GDPR & Data Protection
1. Introduction
This document provides detailed information about how YUI s.r.o. processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "General Data Protection Regulation" or "GDPR").
This document supplements our Privacy Policy and is intended to provide the comprehensive disclosure required by Articles 13 and 14 GDPR for data subjects whose personal data we collect and process.
2. Data Controller
The data controller responsible for your personal data is:
- Company: YUI s.r.o.
- Country: Slovak Republic
- Email: privacy@yui.sk
- Website: yui.sk
As the data controller, YUI s.r.o. determines the purposes and means of processing your personal data. We are established in the European Union and are directly subject to the GDPR.
3. Categories of Personal Data Processed
Identification and Contact Data
Name, email address, company name, billing address, and account login credentials (email address and hashed password). Collected when you register an account, submit a contact or support form, or place an order.
Transaction and Order Data
Order reference numbers, purchased license types, license keys, invoice details, and payment status. Payment card data is processed exclusively by our payment service providers and is never stored by YUI s.r.o..
Technical and Usage Data
IP address, browser type and version, operating system, device type, pages viewed, referring URLs, and session timestamps. Collected automatically by our servers when you visit the Site.
Support and Communication Data
The content of messages you send us via the contact form, support ticket system, or email, including any attachments or technical details you provide.
Marketing Preferences
Your newsletter subscription status and communication preferences. Collected with your explicit consent when you subscribe.
4. Purposes and Legal Bases for Processing
| Purpose | Categories of Data | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Processing orders and delivering licenses | Identification, transaction, and order data | Art. 6(1)(b) — performance of a contract |
| Managing Client Zone accounts | Identification, transaction, and order data | Art. 6(1)(b) — performance of a contract |
| Responding to contact and support inquiries | Identification, support, and communication data | Art. 6(1)(b) — performance of a contract; Art. 6(1)(f) — legitimate interests |
| Sending transactional emails (confirmations, renewals) | Identification and transaction data | Art. 6(1)(b) — performance of a contract |
| Sending newsletters and product updates | Identification and marketing preference data | Art. 6(1)(a) — consent |
| Maintaining tax and accounting records | Identification and transaction data | Art. 6(1)(c) — legal obligation (Slovak Accounting Act No. 431/2002 Coll.) |
| IT security, fraud prevention, and system integrity | Technical and usage data | Art. 6(1)(f) — legitimate interests |
| Improving the Site using aggregate analytics | Technical and usage data (anonymised) | Art. 6(1)(f) — legitimate interests |
Legitimate Interests Assessment
Where we rely on legitimate interests as a legal basis we have assessed that our interests (operating a secure, functional, and improving service) are not overridden by your interests, rights, or freedoms, taking into account the limited sensitivity of the data processed and the reasonable expectations of individuals using a software licensing service.
5. Recipients and Categories of Recipients
We share your personal data only with the following categories of recipients, each bound by appropriate data processing agreements:
- Payment service providers (Stripe, PayPal/Braintree) — for payment authorisation and fraud prevention.
- Email delivery services — for sending transactional and marketing emails.
- Web and database hosting providers — for operating and storing Site data in the EU.
- Analytics services — for processing anonymised aggregate usage data.
- Competent public authorities — where required by law (e.g. tax authorities, law enforcement acting under lawful order).
We do not sell personal data to any third party, nor do we share it with data brokers or advertising networks.
6. International Transfers
Some of our service providers (notably payment processors) are established outside the European Economic Area (EEA), primarily in the United States. Where we transfer personal data to a third country we ensure at least one of the following safeguards is in place:
- Adequacy decision — the European Commission has determined that the country ensures an adequate level of data protection.
- Standard Contractual Clauses (SCCs) — contracts incorporating the SCCs approved by the European Commission under Article 46(2)(c) GDPR, ensuring your data receives equivalent protection to that it would receive within the EU.
You may request a copy of the applicable safeguards by contacting us at privacy@yui.sk.
