Privacy Policy

Yolia OÜ ("we," "our," or "us") is committed to protecting and respecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Estonian Personal Data Protection Act (Isikuandmete kaitse seadus).

2. Personal Data We Collect

We only collect personal information that is necessary to evaluate collaboration requests, deliver research dissemination services, and communicate with institutional partners. This includes:

• Direct Inquiries & Project Briefs: Full name, academic title, institutional email address, phone number, university/faculty affiliation, grant IDs/project codes, and narrative project descriptions submitted via our Diagnostic Collaboration Wizard or direct email.
• Client Media & Research Assets: High-resolution photographs, recorded video interviews, scientific summaries, microscopy arrays, and graphical figures provided to us during active production contracts.
• Technical & Analytical Data: Anonymized IP addresses, browser specifications, device attributes, and site interaction metrics collected via Google Analytics cookies (subject to your explicit consent).

3. Legal Basis and Purposes of Processing

We process your data under the following GDPR legal bases (Article 6):

• Performance of a Contract / Pre-contractual Measures (Art. 6(1)(b)): To prepare research dissemination proposals, schedule creative briefing calls, execute audiovisual productions, and deliver client visual assets.
• Legitimate Interests (Art. 6(1)(f)): Conducting professional B2B and institutional communication with researchers, PIs, and academic bodies regarding relevant science dissemination frameworks.
• Consent (Art. 6(1)(a)): Operating non-essential analytical cookies (e.g., Google Analytics 4) when you explicitly grant permission through our Cookie Consent Banner.
• Legal Obligation (Art. 6(1)(c)): Retaining accounting, tax, and invoicing records in full compliance with Estonian accounting laws.

4. Data Retention Periods

• Inquiries & Strategic Briefs: Retained for up to 24 months from the last point of contact if no contract is formed, after which they are permanently deleted.
• Client Production Files & Contracts: Project documentation and media files are stored for the duration of the collaboration and archived for a standard client-support period unless earlier deletion is requested.
• Accounting & Invoicing Records: Maintained for 7 years pursuant to the Estonian Accounting Act.

5. Third-Party Processors & Data Security

We never sell, rent, or trade your personal data. We only transmit data to vetted third-party service providers strictly necessary for secure business operations:

• Hosting & Infrastructure: Secure web servers and cloud hosting located within the European Economic Area (EEA).
• Google Analytics 4: Web traffic measurement activated strictly upon user consent, configured with IP anonymization.

6. Your Statutory Rights Under the GDPR

As a data subject in the European Union, you possess the following enforceable statutory rights:

• Right of Access: Request confirmation and copies of personal data held about you.
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your data when no longer required for legitimate processing.
• Right to Restriction of Processing: Request restrictions on how your data is processed in specific scenarios.
• Right to Object: Object to processing based on legitimate interests at any time.
• Right to Data Portability: Request transmission of your data in a structured, machine-readable format.

To exercise any of these rights, email us directly at [email protected].

7. Cookies and Tracking Technologies

Our website utilizes essential technical cookies necessary for core interface functions, as well as optional analytical cookies to measure site performance. You can manage or revoke your cookie preferences at any time by clicking Cookie Settings or visiting the footer link on any page.

8. Supervisory Authority & Complaints

If you believe your personal data is not being handled in compliance with GDPR standards, you have the statutory right to contact or lodge a complaint with the competent supervisory authority in Estonia: