Privacy Policy
1. Who We Are
This Privacy Policy describes how YUI s.r.o. ("we", "us", "our") collects, uses, and protects personal data when you visit yui.sk and its subdomains (the "Site"), contact us, purchase a yStore license, or subscribe to our newsletter.
YUI s.r.o. is the data controller for the personal data described in this policy. We are based in the Slovak Republic and are subject to Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and applicable Slovak data protection law.
If you have any questions about this policy, contact us at privacy@yui.sk.
2. Personal Data We Collect
Website Visitors
When you browse the Site our web server automatically records your IP address, browser type, operating system, referring URL, pages visited, and timestamps. This data is used solely to keep the Site operational and secure and is not used to identify individual users.
Contact and Support Inquiries
When you submit a contact or support form we collect your name, work email address, company name (if provided), and the content of your message. We use this data exclusively to respond to your inquiry.
Newsletter Subscribers
When you subscribe to our newsletter we store your email address and the date of subscription. You can unsubscribe at any time via the link included in every email.
Customers and Licensees
When you purchase a yStore license or add-on plugin we collect your name, email address, company name (if provided), billing address, and order details. Payment card data is processed exclusively by our payment service providers — we never store card numbers, CVV codes, or other sensitive payment credentials on our servers.
Client Zone Accounts
If you register a Client Zone account we store your email address, a hashed password, your license keys, order history, and any support tickets you open. You can request deletion of your account at any time.
3. How We Use Your Data
- To respond to contact and support requests submitted through the Site.
- To process orders, deliver license keys, and manage your Client Zone account.
- To send transactional emails including order confirmations, license delivery, and renewal reminders.
- To send our newsletter and product updates, where you have subscribed.
- To analyse aggregate Site usage in order to improve content and performance.
- To detect, prevent, and respond to fraud, abuse, and security incidents.
- To comply with legal obligations, including Slovak tax and accounting requirements.
We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.
4. Legal Bases for Processing
We process your personal data on the following legal bases under Article 6 GDPR:
- Performance of a contract (Art. 6(1)(b)) — processing orders, delivering licenses, and managing your account.
- Legitimate interests (Art. 6(1)(f)) — operating and improving the Site, fraud prevention, and IT security. We have assessed that our legitimate interests are not overridden by your rights and freedoms.
- Consent (Art. 6(1)(a)) — sending newsletters and marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
- Legal obligation (Art. 6(1)(c)) — retaining invoices and transaction records as required by Slovak accounting and tax law.
5. Data Sharing and Third Parties
We share personal data with third-party processors only to the extent necessary for them to provide their services to us. All processors are bound by data processing agreements that require GDPR-compliant handling of your data.
| Recipient | Purpose | Location | Safeguard |
|---|---|---|---|
| Stripe, Inc. | Payment processing | USA | Standard Contractual Clauses |
| Email delivery provider | Transactional and marketing emails | EU | Data Processing Agreement |
| Hosting provider | Web and database hosting | EU | Data Processing Agreement |
| Analytics provider | Aggregate Site analytics | EU | Data Processing Agreement |
We may disclose personal data to competent public authorities where required by law or where necessary to protect the rights, property, or safety of YUI s.r.o., our users, or others.
6. International Data Transfers
Where we transfer personal data to countries outside the European Economic Area (EEA) — for example to payment processors based in the United States — we ensure appropriate safeguards are in place. These safeguards include Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) GDPR.
7. Data Retention
- Contact and support messages — retained for 24 months from the date of the last communication, then permanently deleted.
- Newsletter subscriptions — retained until you unsubscribe, after which your email address is deleted within 30 days.
- Orders, invoices, and billing records — retained for 10 years in accordance with Section 35 of the Slovak Accounting Act (Act No. 431/2002 Coll.).
- Client Zone accounts — retained for the duration of your account. Upon account deletion, personal data is removed within 30 days, except data that must be retained by law.
- Server logs — retained for up to 90 days and then automatically purged.
8. Your Rights Under the GDPR
As a data subject you have the following rights. To exercise any of them, please contact us at privacy@yui.sk. We will respond within 30 calendar days.
- Right of access (Art. 15) — obtain confirmation of whether we process your data and receive a copy of it.
- Right to rectification (Art. 16) — request correction of inaccurate or incomplete personal data.
- Right to erasure (Art. 17) — request deletion of your data where it is no longer necessary, consent has been withdrawn, or processing is unlawful, subject to legal retention obligations.
- Right to restriction of processing (Art. 18) — request that we limit processing of your data in specific circumstances.
- Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format and transfer it to another controller.
- Right to object (Art. 21) — object to processing based on legitimate interests or for direct marketing purposes.
- Right to withdraw consent (Art. 7(3)) — withdraw consent at any time for processing activities that rely on consent, without affecting prior lawful processing.
- Right to lodge a complaint (Art. 77) — file a complaint with the Office for Personal Data Protection of the Slovak Republic: dataprotection.gov.sk, Hraničná 12, 820 07 Bratislava, Slovak Republic.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. These measures include HTTPS encryption for all data in transit, access controls limiting data access to authorised personnel only, and regular security assessments of our systems.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, inform affected individuals without undue delay.
10. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices, technology, or legal obligations. When we make material changes we will revise the "Last updated" date shown at the top of this page and, where appropriate, notify you by email or a prominent notice on the Site. Your continued use of the Site following any update constitutes acceptance of the revised policy.
11. Contact
For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us:
- Email: privacy@yui.sk
- Contact form: yui.sk/contact
We aim to respond to all privacy-related enquiries within 30 calendar days of receipt.