Privacy Policy
Last updated 27 August 2026
This policy explains what personal data Yanyy collects, why it is collected, how long it is kept and what rights you have under UK GDPR.
1. Who we are
Yanyy is a web design and hosting studio based in Grantham, Lincolnshire, United Kingdom, acting as data controller for the data described below. Contact: hello@yanyy.uk.
2. Data we collect
Enquiry data (name, email, phone, business name, message), client account data (contact and billing details, company information), service data (domains, hosting details, invoices, agreements, support tickets, uploaded files) and technical data (IP address, browser type, server logs).
3. Why we use it
To respond to enquiries, deliver and support the services you have requested, issue invoices and take payment, maintain security and backups, comply with legal and accounting obligations, and send service-related notifications.
4. Legal bases
Performance of a contract (delivering services), legitimate interests (responding to enquiries, securing systems, preventing abuse), legal obligation (accounting records) and consent where required, such as optional marketing.
5. Sharing
Data is shared only with processors needed to run the service — hosting and infrastructure providers, payment providers, email delivery and e-signature providers. They act on documented instructions and are bound by confidentiality. Data is not sold.
6. Retention
Enquiry data is kept for up to 24 months. Client and billing records are kept for at least six years to meet UK accounting requirements. Backups are rotated on a rolling schedule and expire automatically.
7. Your rights
You may request access, correction, erasure, restriction, portability or object to processing, and you may withdraw consent at any time. Requests are answered within one month. You may also complain to the Information Commissioner's Office (ico.org.uk).
8. Security
Access to client data is restricted, credentials are stored encrypted, connections are secured with TLS and portal access requires authentication. Any breach affecting your rights will be reported without undue delay.
9. International transfers
Where a provider processes data outside the UK, transfers rely on adequacy regulations or standard contractual clauses.