Privacy Policy
Last updated: 28/10/2026
1. Who we are
KR1 plc ("KR1", "we", "us", "our") is the controller of the personal data described in this policy. We decide why and how it is used.
- Registered office: First Names House, Victoria Road, Douglas, Isle of Man, IM2 4DF
- Company number: 015310V
- Website:
We have appointed a Data Protection Lead (DPL) who is responsible for overseeing how we handle personal data. You can contact the DPL at with any question about this policy or your data.
2. What this policy covers
This policy covers personal data collected through our website and related online interactions, including investor presentation requests, investor communications, newsletter subscriptions, contact forms and other features we may introduce from time to time. It also explains how we use technical information to maintain, secure and improve our website.
Where we collect personal data for a new purpose, we will assess the applicable legal requirements and provide any additional information or choices required before starting that processing.
KR1 plc processes personal data in accordance with the Isle of Man's data protection legislation, including the Data Protection Act 2018 and the Data Protection (Application of GDPR) Order 2018, as applicable. Where our processing falls within the territorial scope of UK data protection law, we also comply with the UK GDPR, the UK Data Protection Act 2018 and other applicable UK data protection requirements.
3. Information we collect
We collect the information you give us through our forms, technical information needed to run and protect our website, and analytics information if you allow analytics cookies.
When you visit our website, our hosting and security providers process limited technical information to deliver and protect it. This may include your IP address, the date and time of your request, browser and device information, and security logs. We use this information to keep the website working, secure and free of faults.
Analytics information, such as pages visited, time spent on pages and how you arrived at our site, is collected only if you accept analytics cookies through our cookie banner.
We also count page views and measure page speed with Vercel Web Analytics and Speed Insights. These use no cookies and give us aggregated figures that cannot follow you across other websites.
| When | Information collected |
|---|---|
| Any visit to our website | IP address, date and time of request, browser and device information, security logs |
| Investor presentation request: institutional investor | Full name, email address, company, role, investor type |
| Investor presentation request: retail investor | Full name, email address |
| Both presentation forms | Your choice about receiving updates, the date and time of your request, and the version of the wording you saw |
| Emails we send you | Whether an unsubscribe request was sent |
| Contact form | Name, email address and your message |
| Booking a call | Name, email address and any details you add when booking, collected by Cal.com |
| Website visits, only if you accept analytics cookies | Pages visited, time on page, approximate location (country or city), device and browser type, how you arrived at our site |
We do not ask for, and you should not give us, sensitive information such as health, political or religious data.
4. How we use your information and our lawful basis
We use your information only for the purposes below. Data protection law requires us to name a lawful basis for each one.
| Purpose | Who it applies to | Lawful basis |
|---|---|---|
| Sending you the investor presentation you requested | Everyone who submits a form | Legitimate interests: responding to your request |
| Sending occasional updates about KR1 plc, such as results, presentations and events | Anyone who ticks "Keep me updated about KR1 plc by email" on the presentation form | Consent. You can withdraw it at any time |
| Using your company, role and investor type to decide which updates are relevant to you | Institutional investors who asked for updates | Legitimate interests: sending relevant information rather than everything |
| Replying to your enquiry, or arranging a call you booked | Anyone who uses our contact form or books a call | Legitimate interests: answering the people who contact us |
| Keeping a record of your choices and a list of people who have unsubscribed | Everyone who submits a form | Legal obligation: showing we respect your choices |
| Understanding how visitors use our website so we can improve it | Visitors who accept analytics cookies | Consent, given through our cookie banner |
| Meeting legal and regulatory duties, responding to requests and defending legal claims | Anyone whose data we hold | Legal obligation and legitimate interests |
| Delivering, securing and troubleshooting our website, including server logs and cookieless visit and performance statistics | Everyone who visits the website | Legitimate interests: keeping the website working and secure |
Where we rely on legitimate interests, we have assessed that our interests do not override your rights. You can ask the DPL for details of that assessment.
