Privacy policy

1. Controller

The controller responsible for processing your data is:

YGO Apps

2. Website operation and hosting

Visiting this website requires processing connection data, including your IP address, access time, requested page, HTTP status, browser and operating system information and, where transmitted, the referring page. This enables delivery of the website and investigation of errors and attacks.

The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in a secure, reliable website. Recipients include hosting and IT providers. Logs should be kept only as long as needed for these purposes; security incidents may require longer retention for investigation.

To be completed: hosting provider name and address, processing locations and actual log retention period.

3. Contact and project inquiries

When you contact us by email or a form, we process your contact details and message to handle your inquiry. The contact form collects your name, email, company, team size, selected services and systems, message and optional phone number.

Pricing inquiries also include the information you submit about your project: contact person, optional website and phone number, project description, consultation preference, software selection, employee count, hosting, migration, development and support preferences, and calculated costs and savings. Submissions include language, submission time, form source and processing status.

Article 6(1)(b) GDPR applies to inquiries concerning a contract with you. Other inquiries, including communications with company representatives, are processed under Article 6(1)(f) GDPR based on our interest in business communication. Providing information is voluntary, but the required fields are needed to submit a form.

The calculator does not make automated decisions with legal or similarly significant effects. Offers are agreed individually. To be completed: the email service provider.

4. Firebase / Cloud Firestore for form submissions

Contact and project submissions are stored in Cloud Firestore, a Google database service available through Firebase. On submission your browser connects to Google, which processes the submitted information and technical connection data. The database supports receiving and handling your inquiry on the legal bases explained above.

Google provides data processing terms for Cloud Firestore. The Google contracting entity for our account, applicable terms and chosen database location must be confirmed before publication. Even with a European database region, additional processing for support or operations may take place outside the EEA. See the international transfers section below.

Firebase privacy and processing locations

5. Consent, cookies and local storage

We save your analytics choice in your browser’s local storage under “ygo_cookie_consent_v1”. This stores your decision about analytics and necessary functions. It is overwritten when you change your choice and currently has no automatic expiry. You can delete it using your browser’s website data controls.

Storing and reading this choice is necessary to honour your privacy settings under Section 25(2)(2) TDDDG. Any associated processing of personal data relies on Article 6(1)(f) GDPR and our legitimate interest in reliably implementing your choice.

Optional analytics is enabled only with your consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can change your choice and withdraw consent for the future through “Cookie settings”. Withdrawal does not affect processing that took place beforehand.

6. Google Analytics

Where configured on this website, Google Analytics 4 is loaded only after you consent to analytics. The provider for users in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use it to understand how pages and features are used.

Data includes page views, interactions with navigation, the software directory and calculator, device and browser information, referral sources and cookie identifiers. IP addresses are processed for the connection and approximate location. Our custom analytics events do not include form contents, email addresses or entered search terms.

Google Analytics uses cookies including “_ga” and “_ga_<identifier>”. Their default lifetime is two years and can be renewed through further use. Actual cookie lifetimes and the user and event retention setting in our Analytics property must be confirmed before publication. Cookie lifetime is separate from server-side retention.

Processing is based on consent, which can be changed in cookie settings. Google may also process data through Google LLC in the United States.

Google Privacy Policy

Google Analytics cookies

7. Recipients and international transfers

Recipients include hosting, email, database and analytics providers and people handling inquiries, as necessary for the stated purposes. Data may also be disclosed to authorities when required by law.

Google states that Google LLC is certified under the EU-US Data Privacy Framework. Transfers covered by that certification may rely on the adequacy decision under Article 45 GDPR. Google also provides standard contractual clauses for relevant transfers. The arrangements applicable to our service accounts must be checked before publication. You can request information about these safeguards using the email address above.

Google data transfer frameworks

8. Retention

Personal data should be deleted once it is no longer needed for its purpose, unless statutory obligations or legitimate grounds require continued retention. For inquiries, relevant criteria are whether handling is complete, follow-up is expected or the data is needed to perform a contract. Business records subject to statutory retention are retained for the applicable period under Article 6(1)(c) GDPR.

To be defined and implemented: specific deletion periods for completed inquiries, copies and backups. The website code does not automatically delete Firestore inquiries.

9. Your rights

Subject to legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. Consent can be withdrawn at any time for the future.

Right to object: where processing relies on Article 6(1)(f) GDPR, you can object on grounds relating to your particular situation. You can object to direct marketing at any time. Contact the controller above to exercise your rights.

You can complain to a supervisory authority, particularly where you usually live, work or believe an infringement occurred. The authority responsible for our location is the Hessian Commissioner for Data Protection and Freedom of Information.

Submit a complaint to the Hessian authority

10. Fonts and external links

The Inter font is served with our website. Your browser does not need to connect to Google Fonts to download the font files.

Our website links to external services, including software providers and GitHub. Following a link takes you to a service governed by its provider’s privacy notice. This notice covers our agency website; separate apps and systems operated for clients have their own privacy information.