labels on every build.
No platform lock-in
Domain, hosting, source code are yours. Full source-code transfer on final payment.
Current focus
Cyber and AI governance.
The same governance work that ships inside every build, taken seriously as a practice in its own right. Everything below is authored in-house and in use today.
Data protection, engineered
The regulatory groundwork applied to every build: a UK GDPR Article 28 Data Processing Agreement, PECR Regulation 22(2) consent records, and GDPR Article 13 transparency notices.
Retention enforced in code
A 90-day PII anonymisation routine enforces the retention policy automatically. Deletion windows run on a schedule, not on someone remembering to clear a folder.
AI governance for small firms
bygild maintains an AI Governance and Acceptable Use Policy mapped to the EU AI Act risk tiers, the NIST AI Risk Management Framework, and ISO/IEC 42001.
Built for firms with no compliance desk
The practice is being built out for UK SMEs that use AI but have no compliance function. Evidence systems and infrastructure, never legal advice.
The practice
The standards, the authored groundwork, and how it shows up in the work.
Read the full focus →
Get in touch
Tell us what you run,
and what it handles.
A free 30-minute call. No slides, no sales pressure. You leave with a clear sense of whether we are a fit, and a written proposal within one business day if we are.
Prefer to pick a time now? Book directly on Calendly.