Legal
Privacy policy
Last updated: 28 October 2026
Here is what happens to personal data at yop: what reaches us through yop.net, its forms and emails, the reason we keep each piece and the say you have over it. We work under the GDPR, the EU’s data protection regulation.
Controller: Yopnet OÜ (Estonian Commercial Register code 17253998), Tallinn, Estonia. Yopnet OÜ runs yop.net under the yop name. Contact: [email protected]
What reaches us
- Form data: the name, email address, the services you tick, your project description and, on the contact page, a budget range.
- Emails: the content of the messages you send us and your contact details.
- Technical records: the IP address, browser, page and time that our server logs for security and error tracking.
- Client data: the contact people, billing details and access you share with us when we work together.
Why we use it
- To answer your request, ask our questions and send a proposal (steps before a contract, GDPR Art. 6(1)(b)).
- To deliver the work we agreed on, invoice it and keep accounting records (contract and legal duty, GDPR Art. 6(1)(b) and 6(1)(c)).
- To keep the site secure and working and to stop abuse (legitimate interest, GDPR Art. 6(1)(f)).
Nobody buys, rents or receives your details from us for marketing. No newsletter reaches you unless you asked for it, and no software decides anything about you or builds a profile of you.
The email field is needed for us to answer you; without it we cannot handle the request. The other fields are optional.
Who else sees it
Only the service providers the work needs: the company hosting this site, our email service and our accounting and invoicing service. They process the data on our behalf and on our instructions. If the law requires it, we share data with the competent authorities.
Data leaving the EU
Yopnet OÜ is an Estonian company, so your data stays with us inside the European Union. Should a provider host anything outside the EU, that transfer runs on the EU Commission’s model clauses or an equal safeguard.
When we delete it
- Form requests and emails: at most two years if we do not start working together.
- Client and invoice records: seven years, the period Estonian accounting rules set.
- Server logs: a short time for security, usually a few weeks.
Your rights
You can ask to see your data, to correct or delete it, to restrict or object to its processing and to receive it in a portable format. Write to [email protected]; we answer within one month, as Article 12 of the GDPR requires. If you think we got it wrong, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the regulator in your own country will hear your complaint.
Cookies
Which cookies this site uses is written in our cookie policy.
Security
The site runs on HTTPS. Only the people working on a request or a project can see its data, and every account is protected by a password.
Changes
When our tools or our work change, this text changes with them. Whatever stands here today is the version in force.