Privacy policy

Intro

Draft for review · 12 November 2026

This is a draft document, not approved legal wording. The controller's identity (business name, address, company ID, phone) has not yet been added - a sole-trader registration is being set up. Specific retention periods have not yet been set. The recipient list has been added from a technical review and the providers' public information of 12 November 2026; anything not confirmed is marked in the text. Contact: info@yabi.sk.

This draft does not claim GDPR compliance.

1. Contact form and enquiries

We process your name, email, selected project type, message and form source to reply and discuss your project. Information is sent to Brevo. An internal notification may include the message and is delivered to the studio mailbox. Not yet verified: the website function that receives the form calls Brevo; we have not tested this connection end-to-end. Do not send sensitive information or passwords.

The proposed legal basis is taking steps at your request before entering a contract, Article 6(1)(b) GDPR. Other general enquiries are to be assessed under the legitimate interest in replying to received correspondence, Article 6(1)(f). This distinction still requires review. We need a contact email and message to handle the enquiry. A newsletter subscription is not required for a reply.

2. Newsletter

Subscription is optional. With your express consent, we process your email and a consent record: wording, version, date and time, language and source. If you also tick the newsletter consent in the contact form, we add your email to the newsletter list. Without it, we only reply to your enquiry. The same consent wording applies to signup on the blog. The technical setup uses Brevo and direct signup without a second confirmation email.

The legal basis is consent under Article 6(1)(a) GDPR. Withdraw through the unsubscribe link in a newsletter or by emailing info@yabi.sk. Withdrawal does not affect the lawfulness of earlier processing. Unsubscribed or blocked contacts are not automatically subscribed again.

3. Booking a call

The booking link opens Cal.com. Information entered there is used to arrange the call and communicate about it. The video call uses Cal Video. The booked time is written to a connected calendar, whose provider will be added. See the Cal.com privacy policy. The proposed legal basis for arranging a booking at your request is Article 6(1)(b) GDPR.

4. Cookies and optional analytics

The consent settings store your choice. Optional analytics starts only after you accept the analytics category. Google Tag Manager (container GTM-P6P2NBWF) manages Google Analytics 4 (measurement ID G-QWRJY1SRBP), Microsoft Clarity (ID zbzp7oi2x6; usage analysis and session recording) and GrowthBook (A/B testing; including the CDN cdn.growthbook.io). Form success measurement sends an event name and technical metadata, not the message or submitted email. This does not mean analytics services process no other data, such as online identifiers or page usage information.

Optional analytics relies on consent. Declining it does not stop you browsing or sending a form. Cloudflare hosting also processes technical information needed to deliver the website. Secure operation is proposed to rely on legitimate interests under Article 6(1)(f) GDPR; technical log retention still needs verification.

Analytics cookies include _ga and _ga_* (Google Analytics), _clck and _clsk (Clarity), and the gbuuid identifier (GrowthBook). Cookie lifetime is not the same as provider data retention. Exact active settings and periods are not yet approved.

5. Change your consent

Open privacy settings. You can change your choice at any time using the Cookies button. After withdrawal, the website removes accessible analytics cookies on its domain and reloads if measurement had already started. It cannot delete third-party domain cookies or HttpOnly cookies. If the consent controls fail to load, optional analytics does not start.

6. Recipients and transfers

Depending on the feature, the recipients below take part in the processing. Information on legal entities, processing locations and safeguards comes from the providers' public information and from a technical review of the website and DNS on 12 November 2026. Unconfirmed information is identified as not yet verified. We do not claim that all data stays in the EU. Transfers that are not confirmed are not stated as fact. Authorised people handling enquiries or maintaining the service may also have access.

Brevo (forms and newsletter). Brevo is a French SAS, 17 rue Salneuve, 75017 Paris, RCS Paris 498 019 298. Which contractual entity applies to the studio's account (Brevo France, Brevo Inc. or Brevo Germany) is not yet confirmed and will be added once verified. Not yet verified: form and newsletter data are processed by Brevo (we have not tested the actual call end-to-end). According to Brevo, its database servers are in the EU (OVH in France and Germany, Google Cloud in Belgium). Its privacy policy (1 October 2025) also states that data may go to countries without an adequacy decision, in particular the USA and India, with appropriate safeguards. Brevo, Inc. (USA) is, according to its information, in the EU-U.S., UK and Swiss Data Privacy Framework. More information: Brevo's privacy policy.

Cloudflare, Inc. (USA) - hosting, DNS, IP addresses and operational metadata. Transfers outside the EEA: yes. Safeguards according to its public documents: Customer DPA v6.4 (3 April 2026); for the USA, the EU-U.S., UK and Swiss Data Privacy Framework, otherwise Standard Contractual Clauses (SCCs). Participation in the DPF is active according to the DPF list, with renewal by 15 September 2027.

Zoho Mail - the @yabi.sk mailbox (confirmed from DNS; the mailbox is on mail.zoho.eu). According to Zoho, these accounts are stored in the EU; in exceptional cases, employees of an Indian entity may access them for support, on the basis of SCCs, and in Zoho's wording without a physical transfer of data out of the EU. We do not name specific data-centre cities. A signed data processing agreement (DPA) with Zoho has not yet been confirmed.

Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA - booking the introductory call at cal.com/yabi-studio/intro-20. YABI is the controller, Cal.com is a processor (DPA). Transfers outside the EEA: yes, processing in the USA. Safeguards according to its information: the EU-U.S. Data Privacy Framework and the UK Extension, otherwise the 2021 Standard Contractual Clauses. EU representative according to its information: Felix Kolodziej, CAYA Postbox 1040588, 96035 Bamberg, Germany. Cal.com privacy policy.

Cal Video / Daily, Co., San Francisco, USA - not a direct contracting party of the studio. According to Cal.com's sub-processor list, Daily, Co. provides the video call; processing is in the USA. This is Cal.com's statement, not an independent verification of the flow of any particular call.

Connected calendar. The provider cannot be identified from public information. This draft only states: a connected calendar, whose provider will be added.

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland - Google Tag Manager (GTM-P6P2NBWF) and Google Analytics 4 (G-QWRJY1SRBP), only after analytics consent; Google is a processor for these services (Google Ads Data Processing Terms, version 8.0 of 30 May 2024). According to Google, EU data is collected by Google Analytics on EU servers and EU IP addresses are not stored. Data may then also be processed in the US by Google LLC. Google states that transfers to the US rely on the EU-U.S. Data Privacy Framework (Google LLC is an active DPF participant, renewal due 13 September 2027), otherwise on standard contractual clauses (SCCs).

Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland - Microsoft Clarity (ID zbzp7oi2x6), usage analysis and session recording, only after analytics consent. Under the Clarity terms, we and Microsoft are independent controllers. Microsoft also processes the data for its own purposes as described in the Microsoft Privacy Statement. Transfer outside the EEA: yes. According to Microsoft, Clarity data is stored in US data centers. Microsoft states that transfers from MIOL to Microsoft Corporation (USA) rely on standard contractual clauses (SCCs). Microsoft Corporation is also an active participant in the EU-U.S. Data Privacy Framework on the DPF list (renewal due 31 August 2027).

GrowthBook (including the CDN cdn.growthbook.io; this is not a separate CDN provider). GrowthBook, Inc., Anaheim, CA, USA. According to its Privacy Notice (8 June 2026), information is held with providers in the USA; a public DPA exists. According to its public sub-processor list, Fastly delivers the CDN. The default data host is cdn.growthbook.io. Whether an EU region is set up is not yet confirmed; according to GrowthBook's notice, data is processed in the USA. Transfer outside the EEA: yes (USA), according to its notice.

jsDelivr (cdn.jsdelivr.net) - Volentio JSD Limited (England and Wales). According to its information, a Privacy Policy and a DPA exist. Its stated sub-processors: Cloudflare, Fastly and Gcore (IP addresses and browser data). This draft makes no further claims about transfers.

7. Retention

Proposed criteria (specific periods are not approved and will be set by a lawyer): keep an enquiry while handling it and necessary follow-up; newsletter information until consent is withdrawn; a minimal suppression record where needed to respect an unsubscribe request. Consent evidence may be needed to demonstrate a lawful subscription. Information connected with a contract, legal duty or legal claim is assessed separately.

Specific periods, review schedules, deletion in Brevo, mail and calendars, and analytics retention have not yet been set. This page does not claim that automatic deletion is already in place, and it does not state unapproved numerical periods.

8. Your rights

Subject to the GDPR conditions, you can request access, correction, erasure, restriction and portability. You can object to processing based on legitimate interests and object to direct marketing at any time. You can withdraw consent. Email info@yabi.sk. Proportionate identity verification may be needed to handle a request securely.

You can complain to a supervisory authority, including the Office for Personal Data Protection of the Slovak Republic. The European Commission explains these rights and information duties. The reviewed website code contains no solely automated decisions with legal or similarly significant effects; external service settings still require verification.