Privacy policy

Data we may process

Purposes and legal bases

• Service delivery, security and troubleshooting: our legitimate interests in operating a reliable and secure public service under Article 6(1)(f) GDPR.
• Responding to general enquiries: our legitimate interests under Article 6(1)(f) GDPR.
• Responding to a request made before a possible contract: Article 6(1)(b) GDPR where applicable.
• Accounting, compliance and legal claims: Article 6(1)(c) GDPR or our legitimate interests under Article 6(1)(f), as applicable.

Service providers and transfers

We use Vercel for hosting and request delivery, Supabase in the EU Central region for the reviewed public data backend, and Google Workspace for company email. These providers and their authorised subprocessors may receive personal data only for the services they provide to us.

Where a provider processes data outside the European Economic Area, the transfer must rely on an applicable adequacy decision, Standard Contractual Clauses or another lawful transfer safeguard.

Retention

Technical records are kept only for the configured provider periods and as long as needed for security and troubleshooting. Email correspondence is kept only as long as needed to answer the enquiry, maintain an appropriate business record, comply with law or establish, exercise or defend legal claims. We delete or anonymise data when those purposes no longer apply.

Your rights

Subject to the conditions in the GDPR, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. If processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.

Send a privacy request to contact@yoofloe.com. You may also lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.