Privacy notice
Last updated: 5 October 2026
This notice covers yadenone.com, the freelancer portal and YadenOne Books. We process personal data under the UK GDPR, the Data Protection Act 2018 and – for users in the EEA – the GDPR.
1. Controller
Yaden Ltd., 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom · support@yadenone.com
2. What we process and why
| Area | Data | Purpose / legal basis |
|---|---|---|
| Server logs | IP address, time, page requested, browser | Operation and security; legitimate interest (Art. 6(1)(f)). Short retention. |
| Contact form | Name, email, message, topic; shortened IP identifier for spam protection | Handling your enquiry (Art. 6(1)(b)/(f)) and consent (Art. 6(1)(a)). |
| Spam protection | Maths question, timestamp, honeypot, IP address (rate limiting) | Abuse prevention; legitimate interest. No third-party service (no Google reCAPTCHA). |
| Freelancer application & portal | Name, email, specialisation, portfolio link, bio; later address, bank details, tax/VAT details, ID document, contract, e-signature, invoices, sign-in times | Performing the engagement/contract (Art. 6(1)(b)), legal obligations (record keeping, identity/compliance checks; Art. 6(1)(c)), legitimate interest in fraud prevention. |
| Company records & document archive | Documents you upload (e.g. bank statements, contracts) and official company documents we store for you; checksum for duplicate detection; activity log | Contract performance (Art. 6(1)(b)); statutory retention (Art. 6(1)(c)). Only the relevant account and authorised administrators have access. |
| Company-name check | The company name you enter is sent to the public Companies House register for the lookup (without your IP address; the request is made by our server) | Handling your request; legitimate interest (Art. 6(1)(f)). |
| YadenOne Books | Account (email, name, company, password hash), bookkeeping entries, uploaded receipts, settings, payment status, sign-in times | Performance of the contract (Art. 6(1)(b)). Each company sees only its own data. |
| Payments | Payment status, amount, reference. Card/PayPal details go straight to Stripe or PayPal – we do not store them. | Contract performance, statutory retention (Art. 6(1)(b)/(c)). |
| Email delivery | Email address, notification content | Account management, password reset, notifications (Art. 6(1)(b)/(f)). |
3. Recipients / processors
- Hosting provider and email (SMTP) provider – running the platform and sending email.
- Stripe Payments Europe Ltd. / Stripe, Inc. and PayPal (Europe) S.à r.l. et Cie, S.C.A. – payment processing (paid Books plans only).
- Companies House (UK) – the company-name check on the home page sends the entered name to the public Companies House service.
- European Central Bank – exchange rates are fetched server-side; no personal data is sent.
4. International transfers
We are based in the United Kingdom. Adequacy decisions exist between the UK and the EEA. For providers based elsewhere (e.g. Stripe, Inc.) we rely on standard contractual clauses / the UK addendum.
5. Retention
Contact requests: up to 12 months after completion. Books data: as long as the account exists; you can delete your account and data yourself at any time (Settings). Statutory retention duties (e.g. 6 years for accounting and invoice records) remain unaffected. Freelancer data: duration of the engagement plus statutory periods. Expired Books accounts are locked; your data remains available for export.
6. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and may withdraw consent at any time. Write to support@yadenone.com. You may complain to the UK Information Commissioner’s Office (ico.org.uk) or to the data protection authority of your country of residence.
7. Security
Encrypted transport (HTTPS), hashed passwords, strict account separation (multi-tenancy), protected receipt storage outside public access, restricted administrator access, rate limits and spam protection, and logging of security-relevant events.
8. Obligation to provide data / automated decisions
Without the mandatory details we cannot provide the account, portal access or payments. No automated decision-making or profiling takes place.
9. Cookies
Strictly necessary cookies only – details under Cookies.
10. Changes
We update this notice when our services or the law change. The version published here applies.