7. Retention Periods
| Category of Data | Retention Period | Basis |
|---|---|---|
| Contact and support messages | 24 months from last communication | Legitimate interests (service continuity) |
| Newsletter subscriptions | Until unsubscribe + 30 days | Consent |
| Orders, invoices, and billing records | 10 years | Legal obligation (Slovak Accounting Act) |
| Client Zone account data | Duration of account + 30 days after deletion | Contract; legitimate interests |
| Server logs (IP, access data) | Up to 90 days | Legitimate interests (security) |
After the applicable retention period expires, personal data is either permanently deleted or anonymised so that it can no longer be associated with any individual.
8. Your Rights as a Data Subject
The GDPR grants you a comprehensive set of rights in relation to your personal data. These rights are described in detail below. To exercise any of them, please submit your request to privacy@yui.sk. We will respond within one month of receipt. In complex cases we may extend this period by a further two months, in which case we will notify you of the extension and the reason for it.
Exercising these rights is free of charge. We may charge a reasonable fee or refuse to act if requests are manifestly unfounded or excessive.
Right of Access (Article 15)
You have the right to obtain from us confirmation of whether or not we process personal data about you, and if so, access to that data along with information about the processing purposes, categories of data, recipients, retention periods, and your other rights. You may request a copy of the personal data we hold about you.
Right to Rectification (Article 16)
You have the right to obtain without undue delay the correction of inaccurate personal data or the completion of incomplete personal data we hold about you.
Right to Erasure — "Right to Be Forgotten" (Article 17)
You have the right to request deletion of your personal data where:
- the data is no longer necessary for the purposes for which it was collected;
- you withdraw consent and there is no other legal basis for processing;
- you object to processing and there are no overriding legitimate grounds;
- the data has been unlawfully processed; or
- erasure is required by law.
This right does not apply where processing is necessary for compliance with a legal obligation (for example, retaining invoices for 10 years under Slovak law) or for the establishment, exercise, or defence of legal claims.
Right to Restriction of Processing (Article 18)
You have the right to request that we restrict processing of your data where:
- you contest the accuracy of the data (restriction applies while we verify accuracy);
- processing is unlawful but you prefer restriction to erasure;
- we no longer need the data but you need it for legal claims; or
- you have objected to processing pending verification of our legitimate grounds.
Where processing is restricted we will only store the data and may process it further with your consent or for legal claims, public interest, or protection of others' rights.
Right to Data Portability (Article 20)
Where processing is based on your consent or the performance of a contract and is carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used, machine-readable format (such as JSON or CSV), and to transmit that data to another controller without hindrance from us.
Right to Object (Article 21)
You have the right to object at any time to processing of your personal data based on our legitimate interests (Article 6(1)(f)), including profiling based on those interests. We will stop processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where processing is needed for legal claims.
You have an unconditional right to object to processing of your data for direct marketing purposes, including profiling related to direct marketing. If you object, we will cease processing for that purpose immediately.
Rights Related to Automated Decision-Making (Article 22)
You have the right not to be subject to a decision based solely on automated processing — including profiling — that produces legal effects concerning you or similarly significantly affects you. YUI s.r.o. does not currently conduct any automated decision-making of this nature.
Right to Withdraw Consent (Article 7(3))
Where we process your personal data on the basis of consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. For newsletter subscriptions, you can withdraw consent by clicking the unsubscribe link in any email or by contacting us directly.
9. Right to Lodge a Complaint
If you believe that we have not handled your personal data in accordance with the GDPR, you have the right to lodge a complaint with the supervisory authority in your country of residence or establishment. In the Slovak Republic the supervisory authority is:
- Office for Personal Data Protection of the Slovak Republic
Hraničná 12, 820 07 Bratislava, Slovak Republic
Web: dataprotection.gov.sk
Email: statny.dozor@pdp.gov.sk
If you are located in another EU member state you may also lodge a complaint with the supervisory authority in that state. We would, however, appreciate the opportunity to address your concerns before you approach a supervisory authority.
10. How to Exercise Your Rights
Submit your request by emailing privacy@yui.sk with the subject line "Data Subject Request". Please describe the right you wish to exercise and provide sufficient information to allow us to verify your identity (for example, the email address associated with your account).
We will acknowledge receipt of your request promptly and provide a substantive response within one month. We will not charge a fee for reasonable requests.
11. Updates to This Document
We may update this GDPR Information document from time to time to reflect changes in our data processing activities or applicable law. The "Last updated" date at the top of this page indicates when the most recent revision was made. We encourage you to review this document periodically.