Privacy Notice

HYPES SB UK LTD (the "Company", “we”, “us” or “our”) acts as the data controller for the processing of personal data in connection with recruitment for roles at our UK entity, HR and workforce administration, and enquiries submitted via our website contact forms (including investment enquiries, sales & business enquiries, and other enquiries). We process personal data lawfully, fairly and transparently in accordance with the UK GDPR and the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR)(EU)2016/679. Unless otherwise stated, terms have the meanings given in the UK GDPR and/or the EU GDPR, as applicable. Our contact details (and, where applicable, those of our DPO and EU representative) are set out in the Contact section below.

In relation to certain recruitment, HR and workforce administration, group governance, compliance, security, business development and strategic decision-making activities, we and Reazon Holdings, Inc. (“Reazon Holdings”), our Japanese parent company, jointly determine the purposes and means of the relevant processing and therefore act as joint controllers for those activities.

Categories of personal data we process

We may process the following categories of personal data:

Identification and contact details (e.g., name, postal address, email, phone).
Demographic and professional information (e.g., date of birth, education, employment history, qualifications, professional memberships, current/desired remuneration).
Application materials and communications (e.g., CVs, cover letters, forms, interview notes, correspondence, call recordings where lawful and notified).
Assessment, verification and vetting data (e.g., test results, right-to-work checks, reference responses, background screening results where proportionate and lawful).
Recruitment process metadata (e.g., application/participation history, outcomes).
HR and workforce data: employment, worker, contractor and director records, including contract and role details, work contact details, payroll, tax, benefits and pension information, working time, attendance and leave records, performance, training, disciplinary and grievance records, IT account and access management records, business travel and expense records, emergency contact details, immigration and right-to-work records, health and safety records, and records relating to the start, management and end of the working relationship.
Enquiry details: enquiry type (investment/sales/other), subject and message content, files you upload.
Technical & logs: IP address, device/browser information, language, timestamps, referrer/UTM, user agent and other standard web logs collected by our web and security tools.

Sources of personal data

We obtain personal data:

Directly from you — for example, when you apply for a role or submit a query via our website contact form, and through related communications (emails, calls, meetings, interviews or assessments you choose to participate in).
From third parties where lawful and relevant — for example, recruitment agencies/head-hunters, referral and background/identity verification services in the recruitment context, and professional referral services or event organisers who may legitimately refer your enquiry to us.
From public sources, where appropriate to the purpose — for example, professional networking services for role-related screening, and official company registers or public corporate websites for limited B2B due diligence connected to enquiries you initiate.
From our systems and business records, where relevant — for example, when you work for us or provide services to us, use our IT systems, or otherwise interact with us in the course of our business.
From employees, workers, contractors or directors, where they provide information about dependants, emergency contacts or other individuals where relevant to HR administration, benefits, health and safety or emergency contact purposes.

Where we obtain your personal data from third-party or public sources, we will provide this notice within a reasonable period and, where appropriate, when we first contact you, unless an exemption applies or you already have the relevant information.

Purposes and lawful bases

We process personal data for the following purposes and on the corresponding lawful bases:

Job sourcing and talent pipeline management: To publicise job openings and source potential candidates (e.g., via LinkedIn).
Lawful Basis: Legitimate Interests. PECR compliance (consent) applies for direct electronic marketing.
Application management: To accept and manage job applications, including interview scheduling and communications.
Lawful Basis: Performance of a Contract (pre-contractual) and Legitimate Interests.
Candidate assessment: To assess skills, qualifications, and suitability for roles.
Lawful Basis: Legitimate Interests.
Identity and right-to-work verification: To verify identity and eligibility to work in the UK.
Lawful Basis: Legal Obligation.
Offer and pre-onboarding administration: To manage job offers and necessary pre-onboarding steps.
Lawful Basis: Performance of a Contract (pre-employment) and Legal Obligation.
Diversity monitoring and adjustments: To monitor diversity and make reasonable adjustments.
Lawful Basis: Explicit Consent (due to special category data).
Recruitment analytics and audits: To improve the recruitment process through metrics and audits.
Lawful Basis: Legitimate Interests.
Enquiry handling: To receive and respond to investment, sales, or general enquiries, including using AI-assisted tools to classify enquiries, detect spam, assess response priority and route enquiries to relevant staff.
Lawful Basis: Legitimate Interests.
Pre-contractual business requests: To provide proposals, quotes, or discuss relationships at your request.
Lawful Basis: Performance of a Contract (pre-contractual).
Business collaboration and partnership evaluation: To manage and evaluate potential partnerships.
Lawful Basis: Legitimate Interests.
Strategic growth and outreach: To assess investment enquiries and outreach for mergers or acquisitions.
Lawful Basis: Legitimate Interests.
Mandatory corporate checks: To conduct sanctions or anti-money laundering checks.
Lawful Basis: Legal Obligation and Performance of a Contract (pre-contractual).
Product and service improvement: To conduct interviews, surveys, and trials to improve quality.
Lawful Basis: Legitimate Interests.
Product trials and research management: To manage participation in specific trials or research.
Lawful Basis: Performance of a Contract (pre-contractual/contractual), Consent (marketing), or Explicit Consent (sensitive data/recordings).
Influencer and partner outreach: To explore potential collaborations with influencers and partners.
Lawful Basis: Legitimate Interests and Performance of a Contract (pre-contractual).
Marketing and outreach communications: To send electronic marketing in compliance with PECR.
Lawful Basis: Consent (for individuals) or Opt-out (for corporates).
Security and fraud prevention: To ensure system security and prevent fraud or abuse.
Lawful Basis: Legitimate Interests and Legal Obligation.
Workforce management and HR administration: To manage employment relationships, payroll, benefits, and compliance.
Lawful Basis: Performance of a Contract, Legal Obligation, and Legitimate Interests.
Group governance and strategic decision-making: To support internal reporting, governance, and planning between entities.
Lawful Basis: Legitimate Interests and Legal Obligation.

Recipients (disclosures)

We share personal data, where necessary and proportionate, with:

Group entities, including Reazon Holdings, involved in the relevant recruitment, HR and workforce administration, group governance, compliance, security, business development, strategic decision-making or enquiry handling. For the processing activities for which we and Reazon Holdings jointly determine the purposes and means, Reazon Holdings acts as a joint controller. Other group entities may act as our processors or independent controllers depending on their role in the relevant processing.
Service providers acting as our processors under Article 28 (with appropriate contractual and security safeguards), including providers of hosting and infrastructure, communications and collaboration tools, applicant-tracking/assessment platforms, identity and right-to-work verification, customer/support and case-management systems, AI service providers and API intermediaries supporting enquiry classification, spam detection and prioritisation, HR information systems, payroll, benefits, pension, insurance, occupational health, analytics/consent-management, and related IT support. Our processors may engage approved sub-processors subject to equivalent safeguards.
Referral and verification/background-screening services (where relevant and lawful), as well as professional advisers (e.g., legal, compliance, audit, insurance) and financial or corporate advisers supporting our business operations.
Public or judicial authorities, regulators, tax authorities, law enforcement bodies, immigration authorities and other public authorities where required by law or to protect rights, safety, security, or the integrity of our website, systems or business.
Other recipients at your direction or with your consent.

We do not sell your personal data, and we do not share it with third parties for their own direct marketing.

Joint controllers

Where we and Reazon Holdings act as joint controllers, we have put in place an arrangement that sets out our respective responsibilities for compliance with applicable data protection laws. In general, we are responsible for providing this notice, acting as the primary contact point for individuals in the UK and EEA, and coordinating responses to data subject rights requests, while Reazon Holdings is responsible for the processing activities and decisions it undertakes as part of group-level governance, recruitment, HR and workforce administration, compliance, security, business development and strategic decision-making.

You may exercise your data protection rights against either joint controller. For convenience, you may contact us using the details in the Contact section below. We will make the essence of the relevant joint controller arrangement available to you where required by applicable law.

International Data Transfers

Your personal data may be transferred outside the UK (and, if relevant, outside the EEA). This may include transfers to Reazon Holdings where it is involved in the processing activities described in this notice. Where we do so, we rely on:

UK adequacy regulations where available (e.g., Japan—partial adequacy; US recipients certified under the UK-US Data Bridge), or
Appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and apply supplementary measures as needed.

Details are available on request.

Special category data and criminal offence data

We process special category data (e.g., health data for reasonable adjustments) only where strictly necessary and where a relevant Article 9 UK GDPR condition applies—typically Article 9(2)(b) (employment, social security and social protection) and/or 9(2)(h) (occupational health). Where required by the DPA 2018 Schedule 1, we maintain an Appropriate Policy Document (APD) setting out safeguards, retention and access controls. If processing is genuinely optional and no relevant condition applies, we will seek your explicit consent.

For criminal convictions and offences data, we process only where permitted by Article 10 UK GDPR together with a relevant Schedule 1 condition and appropriate safeguards.

Automated decision-making

We do not make decisions solely on automated processing (including profiling) that produce legal effects or similarly significantly affect you. If we introduce such processing, we will inform you in advance and implement the Article 22 safeguards (including the right to obtain human review and to contest the decision).

Retention of Data

We store the personal data we collect as described in this notice for as long as you engage with the Company, necessary to fulfill the purpose(s) for which it was collected, provide our services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws. The specific retention period is determined based on the purpose of acquisition and processing, the nature of the personal data, and its necessity for legal or business grounds.

Your Rights (subject to applicable law)

You may exercise the following rights by contacting us or a representative or data protection officer. If you request to exercise the following rights, please contact us as set out in the Contact section below.

