Legal

Privacy Notice

What personal data we collect when you use this website or start a free trial, why we collect it, who processes it on our behalf, how long we keep it, and what you can ask us to do about it.

In effect since

Who is responsible

Ydntfy BV (in oprichting) De Bocht 62440 GeelBelgium privacy@ydntfy.com

Ydntfy BV (in oprichting) decides why and how the personal data described in this notice is processed. In the language of the GDPR, we are the controller.

The company is in oprichting — in formation. Until incorporation is complete it has no separate legal personality, and the founders are personally bound by the commitments made here. We will update this section, and add the company and VAT numbers, once the deed is passed.

We have not appointed a Data Protection Officer, and we are not required to: we are not a public authority, we do not monitor people systematically on a large scale, and we do not process special categories of data. Write to the address above and a founder will read it.

What we collect, and why

Everything we do with personal data as controller — on this website, and when you start a free trial — is listed below. If a purpose is not on this list, we are not pursuing it. Personal data that a customer puts inside their own workspace is a separate matter: there we act as a processor on that customer's instructions, and our Data Processing Agreement governs it rather than this notice.

Starting a free trial

What we collect
Your name, work email address and company name; the workspace address you asked for; the language you were reading in; and the version of the trial terms you accepted together with the moment you accepted them. We also record the IP address and browser user-agent the request came from.
Why
To confirm the email address is yours, to create and set up your evaluation workspace, to keep a record of which terms you agreed to, and to stop the form being used for automated or abusive sign-ups.
Legal basis
Article 6(1)(b): steps taken at your request before entering into a contract, and then performance of the trial agreement itself. For the IP address and user-agent, Article 6(1)(f), our legitimate interest in keeping the sign-up form from being abused — which is why we limit how often it can be used from one address, one email and one email domain.
Who processes it
Amazon Web Services, which hosts the platform and delivers the confirmation email, acting as our processor.
Transfers outside the EEA
None. The platform and its database run in Amazon's Ireland region.
How long we keep it
If you never confirm the email address, the request expires after 24 hours and is deleted 30 days later. If the workspace is created, the record is kept for as long as the workspace exists; when the workspace is deleted — 90 days after the trial starts, unless you convert to a subscription — we strip your name, address, company and the technical details out of it and keep only the fact that a trial was started, which version of the terms was accepted, and when. We keep that last part because it is the evidence of what was agreed.

Booking a demo

What we collect
Your name, email address, time zone, the meeting time, and anything you choose to type into the booking form.
Why
To schedule, hold and follow up on the meeting you asked us for.
Legal basis
Article 6(1)(b): steps taken at your request before entering into a contract. Booking a demo is voluntary, and nothing else on this site depends on it.
Who processes it
Calendly, LLC, acting as our processor under its data processing addendum. We link out to Calendly rather than embedding it in our pages, so nothing reaches Calendly unless you click through.
Transfers outside the EEA
Yes, to the United States. Calendly states that it relies on the EU–U.S. Data Privacy Framework, the Standard Contractual Clauses and the UK Addendum.
How long we keep it
24 months after our last contact with you. If you become a customer, the data moves into the contractual relationship and is kept for as long as that lasts.

The contact form

What we collect
Your name, work email address, company, your message, and which language version of the site you were reading. We do not record your IP address.
Why
To read your message and reply to it. Nothing else: you are not added to a mailing list.
Legal basis
Article 6(1)(f), our legitimate interest in answering people who write to us — or Article 6(1)(b) where your message concerns a possible contract. Sending the form is voluntary; you can email us instead.
Who processes it
Amazon Web Services, which runs the function that receives the form and the service that turns it into an email, and Microsoft, which hosts the mailbox that email lands in. Both act as our processors.
Transfers outside the EEA
The function and the email service run in Amazon's Ireland region. Mail in a Microsoft 365 mailbox may be processed outside the EEA under the Standard Contractual Clauses in Microsoft's data protection addendum.
How long we keep it
The email is deleted from the mailbox 24 months after our last exchange with you. The function itself stores nothing; its logs record only whether a message was sent, never its contents, and are deleted after 30 days.

Analytics

What we collect
Aggregate statistics: which pages were read, the referring site, country, browser and device type. No cookies are set and nothing is stored on or read from your device.
Why
To understand which pages are read, so that we can write better ones.
Legal basis
Article 6(1)(f), our legitimate interest in understanding how our own website is used. Because nothing is stored on or read from your device, no consent is required and this site has no cookie banner.
Who processes it
Plausible Insights OÜ (Estonia), acting as our processor on its EU-hosted plan.
Transfers outside the EEA
None. The data stays in the European Union.
How long we keep it
Your IP address is used momentarily to derive a country and is never stored. What remains is aggregate counts that cannot be traced back to a visitor, and we keep those indefinitely.

Hosting

What we collect
To send you a page, our content delivery network necessarily sees your IP address, the address of the page you asked for, the time, and your browser's user-agent string.
Why
To deliver the website, and to withstand attack and abuse.
Legal basis
Article 6(1)(f), our legitimate interest in running a website that works and is not abused.
Who processes it
Amazon Web Services, acting as our processor.
Transfers outside the EEA
Pages are served from whichever of Amazon's European or North American edge locations is nearest to you.
How long we keep it
We do not switch access logging on, so no record of your request is written down anywhere. Amazon sees the request in order to answer it, and that is all.

Cookies and local storage

We set no advertising cookies and no tracking cookies. Your browser may keep your language preference so the site opens in the language you last chose; that stays on your device and is never sent to us.

Our cookie policy describes this in full, and is the place we will update first if it ever changes.

Cookie Policy

Your rights

You may ask us for a copy of the personal data we hold about you, to correct it, to erase it, to restrict what we do with it, or to receive it in a portable form. Write to the address above. We will answer within one month.

Where we rely on legitimate interest — the contact form, analytics and hosting — you have the right to object to that processing at any time, on grounds relating to your particular situation. If you object we will stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

We do not rely on your consent for anything on this website, so there is no consent for you to withdraw. Nothing here is a statutory or contractual requirement either: you are free to read every page without giving us anything.

There is no automated decision-making and no profiling.

Changes to this notice

We will publish any change on this page and move the effective date at the top. Where a change materially affects people whose data we already hold, we will tell them directly rather than waiting to be read.

Complaints

If you think we have mishandled your personal data, please tell us first — we would rather fix it. You may also lodge a complaint with the Belgian supervisory authority, or with the authority in the country where you live or work:

Gegevensbeschermingsautoriteit / Autorité de protection des données Drukpersstraat 351000 BrusselBelgium contact@apd-gba.be www.gegevensbeschermingsautoriteit.be

This notice is published in English, French, German, Spanish and Italian. Where the versions differ, the English text prevails.