Privacy Notice

Purpose: to reply to your enquiry, understand your needs and prepare a proposal.

Data: name, email address, phone number, company name (optional), your message, time of submission.

Legal basis:

• If you contact us as an individual or sole trader: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
• If you contact us on behalf of a company: our legitimate interest (Article 6(1)(f) GDPR) in dealing with the company’s enquiry through its designated contact person. This does not unduly affect your rights, as we use only the details you provide and only to respond to the enquiry.

How it travels: the form is delivered by the Resend email service from its EU data centre to our hello@yeralabs.com mailbox (Google Workspace). Resend may keep delivered messages for a limited period under its own retention rules. Incoming emails are archived in Proton Drive. We do not store form submissions in any separate database.

Protection against abuse: To block spam and abuse, the form uses Cloudflare Turnstile. When you start filling in the form, Turnstile loads from Cloudflare’s servers and checks your IP address and technical characteristics of your browser (such as the browser type); it does not access what you type. Cloudflare also uses these signals as an independent controller to improve its bot detection. We check that your email domain accepts mail and look up its registration date in the public RDAP registry; for this, only the domain name (for example company.com) is sent to the public rdap.org lookup service. To prevent flooding, we keep a one-way hash of your IP address for 24 hours. If the form is abused, we keep the sender’s email address or domain on a blocklist for as long as the block is justified. Legal basis: our legitimate interest in protecting the form and our mailbox from abuse (Article 6(1)(f) GDPR).

Retention: 12 months from the close of the enquiry if no contract follows, then deleted. If a contract is concluded, section 4.4 applies.

Is it required? We cannot respond without your name, email address, phone number and message. The company name is optional.

Data: your name, contact details, the content of your message and when you sent it.

Purpose, legal basis and retention: as in section 4.1.

When you use WhatsApp or LinkedIn, WhatsApp Ireland Limited and LinkedIn Ireland Unlimited Company act as independent controllers under their own privacy policies.

Purpose: scoping your needs and discussing the project.

Data: name, email address, meeting time, and the image and voice of participants during the call.

Legal basis: as in section 4.1: Article 6(1)(b) for individuals and sole traders, Article 6(1)(f) for company contacts.

Meetings take place on Google Meet. We do not record them.

Retention: invitation details are kept for the periods set out in sections 4.1 or 4.4.

Purpose: concluding and performing the contract and communicating during the project.

Data: name or company name, address or registered office, tax number, the contact person’s name, email and phone number, and the identification data needed for electronic signature.

Legal basis:

• Where the contracting party is an individual or sole trader: performance of the contract (Article 6(1)(b) GDPR).
• For a contracting company’s contact person: our legitimate interest (Article 6(1)(f) GDPR) in the communication needed to perform the contract.

Electronic signature: contracts are signed through Signingo using DÁP (the Hungarian government’s digital identity app) for authentication. Signingo is operated by NP-Soft Studio Kft., which acts as an independent controller under its own privacy policy. The DÁP app is covered by its own privacy notice.

Retention: contracts are archived in Proton Drive and kept for 5 years after the contract ends. This is the general limitation period for contractual claims under section 6:22(1) of the Hungarian Civil Code, and keeping them is permitted by Article 17(3)(e) GDPR.

Is it required? Yes. Without this data no contract can be concluded.

Purpose: issuing invoices and meeting our invoice reporting and record-keeping obligations.

Data: billing name and address, tax number, invoice items and amount, and the email address used to send the invoice.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR) under Hungarian VAT, tax administration and accounting law: Act CXXVII of 2007, Act CL of 2017 and Act C of 2000.

Invoices are issued in Billingo. As required by law, invoice data is reported to the Hungarian Tax and Customs Administration’s Online Invoice system; Billingo submits this report on our behalf. Invoices are also archived in Proton Drive. Our bookkeeping is handled by an accountant.

Retention: 8 years (section 169(2) of the Accounting Act; section 78(3) of the Act on the Rules of Taxation).

Purpose: keeping the website available and fast and blocking attacks and abuse.

Data: IP address, browser and device type, time of request and page requested.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in operating the website securely and reliably, which also protects visitors. We do not use this data to identify anyone or to build profiles.

The website runs on Cloudflare Pages. We keep no logs of our own. Cloudflare, Inc. processes the log data needed to provide its service as our processor for a limited period under its own data processing terms.