We do not sell your personal data. We do not make decisions about you based solely on automated processing.
5. Investor updates and your choices
You can stop receiving updates from us at any time, free of charge.
- Unsubscribe link: every update we send includes one.
- By email: write to and ask to be removed.
If you unsubscribe, we keep your email address on a suppression list so we never contact you again by mistake. Unsubscribing does not affect your access to the presentation. Regulatory announcements remain available to everyone through RNS and our website.
6. Cookies and analytics
This section summarises how we use cookies. Our lists every cookie in full. Apart from strictly necessary cookies, nothing is set until you accept it in our cookie banner. We manage your choices through Termly. You can change them at any time with the Consent Preferences link at the bottom of every page, or by clearing cookies in your browser. Refusing non-essential cookies does not affect your use of the website.
Cookies we set
| Cookie | Type | Purpose | Lasts |
|---|---|---|---|
| Termly consent record | Strictly necessary | Remembers your cookie choices | 12 months |
| kr1-important-information | Strictly necessary | Remembers that you accepted the “Important Information notice” on our holdings page | 90 days |
| _ga, _ga_[ID] (Google Analytics) | Analytics, needs your consent | Counts visits and shows which pages are used, so we can improve the site | Up to 2 years |
Cookies set by our newsletter box
Our newsletter sign-up box is provided by Substack. When it loads, Substack and the services it uses set the cookies below, so we load it only after you accept non-essential cookies. Substack decides what these cookies collect and how long they last. See and .
| Type | Cookies | Set by | Purpose |
|---|---|---|---|
| Strictly necessary for the box | AWSALBTG, AWSALBTGCORS, __cf_bm | Substack's hosting (Amazon Web Services, Cloudflare) | Keeps the box working and blocks automated bots |
| Analytics | ajs_anonymous_id, mp_[ID]_perfalytics, visit_id, session_attribution, ab_testing_id, substack_ref, substack_ref_url, cookie_storage_key | Substack, with Segment and Mixpanel | Substack's measurement of how its sign-up box is used |
| Advertising | _gcl_ls, test_cookie, a numbered cookie on google.com | Advertising measurement |
We do not use advertising cookies ourselves.
Cookies set by other embedded services
Two other services embedded in our website set strictly necessary cookies so that they work. They load without asking because they cannot work without these cookies.
| Service | Cookies | Type | Purpose |
|---|---|---|---|
| BrighterIR (announcements and share price on our Investors pages) | AWSALB, AWSALBCORS, laravel_session, XSRF-TOKEN | Strictly necessary | Keeps the feed working, balances traffic between servers and protects against forged requests |
| Cal.com (booking calendar on our Request a Call page) | __cf_bm | Strictly necessary | Blocks automated bots. Lasts 30 minutes |
7. Who we share your information with
We share your information with service providers who act on our instructions under a written contract, and in the limited cases set out below. Service providers may not use your information for their own purposes.
We may use service providers to host and maintain our website, process forms, send communications, provide analytics, manage cookie preferences, maintain security and support our business operations. Where a provider processes personal data on our behalf, we require it to act on our documented instructions and protect the data in accordance with applicable data protection requirements.
Some third-party services, including newsletter or other embedded services, may process personal data as independent controllers under their own privacy notices. Where this applies, the relevant provider's own terms and privacy information will govern its independent processing. We will provide information about these arrangements where required by law.
| Provider | What they do for us | Location |
|---|---|---|
| Resend (Plus Five Five, Inc.) | Delivers each presentation request from our website to our investor relations mailbox | United States |
| Provides Google Analytics, only if you accept analytics cookies | Ireland and United States | |
| Termly, Inc. | Runs our cookie banner and records your cookie choices | United States |
| Vercel Inc. | Hosts our website, processes form submissions as they are sent, and provides cookieless visit and performance statistics (Vercel Web Analytics and Speed Insights) | United States |
| Formspree, Inc. | Delivers messages sent through our contact form to us by email | United States |
| Cal.com, Inc. | Runs the booking calendar on our Request a Call page and passes your booking details to us | European Union |
| BrighterIR | Provides the announcements and share price feed on our Investors pages | United Kingdom |
Our newsletter sign-up box is provided by Substack. If you subscribe there, Substack collects your email address under its own privacy policy and acts as a separate controller. The box also sets Substack's own cookies, listed in section 6.
