Privacy Policy
Yameo B.V. (“Yameo”, “we”, “our”) is committed to protecting your personal data. This policy explains what data we collect, why we collect it, how long we keep it, and your rights under GDPR.
I. Who We Are
Yameo B.V. is the data controller for personal data processed in connection with this website and our business activities.
Parijsboulevard 209, 3541 CS Utrecht, the Netherlands
contact@yameo.eu
security@yameo.eu (data protection matters)
We do not appoint a formal Data Protection Officer (DPO) as we do not engage in large-scale systematic processing that would trigger that obligation under GDPR Article 37. All data protection rights requests and enquiries are handled by our data protection contact at security@yameo.eu.
II. What Data We Collect
A. Data you provide to us (via contact form)
| Data | Why collected |
|---|---|
| First name, Last name | Personalisation and addressing you correctly |
| Work email | Primary contact channel |
| Phone number | Optional; for calls if preferred |
| Company name | Lead qualification |
| Industry | Routing your enquiry to the right person |
| Service interest | Scoping your enquiry |
| Budget range | Helping us prepare a relevant response |
| Timeline | Understanding urgency |
| How you found us | Marketing attribution |
B. Data collected automatically
When you visit our website, we collect technical and behavioural data automatically: IP address (anonymised), browser type and version, pages visited, time spent on site, and referral source. This data is collected via Google Analytics 4.
C. Data from correspondence
When you contact us by email, LinkedIn, or any other channel, we retain the content of that communication and any personal data it contains (name, email address, professional details).
D. Recruitment data
When you apply for a position at Yameo, we collect your CV, cover letter, LinkedIn profile URL, and contact details. This data is used exclusively for evaluating your application.
III. How We Use Your Data
The table below sets out each purpose for which we process personal data, the legal basis under GDPR Article 6, and the applicable retention period.
| Purpose | Legal basis | Retention |
|---|---|---|
| Responding to contact form submissions | Legitimate interest (Art. 6(1)(f)) | 3 years from last contact |
| Sales and business development | Legitimate interest (Art. 6(1)(f)) | 3 years from last contact |
| Sending requested information or proposals | Pre-contractual steps (Art. 6(1)(b)) | Duration of pre-contract period |
| Contract performance | Contract (Art. 6(1)(b)) | Duration of contract + 7 years (tax/legal obligations) |
| Analytics and website improvement | Legitimate interest (Art. 6(1)(f)) — anonymised data | 26 months (GA4 default) |
| Recruitment | Pre-contractual steps (Art. 6(1)(b)); Consent for future opportunities (Art. 6(1)(a)) | Duration of recruitment process; up to 2 years with consent |
| Legal compliance and claim defence | Legal obligation (Art. 6(1)(c)) / Legitimate interest (Art. 6(1)(f)) | As required by applicable law |
We do not use your data for automated decision-making or profiling within the meaning of GDPR Article 22.
V. International Data Transfers
We primarily process data within the EU/EEA. Where transfers to third countries occur, we ensure appropriate safeguards are in place:
- HubSpot: EU1 region (Ireland) — no transfer outside the EEA for contact form data.
- Google Analytics: Covered by EU Standard Contractual Clauses (SCCs) and Google’s EU Data Processing Addendum. IP addresses are anonymised before any data leaves the EU.
- All remaining transfers are protected by either EU adequacy decisions, Standard Contractual Clauses (Art. 46 GDPR), or the EU–U.S. Data Privacy Framework where applicable.
We no longer rely on the EU–U.S. Privacy Shield, which was invalidated by the Court of Justice of the European Union in July 2020 (Schrems II).
VI. How Long We Keep Your Data
| Purpose | Retention period |
|---|---|
| Contact form submissions & sales correspondence | 3 years from last contact |
| Pre-contractual information and proposals | Duration of pre-contract period |
| Contract and related documents | Duration of contract + 7 years |
| Website analytics data | 26 months (GA4 default) |
| Recruitment applications | Duration of recruitment process; up to 2 years with consent |
| Legal compliance records | As required by applicable law |
After the applicable retention period expires, data is securely deleted or irreversibly anonymised. You may request earlier deletion — see Section VII below.
VII. Your Rights Under GDPR
As a data subject under GDPR, you have the following rights. You can exercise any of these rights by emailing security@yameo.eu. We will respond within 30 calendar days. We may need to verify your identity before processing your request.
Request a copy of the personal data we hold about you, along with information about how it is processed.
Ask us to correct inaccurate data or complete incomplete data without undue delay.
Ask us to delete your personal data. This right may not apply where we have a legal obligation to retain the data.
Ask us to pause processing while a dispute about accuracy or lawfulness is resolved.
Receive your data in a structured, commonly used, machine-readable format. Applies where processing is based on consent or a contract.
Object to processing based on legitimate interest. We will stop unless we can demonstrate compelling legitimate grounds that override your interests.
Where processing is based on consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with the supervisory authority in your EU member state of habitual residence.
IX. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The “last updated” date at the top of this page will always reflect the date of the current version.
For material changes that significantly affect how we process your data, we will notify active contacts by email before the changes take effect.
X. Contact Us
For any questions about this Privacy Policy, or to exercise your data protection rights: