1. Who We Are and Scope
Yone IT Ltd ("we", "us", "our") is a company registered in England and Wales (Company No. 13073396), registered office at 60 Cookridge Drive, LS16 7HW Leeds, United Kingdom.
This Policy explains how we handle personal data in connection with:
- our SaaS platform ("the Service"), and
- our dealings with customers, their users, and people who contact us.
This Policy does not cover our public marketing website. That site is operated separately and has its own privacy and cookie notice at [LINK — see the status document; that notice still needs to exist].
The Service is available internationally. Where local law gives you rights beyond those described here, those rights apply — see Section 14 (Regional Disclosures).
Contact: contact@yone.co.uk
Data protection contact / privacy lead: [NAME OR ROLE — INSERT] (A statutory DPO is not required in most cases for an organisation of this size, but you must name a contact point.)
UK representative: not required — we are established in the UK. EU/EEA representative (UK GDPR Art. 27 / EU GDPR Art. 27): [INSERT NAME AND EU ADDRESS — REQUIRED if you offer the Service to individuals in the EEA and have no EEA establishment. See review notes.]
2. Our Role: Controller and Processor
| Data | Our role |
|---|---|
| Account, billing, support and usage data of our customers and their users | Controller |
| Content you upload into or create within the Service ("Customer Data"), including any personal data it contains | Processor, acting on your documented instructions |
Where we act as processor, our customer is the controller and is responsible for the lawfulness of the data and for responding to the individuals concerned. Our processor obligations are set out in our Data Processing Addendum.
3. Data We Collect and Why
3.1 Account data
When you register: your name, work email address, organisation name, role, country, and account credentials (stored hashed).
- Purpose: to create and manage your account and provide the Service.
- Legal basis: performance of a contract (Art. 6(1)(b) UK/EU GDPR).
3.2 Billing and tax data
Billing address and country, billing currency, VAT registration number, evidence of business status (such as company registration number or certificate of incorporation), invoice history, and payment status.
We do not store full payment card details. Card data is handled by our payment providers.
Where Stripe acts as merchant of record for customers outside the UK and EU/EEA, Stripe is the seller of record for that transaction and is an independent controller of the payment data it collects, under its own privacy notice.
- Purpose: to take payment, issue invoices, validate business status, and meet tax and accounting obligations.
- Legal basis: performance of a contract; legal obligation (Art. 6(1)(b) and (c)).
3.3 Usage and technical data
Login timestamps, IP address, browser and device type, feature usage, error and audit logs.
- Purpose: to secure, maintain, troubleshoot and improve the Service, and to detect abuse.
- Legal basis: legitimate interests (Art. 6(1)(f)) — securing and improving our service. Our assessment is that this does not override your interests, as the data is limited, technical, and not used for profiling or advertising.
3.4 Support and communications
Messages you send to support, and our replies.
- Purpose: to respond to and record support requests.
- Legal basis: performance of a contract; legitimate interests.
3.5 Customer Data
Any data you upload or input into the Service remains your data. We do not access, use, or process Customer Data except as necessary to provide the Service, to maintain security, or as you instruct us. We are a processor in respect of Customer Data.
You are responsible for having a lawful basis for the personal data you place in the Service, and for informing the individuals concerned.
3.6 Marketing
If you opt in, or where permitted for existing business customers, we may send product updates and marketing by email.
- Legal basis: consent, or legitimate interests where the "soft opt-in" applies.
- You can unsubscribe at any time via the link in any email or by contacting us.
We do not sell or share personal data for cross-context behavioural advertising, and we do not use personal data for advertising profiling.
4. Cookies and Similar Technologies
The platform uses strictly necessary cookies and browser storage only:
- Cookies: authentication (httpOnly) and CSRF protection.
- Browser storage: session state, interface preferences, and a cache of unsaved drafts and recently viewed content held on your own device for autosave and offline resilience. That cache may contain personal data; we clear it when you log out.
No consent banner appears in the platform because all of this is necessary to deliver the Service you have requested, and is therefore exempt under UK PECR and the EU ePrivacy Directive. No analytics, advertising or tracking technology operates inside the platform.
The law here is not cookie-specific: UK PECR and the EU ePrivacy Directive cover any storing of, or access to, information on your device, including localStorage and equivalents.
Full detail is in our Cookie and Similar Technologies Policy.
5. AI Features and Your Data
The Service includes AI features powered by a third-party provider. Your content and prompts are not used to train or fine-tune any AI model, and no automated decision-making with legal or similarly significant effects is carried out.
How AI processing works, what is transmitted, retention by the provider, and the transfer safeguards applied are set out in Clause 14 and Annex III of the Data Processing Addendum. Restrictions on what may be submitted are in Clause 4 of that document.
6. Who We Share Data With
We do not sell, rent, or share personal data with third parties for their own purposes.
Where we are the controller (account, billing, support and usage data), we share with:
| Recipient | Purpose | Location |
|---|---|---|
| Stripe, Inc. / Stripe Payments Europe Ltd | Payment processing; merchant of record outside the UK and EEA, where Stripe acts as an independent controller | Ireland, United States |
| Microsoft Limited | Account and service emails | UK |
| Professional advisers, auditors, insurers | Legal, accounting and insurance | UK/EU |
| Law enforcement and regulators | Where legally required | As applicable |
Where we are the processor (Customer Data), the complete and authoritative list of sub-processors — with what each accesses, where it sits, retention and transfer mechanism — is Annex III of the Data Processing Addendum. That annex also sets out the notice and objection process for changes. We do not maintain a second list here, so there is only ever one to keep current.
We may also disclose data in connection with a merger, acquisition or sale of assets, subject to equivalent protection.
7. Data Residency and International Transfers
Customer Data is hosted and stored at rest in the United Kingdom. We do not currently offer other residency regions. If your organisation is subject to a data localisation requirement outside the UK, contact us before subscribing.
Some recipients are located outside the UK, principally the United States. The transfer mechanisms we rely on — the UK adequacy position for EEA transfers, and the IDTA, UK Addendum or Data Privacy Framework for onward transfers — are set out in Clause 11 and Annex IV of the Data Processing Addendum, and apply equally to the controller-side transfers in Section 6.
Copies of the relevant safeguards are available on request from contact@yone.co.uk.
8. Data Retention
| Data | Retention |
|---|---|
| Account data | Duration of subscription + [12] months, then deleted |
| Customer Data | As set out in Clause 13 of the DPA — not repeated here |
| Billing, invoice and tax records | 6 years (UK statutory requirement) |
| Security and audit logs | [12] months |
| Support tickets | [24] months |
| Marketing consent records | Duration of consent + [24] months |
| Client-side cache on your device (drafts, preferences) | Cleared on logout; otherwise until you clear your browser data |
You may request earlier deletion at any time; we will comply unless we are required to retain the data by law.
9. Data Export and Portability
To export your data, contact contact@yone.co.uk, or use the export functionality in the Service.
We provide a structured, commonly used, machine-readable export within a reasonable period and in any event within [30] days of a valid request. Timings after termination, and the grace period, are in Clause 13 of the Data Processing Addendum.
We may charge a reasonable fee for manifestly unfounded, excessive or repeated requests, or for bespoke export formats.
10. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. The full and current list is Annex II of the Data Processing Addendum — encryption, access control, resilience, logging, secure development, incident response and the rest. It is maintained in one place so it cannot drift between documents.
No system is completely secure. You are responsible for keeping your credentials confidential, for managing user access within your account, and for endpoint security on the devices your users use.
11. Data Breaches
If a personal data breach occurs, we will:
- notify the ICO within 72 hours where the breach is reportable and we are the controller;
- notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms;
- notify affected customers without undue delay where we are the processor, so they can meet their own notification obligations, and provide reasonable assistance.
12. Your Rights
Depending on where you are, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your data ("right to erasure")
- Restrict or object to processing, including objecting to processing based on legitimate interests
- Portability — receive your data in a machine-readable format
- Withdraw consent at any time, without affecting processing carried out before withdrawal
- Not be subject to solely automated decision-making with legal or similarly significant effects (we do not carry out such processing)
To exercise your rights, contact contact@yone.co.uk. We will respond within one month, extendable by two further months for complex requests. We may need to verify your identity.
If your data is held in the Service as Customer Data, we are the processor — please contact the customer organisation that controls that account. If you contact us instead, we will refer you to them.
13. Regional Disclosures
13.1 United Kingdom
Governed by the UK GDPR, Data Protection Act 2018 and PECR. Supervisory authority: the Information Commissioner's Office, ico.org.uk.
13.2 EEA
Governed by the EU GDPR. You may complain to the supervisory authority in your country of residence, work, or where the alleged infringement took place. Our EU Art. 27 representative is listed in Section 1. [INSERT]
13.4 California, USA
Under the CCPA/CPRA:
- We do not sell personal information, and we do not share it for cross-context behavioural advertising.
- Categories collected in the last 12 months: identifiers, commercial information, internet activity, and professional/employment information — as described in Section 3.
- You have rights to know, delete, correct, opt out of sale/sharing, limit use of sensitive personal information (we do not collect sensitive personal information for these purposes), and to be free from discrimination for exercising these rights.
- Submit requests to contact@yone.co.uk. Authorised agents may submit requests with proof of authority.
- Where we process Customer Data we act as a service provider under the CCPA and will not retain, use or disclose it for any purpose other than performing the service.
13.5 Other US states
Equivalent rights apply under state privacy laws including those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana. Contact us to exercise them.
13.6 Canada
PIPEDA applies. You may complain to the Office of the Privacy Commissioner of Canada.
13.7 Australia
The Privacy Act 1988 and Australian Privacy Principles apply. You may complain to the OAIC.
13.8 Other jurisdictions
Where the law of your country grants you rights not listed above, we will honour them to the extent they apply to us.
14. Children
The Service is for business use and is not directed at, or intended for, anyone under 18. We do not knowingly collect personal data from children. If you believe a child's data has been provided to us, contact contact@yone.co.uk and we will delete it.
15. Changes to This Policy
We may update this Privacy Policy. We will notify customers of material changes by email or in-platform notification at least [14] days before they take effect. The "last updated" date above reflects the most recent revision. Previous versions are available on request.
16. How to Contact Us and Complain
Yone IT Ltd 60 Cookridge Drive, LS16 7HW Leeds, United Kingdom Company No. 13073396 contact@yone.co.uk
If you are unhappy with how we have handled your data, please contact us first so we can try to resolve it. You also have the right to complain to your local supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
17. Accessibility
We want the Service to be usable by as many people as possible. The current interface uses structured, content-rich layouts (sections and columns) built with standard web technologies. We have not carried out a formal accessibility conformance assessment.
If you have specific accessibility needs, please contact us to let us know. We assess and prioritise accessibility improvements to the Service based on the feedback we receive.
Terms · Privacy · Cookies · DPA
© 2026 Yone IT Ltd