Who is responsible
Alston RaoYulunoFerdinandstrasse 3033102 Paderborn · GermanyProposed email (to be confirmed)hello@yuluno.comAlston Rao is the contact for questions and requests concerning the personal information described on this page.
Website visits and hosting
Delivering a website requires technical information such as your IP address, requested resource, access time and browser information. A hosting provider may also process security and error records. Where applicable, the legal basis is Article 6(1)(f) GDPR: the legitimate interest in providing a reliable and secure website.
The production provider, locations and actual log-retention settings have not yet been confirmed. These details must be added before public deployment; this draft does not claim that logs are disabled or that all processing takes place in Germany.
Project enquiries and email
The enquiry fields ask for your name or company name, email address, project type, preferred package, timing and project description. The button assembles these fields into an email in your own email application. The form itself does not send the fields to a Yuluno form server or save them in a Yuluno database. We receive the message only if you send it.
After receipt, we use the message to answer you, clarify requirements and prepare an offer. For enquiries about your own prospective contract, the GDPR basis is Article 6(1)(b). For other enquiries, including contact persons acting for a company, it is Article 6(1)(f), based on the legitimate interest in communicating about requested services. Information needed for legal duties is processed under Article 6(1)(c).
Please provide only information needed to discuss the project. Do not include passwords, identity documents or sensitive personal information in the initial enquiry. We do not add enquiry contacts to a marketing list.
How long information is kept
The proposed retention rule for enquiries that do not lead to a project is deletion within six months of the last substantive contact, unless continued discussions, a legal duty or a concrete legal claim requires longer retention. The email provider and deletion workflow must be configured to support this rule before launch.
Contract and accounting records are retained for the statutory period applicable to each record. Information needed for a legal dispute is restricted to that purpose and retained only as long as necessary. Technical log retention will be specified with the production hosting configuration.
Service providers and international processing
Hosting and email providers may process information on our behalf. Appropriate processor agreements must be in place where required. Accountants, advisers or authorities receive information only where necessary for their task or a legal obligation.
The production providers are still to be selected or confirmed, so this version does not assert particular recipients, processing countries or transfer safeguards. Where personal data is transferred outside the EEA, the applicable recipient, country and safeguard must be identified before the transfer, such as an applicable adequacy decision or appropriate contractual safeguards.
Cookies, analytics and embedded content
The current website implementation does not include advertising pixels, visitor analytics, a newsletter, customer accounts, embedded social-media feeds or remotely loaded Google Fonts. The enquiry fields are not persisted by the website in cookies or browser storage. This description must be checked again against the production deployment.
If optional tracking or other services requiring consent are introduced, their details and a consent mechanism will be provided before they operate. Consent can then be withdrawn. Strictly necessary device storage or access is assessed under Section 25(2) TDDDG where applicable; data processing still requires its own legal basis.
Following an external link takes you to another provider’s website. That provider is responsible for its own processing.
Your rights
Subject to the applicable conditions, you may request access, correction, erasure, restriction and portability of your personal information. You may withdraw consent at any time without affecting the lawfulness of earlier processing. There is no automated decision-making with legal or similarly significant effects in this enquiry process.
Where processing relies on legitimate interests, you may object for reasons relating to your particular situation. An objection to direct marketing does not require such reasons. Contact us at the address above to exercise your rights; only proportionate verification information will be requested.
You can complain to a supervisory authority, including the authority where you live or work. The authority for North Rhine-Westphalia is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).
Enquiries from mainland China
If the Chinese Personal Information Protection Law applies to the handling of your enquiry, applicable rights to know, decide, access, copy, correct, restrict and delete information are respected alongside other applicable protections. The controller, categories and enquiry purposes are described above.
This draft does not yet provide a completed China-specific cross-border notice. The actual overseas recipients, processing locations, applicable safeguards and any separate consent or representative arrangements must be established before the relevant processing begins. A Chinese translation alone does not resolve these requirements.
Updates
This policy will be updated when the website’s functions, providers or processing arrangements change. The revision date appears at the top of the page. Material changes will be communicated as required by applicable law.