Privacy Policy
How Yafee handles the records created when a company is found in the directory and a cancellation is sent by registered electronic mail.
1. The controller and the instruments this policy governs
The site https://www.yafee.com is published by Yafee Services Limited (C 116017), whose registered office is at and which may be reached on data protection matters at [email protected]. That company decides the purposes and the means of the processing set out below and is accordingly the controller of the personal data collected from users.
The processing described here arises from four instruments: the directory entry consulted by the Customer, the letter drafted on the Customer's behalf, the registered electronic dispatch of that letter with its evidential record, and the subscription contract. This policy states, for each of them, what is recorded, why, for how long and who else may see it.
It is applied in conformity with Regulation (EU) 2016/679 (GDPR) where the Customer is located in the European Union, with amended Law No. 78-17 (the Data Protection Act) as regards France, and with the Personal Data Protection Law (PDPL) applicable in Malta.
2. The categories of record held
Nothing is collected beyond what the supply, the administration and the billing of the service require. Identification records cover the surname, first name, postal address, email address, telephone number and country. Account records cover the username, the password held only in hashed form, the subscription history and the invoices issued. Payment records, meaning the card number and the banking information attached to it, are handled solely by the provider Stripe and are at no point accessible to Yafee. Records of service use cover the documents uploaded, the templates created, the sender and recipient addresses entered, the sending history and the tracking of each item. Technical records cover the IP address, the type of device, the browser, server logs and the analytical and security cookies described below.
3. Why those records are processed, and on what basis
Records are processed in order to supply and perform the service, which is to say the creation, the production and the dispatch of the mail; to administer the customer account and to issue invoices; to prevent fraud and secure payments; to assist the Customer and answer technical support requests; to improve the site and the performance of the service; to satisfy legal obligations in matters of invoicing, of anti-money-laundering and of accounting records; to send administrative or contractual information concerning the service; and to handle requests by which rights under the GDPR or the PDPL are exercised. Each purpose rests, according to the situation, on one of the bases below.
- Performance of the contract
- Use of the service, processing of an order and billing.
- Consent
- Creation of an account, cookies and marketing communications.
- Legal obligation
- Keeping of records and issuing of invoices.
- Legitimate interest
- Prevention of fraud and improvement of the service.
4. How long each record is kept
No record is held longer than the period strictly required by the purpose it serves.
| Category of record | Maximum period |
|---|---|
| Account records | for as long as the account remains open, plus 3 years from its deletion |
| Billing records | 10 years, under accounting obligations |
| Records of mail sent | the term of the subscription, plus 6 months |
| Technical records and logs | 12 months |
| Analytical cookies | 13 months at most |
The documents and files belonging to the Customer are erased automatically when the subscription comes to an end or the account is closed.
5. Where the records are held, and transfers abroad
The records are held on secured servers operated by OVHcloud (OVH SAS) inside the European Union, in Lithuania and in the Netherlands. Backups, and some processing operations, may take place in Malta where the technical running of the service requires it, and records may be transferred there for support purposes.
Any transfer outside the European Union is covered by the guarantees the GDPR provides for, namely the Standard Contractual Clauses adopted by the European Commission. Yafee thereby maintains a level of protection equivalent to that required by Article 46 of the GDPR and by the Personal Data Protection Act applicable in Malta.
6. Who else sees the records
Personal data is neither sold nor rented. It is disclosed only to the technical providers that host the site, route and produce the mail and staff customer support; to the payment provider; to the carriers and postal operators that carry out a dispatch; and to administrative or judicial authorities where the law compels disclosure. Every processor is bound by strict obligations of confidentiality and security.
The principal processors are the following.
- Stripe Payments Europe Ltd.
- Processing of payments.
- OVHcloud (OVH SAS)
- Hosting.
- Google LLC
- Audience analysis through Google Analytics 4.
- Postal Service
- Printing and sending of the mail.
- OpenAI / AI API
- Automated generation of text. No personal data is stored once the generation is complete.
We use Stripe for payment, analytics, and other business services. Stripe collects identifying information about the devices that connect to its services. Stripe uses this information to operate and improve the services it provides to us, including for fraud detection. You can learn more about Stripe and read its privacy policy at https://stripe.com/privacy.
7. Security measures
Yafee applies technical and organisational measures aligned with international standards. They comprise SSL/TLS encryption, the hashing of passwords, firewalling, logging, segregation of environments, strict control of access and internal security audits.
8. Cookies placed on the site
Cookies are placed in three capacities: technical cookies, without which the service does not operate; analytical cookies, through Google Analytics 4, by which audience is measured; and functional cookies, which retain the chosen language and other preferences. The Client governs them through the consent banner or through the settings of the browser. Where technical cookies are refused, access to the service may become impossible.
9. The rights the Client may exercise (GDPR / PDPL)
The Client may obtain access to the data held on them, have inaccurate data rectified, obtain erasure under the right to be forgotten, have processing restricted, object to processing, receive an export of the data for the purpose of portability and, within the European Union alone, lay down directives governing the fate of the data after death.
A request is addressed to [email protected] and is answered within 30 days at the latest. An identity document may be requested before the request is acted upon.
10. Complaints, and amendment of this policy
Questions, and requests by which the rights above are exercised, are received at [email protected]. A user located in the European Union may in addition lodge a complaint with the data protection authority of their own country.
Yafee reserves the right to amend this policy at any time. The version that governs is the one published on the site on the day of consultation. Where an amendment is substantial, notice of it is given by email or through the customer account.