Right of access: You have the right to obtain confirmation as to whether we process personal data about you and, where that is the case, access to such personal data and certain information about our processing.
Right to rectification: You have the right to have inaccurate personal data corrected without undue delay and to have incomplete data completed.
Right to erasure: You may obtain the erasure of your personal data, subject to certain exceptions under the GDPR, where: (i) such personal data is no longer necessary in relation to the purposes for which we collected and processed it; (ii) you withdraw your consent to our processing solely based upon your consent; (iii) you object to our processing and there are no overriding legitimate grounds for such processing; (iv) our processing is unlawful; (v) your personal data has to be erased in compliance with a legal obligation.
Right to restriction of processing: You may obtain restriction of processing of your personal data, subject to certain exceptions under the GDPR, where: (i) you contest the accuracy of your personal data: (ii) our processing is unlawful and you select to restrict our processing instead of requesting erasure of your personal data: (iii) you request us to establish, exercise or defense legal claims that need your personal data no longer necessary for the purposes of our processing; or (iv) you exercise the right to object to our processing and wait for verification on where we have overriding legitimate grounds.
Right to data portability: Where processing is based on your consent or a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to have that data transmitted to another controller where technically feasible.
Right to object: You may object to the processing of your personal data where our processing is based upon the exercise of our official authority or our legitimate interests, including “profiling” or for direct marketing purposes. You may also object at any time to processing for direct marketing, including related profiling; in that case we will stop processing for such purposes.
Rights related to automated decision-making (including profiling): You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you, and to obtain human intervention, express your point of view, and contest the decision, subject to applicable exceptions.
Right to the withdrawal of your consent: You may withdraw your consent at any time to the processing of your personal data that we have collected about you. The lawfulness of processing based on consent before its withdrawal will not be affected. Withdrawal of consent does not affect processing that is carried out on other lawful grounds, and we will inform you if certain services or recruitment steps can no longer be provided without your consent.
Right to lodge a complaint: You may make a data protection complaint to us as described in the section “Data protection complaints” below. You also have the right to lodge a complaint with a data protection supervisory authority. Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority. In the EU, you may complain in the Member State of your habitual residence, place of work, or place of the alleged infringement. In the United Kingdom, you may complain to the Information Commissioner’s Office (ICO). The supervisory authority (or the ICO) will inform you of the progress and outcome of the complaint, including the possibility of a judicial remedy.

Data protection complaints

If you have a concern or complaint about how we handle personal data, or if you believe that we have not complied with applicable data protection law, you may make a data protection complaint to us using the Contact details below or any other reasonable method through which you contact us. You do not need to use legal terminology or refer to specific laws.

We may ask you for information that is reasonably necessary to understand your complaint, verify your identity or authority to act on behalf of another individual, and investigate the matter. This does not affect your right to lodge a complaint with the ICO or another relevant supervisory authority.

We will acknowledge receipt of your data protection complaint within 30 days of receiving it, investigate it without undue delay, keep you informed of the progress of our investigation without undue delay, and tell you the outcome of the complaint without undue delay once our investigation is complete.

If your complaint relates to processing carried out jointly with Reazon Holdings, we will coordinate with it as appropriate in accordance with our joint controller arrangement.

Requirement to provide data

Provision of certain personal data may be a statutory or contractual requirement, or necessary to enter into or perform a contract, or otherwise necessary for the purposes set out in this notice. Where we indicate that provision of particular data is mandatory, failure to provide it may mean we are unable to proceed or fulfil the relevant request. We will indicate where information is mandatory.

Contact

If you have any questions about our privacy practices or this notice, wish to make a data protection complaint, or to exercise your rights as detailed in this notice, please contact us at:

HYPES SB UK LTD
Address: Suite A, 82 James Carter Road, Mildenhall, United Kingdom, IP28 7DE
Email: privacy@hypes-bet.com

Where we and Reazon Holdings act as joint controllers, you may contact either controller. For convenience, we act as the primary contact point for data protection enquiries, rights requests and data protection complaints in relation to the processing described in this notice.

Joint controller: Reazon Holdings, Inc.
Address: 1-6-1 Yotsuya (YOTSUYA TOWER), Shinjuku-ku, Tokyo 160-0004, Japan
Email: privacy@reazon.jp

For EU data subjects, you can contact our EU representative at:
Name: Classmethod (Europe) GmbH
Email: rh@gdpr-contact.email

Data Protection Officer (DPO) Contact
For any data protection inquiries, you may also contact our Data Protection Officer.
Email: dpo@hypes-bet.com

Data Protection Authority
You can also raise a concern or lodge a complaint with the relevant data protection authority or other official with jurisdiction in your country or region of residence.

If you are in the UK, you may lodge a complaint with the Information Commissioner’s Office (ICO).

Cookies and Similar Technologies

We use Google reCAPTCHA Enterprise to protect our contact form against spam and automated abuse. It uses the strictly necessary _GRECAPTCHA cookie on www.recaptcha.net for security risk analysis. The cookie expires after 180 days, with this period renewed each time reCAPTCHA is used. Google processes related browser and device information on our behalf.

Changes To This Notice

The Company will strive to make appropriate improvements to this notice. The Company may change this notice without notifying individuals. Unless otherwise specified by the Company, the revised notice will take effect from the time it is posted on this website.

Established: September 18, 2025
Last updated: October 19, 2026