Summary: We collect only the business contact and project information needed to respond to inquiries and deliver our services. We never sell personal data, we do not use advertising or analytics trackers on this website, and you can exercise your data protection rights at any time by emailing privacy@yakamiglobal.com.
1. Who we are
This website and our services are operated by YAKAMI GLOBAL ("YAKAMI GLOBAL", "we", "us" or "our"), a private limited company registered in England and Wales. For the personal data described in this policy we act as the data controller.
YAKAMI GLOBALRegistered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Company No. 17500195 (incorporated and registered in England and Wales)
General inquiries: contact@yakamiglobal.com
Data protection: privacy@yakamiglobal.com
Data Protection Officer (DPO) contact: questions about this policy or how we handle personal data should be sent to privacy@yakamiglobal.com with the subject line "FAO Data Protection Officer", or by post to the registered office address above, marked for the attention of the Data Protection Officer.
2. Scope of this policy
This policy applies to personal data we process about:
- visitors to this website;
- individuals who contact us or submit an inquiry;
- representatives, employees and contacts of our current, past and prospective business clients; and
- representatives of our suppliers and subcontractors.
Our services are offered to businesses only. Where we process personal data on behalf of a client as part of a software or infrastructure engagement, that processing is governed by a separate Data Processing Agreement (see section 5).
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity & contact data | Name, job title, business email address, company name, business telephone number | You, via our inquiry form, email or meetings |
| Inquiry data | Project scope, estimated budget, message content and any attachments you send | You |
| Contract & billing data | Billing contact details, invoicing address, VAT number, purchase order references, payment status and bank payment references | You, your organisation, our bank and payment providers |
| Communications data | Emails, meeting notes, support tickets and project correspondence | You and your colleagues |
| Technical data | IP address, browser type, device type, requested pages and timestamps recorded in server security logs | Your browser, via our hosting provider |
We do not intentionally collect special category data (such as health, ethnicity or religious beliefs) and ask that you do not send it to us. We do not store full payment card numbers; card payments are handled entirely by authorised, PCI DSS-compliant payment gateways.
4. How we use personal data and our lawful bases
Under Article 6 of the UK GDPR we must have a lawful basis for each purpose for which we use personal data:
| Purpose | Lawful basis |
|---|---|
| Responding to inquiries, preparing proposals and arranging discovery calls | Legitimate interests (responding to business requests) and steps prior to entering into a contract |
| Delivering services, managing projects and providing support | Performance of a contract with your organisation; legitimate interests in managing our relationship with its representatives |
| Invoicing, collecting payment and maintaining accounting records | Performance of a contract; legal obligation (tax and company law) |
| Customer due diligence requested by our bank or payment providers | Legal obligation; legitimate interests in maintaining banking and payment services |
| Securing our website and systems, detecting fraud and abuse | Legitimate interests (network and information security) |
| Sending occasional service updates to existing business clients | Legitimate interests, with a simple opt-out in every message. We do not send unsolicited marketing. |
| Establishing, exercising or defending legal claims | Legitimate interests |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You can ask us for details of this assessment.
5. Client data we process on your behalf (processor role)
When we build, host or maintain systems for a client, we may have access to personal data held in those systems. In that case the client is the data controller and YAKAMI GLOBAL acts as a data processor under Article 28 of the UK GDPR. We will:
- process client personal data only on the client's documented instructions;
- ensure our personnel are bound by confidentiality obligations;
- implement appropriate technical and organisational security measures;
- engage sub-processors only with the client's prior authorisation and under equivalent contractual terms;
- assist the client with data subject requests, security incidents and data protection impact assessments;
- notify the client without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach; and
- delete or return all client personal data at the end of the engagement, unless retention is required by law.
These commitments are set out in full in the Data Processing Agreement that forms part of every client contract. We never use client data to train AI models without the client's prior written consent.
7. International transfers
We prefer UK and European Economic Area (EEA) hosting. Where personal data is transferred outside the UK, we make sure it is protected by one of the following safeguards:
- a UK adequacy regulation covering the destination country (including the EEA and the UK-US Data Bridge for certified US organisations);
- the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses with the UK Addendum; or
- another transfer mechanism permitted under the UK GDPR.
You can request a copy of the relevant safeguards by contacting us.
8. How long we keep personal data
| Data | Retention period |
|---|---|
| Inquiries that do not result in a contract | 24 months from our last contact, then deleted |
| Contracts, invoices and accounting records | 6 years from the end of the financial year to which they relate, as required by HMRC and the Companies Act 2006 |
| Project correspondence and delivery records | 6 years after the end of the engagement, to deal with any legal claims |
| Client personal data processed on a client's behalf | For the duration of the engagement, then returned or securely deleted within 30 days unless the contract states otherwise |
| Website server and security logs | Up to 90 days, unless needed to investigate a security incident |
9. How we protect personal data
We follow information security practices aligned with ISO/IEC 27001, including:
- encryption of data in transit (TLS 1.2 or higher) and at rest;
- multi-factor authentication and least-privilege access to all business systems;
- regular patching, dependency scanning and access reviews;
- encrypted, managed company devices with remote wipe capability; and
- a documented incident response procedure. Where a breach is likely to result in a risk to individuals, we notify the Information Commissioner's Office (ICO) within 72 hours and inform affected individuals where required.
10. Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to:
- Access: obtain a copy of the personal data we hold about you;
- Rectification: have inaccurate or incomplete data corrected;
- Erasure: ask us to delete your data where there is no compelling reason for us to keep it;
- Restriction: ask us to limit how we use your data;
- Data portability: receive data you provided to us in a structured, machine-readable format;
- Objection: object to processing based on legitimate interests, and to direct marketing at any time;
- Withdraw consent: where we rely on consent, withdraw it at any time without affecting earlier processing; and
- Not be subject to solely automated decisions that have legal or similarly significant effects.
11. How to exercise your rights
Email privacy@yakamiglobal.com with the subject "Data Subject Request", or write to our registered office for the attention of the Data Protection Officer. We may ask you to verify your identity before acting on a request.
We respond within one month of receiving a valid request. Where requests are complex or numerous we may extend this by up to two further months and will tell you why. Requests are free of charge unless they are manifestly unfounded or excessive.
If your request relates to data we process on behalf of a client (section 5), we will refer it to that client, as the data controller, and assist them in responding.
12. Complaints
We would appreciate the chance to resolve any concern first, so please contact us. You also have the right to complain to the UK supervisory authority:
Information Commissioner's OfficeWycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint
If you are located in the EEA, you may also contact the data protection authority in your country of residence.
13. Automated decision-making
We do not make decisions about individuals based solely on automated processing, including profiling, that produce legal or similarly significant effects.
14. Children
Our website and services are intended for businesses and are not directed at anyone under 18. We do not knowingly collect personal data from children.
16. Changes to this policy
We review this policy at least once a year and whenever our processing changes. The "Last updated" date at the top shows when it was last revised. Material changes affecting existing clients will be notified by email.
Related documents: Terms of Service · Refund & Cancellation Policy · Cookie Policy