We may also disclose personal data where reasonably necessary to comply with applicable laws, regulations, court orders or lawful requests from competent authorities; obtain professional advice; establish, exercise or defend legal claims; investigate suspected fraud or unlawful activity; or protect the rights, property, security or legal interests of KR1, our personnel, investors or other persons, subject to applicable law.
Within KR1, access to investor contact details is limited to the staff who manage investor communications.
8. International transfers
Some of our service providers are based in the United States, so your information may be processed there. Where a country has not been recognised as giving adequate protection, we use one of these safeguards:
- standard contractual clauses approved for transfers from the Isle of Man, the UK or the EU, including the UK International Data Transfer Addendum; or
- the UK Extension to the EU–US Data Privacy Framework, where the provider is certified under it.
You can ask the DPL for a copy of the safeguards that apply to your information.
9. How long we keep your information
We keep your information only as long as we need it for the purposes above, then delete it.
| Information | How long we keep it |
|---|---|
| Contact details of people receiving updates | Until you unsubscribe, or 24 months after you last opened or clicked one of our emails, whichever is sooner |
| Contact details of people who requested the presentation only | 12 months from your request |
| Record of your choice about updates | As long as we hold your contact details, plus 2 years |
| Suppression list (unsubscribed email addresses only) | Indefinitely, so we never contact you again |
| Contact form messages and call bookings | For a maximum of 24 months from the date of your last interaction or completed booking. |
| Google Analytics data | 14 months |
| Cookie consent records | 12 months, or until you change your choice |
10. How we protect your information
We use technical and organisational measures suited to the information we hold, including:
- encrypted connections (HTTPS) for our website and forms; and
- sending updates so that recipients cannot see each other's email addresses.
If a breach affecting your information is likely to put your rights at high risk, we will tell you and the relevant regulator as the law requires.
No method of transmission over the internet or electronic storage is completely secure. We take appropriate technical and organisational measures to protect personal data, but cannot guarantee absolute security. We regularly review our safeguards in light of the nature of the data, the risks involved and developments in our systems and services.
11. Your rights
You have the following rights over your personal data. To use any of them, email the DPL at . We may ask you to confirm your identity, and we will reply within one month. If your request is complex, we may extend this by up to two further months and will tell you within the first month.
- Access: ask for a copy of the information we hold about you.
- Correction: ask us to fix anything inaccurate or incomplete.
- Erasure: ask us to delete your information where we no longer need it.
- Restriction: ask us to pause using your information while a concern is resolved.
- Objection: object to our use of your information based on legitimate interests. You can object to direct marketing at any time, and we will always stop.
- Portability: ask for information you gave us in a machine-readable format.
- Withdraw consent: where we rely on consent, withdraw it at any time. This does not affect anything we did before.
Complaints
Please contact the DPL first so we can try to resolve your concern. You also have the right to complain to a data protection regulator:
- Isle of Man Information Commissioner: , , +44 1624 693260
- UK Information Commissioner's Office (ICO): , if you are in the UK
12. Changes to this policy
We review this policy at least once a year and whenever we change how we use personal data. The date at the top shows when it was last updated. If a change significantly affects how we use your information, we will tell you before it takes effect.
We may update this policy to reflect changes in our business, website functionality, service providers, data processing activities or applicable law. The latest version will be published on our website with its updated date. Where a change materially affects how we use personal data, we will provide any notice or seek any consent required by law before the change takes effect.
Contact: Data Protection Lead, KR1 plc, First Names House, Victoria Road, Douglas, Isle of Man, IM2 4DF, or .