01Who is responsible
YLNMN is the data controller for personal data collected through this website and in the course of selling and delivering our services. For the marketing data we handle inside a client's systems during an engagement, the client is the controller and we act as a processor on their instructions (see section 05).
02What we collect
| When | What | Source |
|---|---|---|
| You fill in a form | Name, work email, company stage or topic, anything you type in a message | You |
| You email or book a call | Your email address, name, employer, call notes | You |
| We work together | Contact details of your team, invoicing details, meeting notes, project correspondence | You and your team |
| You visit the site | Aggregated, anonymised page views and referrers. No IP addresses are stored. | Your browser |
We do not collect special-category data, and we ask you not to send it to us.
03Why, and on what basis
- To answer you and scope work when you contact us. Legal basis: steps taken at your request before entering a contract.
- To deliver and invoice an engagement. Legal basis: performance of a contract.
- To keep accounting records. Legal basis: legal obligation.
- To send occasional notes about our work to past and present clients who have not opted out. Legal basis: legitimate interest. Every email has an unsubscribe link and we stop at once if you ask.
- To understand which pages are read. Legal basis: legitimate interest, using anonymised data only.
We do not use personal data for automated decision-making or profiling, and we never sell it.
04Cookies and analytics
This website sets no tracking cookies and uses no advertising pixels. Our analytics are cookieless and aggregated: we can see that a page was viewed and roughly where the visitor came from, not who the visitor was. The only storage the site uses is the browser's own, for things like remembering a form you have not sent yet, and it never leaves your device.
05Client data we process for you
During an engagement we often work inside a client's CRM, analytics, email and advertising tools, and for LinkedIn management inside a client's LinkedIn account. That data belongs to the client. We process it only on the client's documented instructions, only for the engagement, and under a data processing agreement that forms part of our proposal. We never copy client customer data to our own systems beyond what is needed to do the work, and we delete working copies when the engagement ends.
06Who we share data with
We share personal data only with service providers who help us run the business, each under a contract that limits what they can do with it:
- Email and calendar hosting
- Our CRM and project management tool
- Invoicing and payment processing (card details go directly to the payment processor and never touch our systems)
- Cookieless website analytics
- Accountants and, where required, legal advisers
We will disclose data where the law requires it. We do not share data with advertisers or data brokers.
07International transfers
Our team and some of our providers are in different countries. Where personal data moves across borders, we rely on recognised safeguards such as adequacy decisions or standard contractual clauses, and we choose providers that commit to them.
08How long we keep data
| Data | Kept for |
|---|---|
| Enquiries that don't become engagements | 12 months after our last exchange |
| Client correspondence and project files | 3 years after the engagement ends |
| Invoices and accounting records | As long as tax law requires, typically 7 years |
| Working copies of client data | Deleted at the end of the engagement |
| Website analytics | Aggregated only, no personal data retained |
09Security
We use unique credentials and two-factor authentication on every tool, encrypted devices, least-privilege access to client systems, and we review who has access to what every quarter. No system is perfectly secure. If we ever become aware of a breach affecting your data, we will tell you without undue delay and, where required, notify the relevant authority.
10Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent where we rely on it. To exercise any of these, email us. We answer within 30 days and we don't charge for it. You also have the right to complain to your data protection authority, though we'd appreciate the chance to put things right first.
11Changes and contact
We'll post any changes to this policy here with a new effective date, and tell current clients directly if a change affects them. Privacy questions and requests go to hello@ylnmn.com with "Privacy" in the subject line.