YKRAFT.tech

Privacy Policy

Privacy Policy

Last updated: 5 August 2026

  1. Who We Are

YKRAFT is a development studio building secure full-stack web applications. YKRAFT is currently run as an individual undertaking; a business registration in Poland (EU) is in progress.

For the purposes of the EU/UK General Data Protection Regulation (GDPR), the data controller for the personal data described in this policy is YKRAFT.

Contact: privacy@ykraft.tech

Once YKRAFT is registered in Poland, this section will be updated with the registered company name and address. In the meantime, contact us at the email above to ask about or exercise any of your rights.

  1. What This Policy Covers

This policy explains what happens to the personal data you give us when you contact us through this website — primarily the "Start a project" enquiry form. It also covers the basic technical data any website processes to function.

  1. What We Collect

3.1 Enquiry data (the "Start a project" form)

When you submit the form, we collect what you provide: your name, email, company or website, what you need built, the stage of your project, budget range, your project description, and how you heard about us. We use this solely to respond to your enquiry and evaluate a potential working relationship.

3.2 Technical data

Session cookie (connect.sid) — strictly necessary for the site to function.

Basic server logs — IP address, browser/user-agent, and request metadata, kept for security and to operate the site.

See our Cookie Policy for the full list of cookies.

  1. How We Use Your Data and Our Legal Basis

Purpose Data used Legal basis (GDPR Art. 6)

Respond to your enquiry / evaluate a project Enquiry data Consent / steps prior to a contract

Security, abuse prevention, debugging Technical data Legitimate interest

We do not use your data for advertising, and we do not sell it.

  1. Sub-processors

We rely on a small number of service providers to run this website and handle enquiries. Each processes personal data only on our instructions:

OVHcloud — website hosting / infrastructure (VPS in France, EU)

Namecheap Private Email — email and notifications

  1. International Data Transfers

Your data is hosted within the EU (OVHcloud, France). Where any provider is located outside the EEA/UK, transfers are made under appropriate safeguards (Standard Contractual Clauses, a UK IDTA, or an adequacy decision).

  1. Data Retention

Enquiry data — kept for up to 24 months unless we begin working together (in which case it is retained under our working relationship), or you ask us to delete it sooner.

Server logs — kept for up to 90 days for security.

  1. Your Rights (GDPR)

You have the right to access, rectify, erase, restrict or object to our processing of your data, to port your data, and to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email privacy@ykraft.tech. We respond within the timeframes required by law (generally one month).

You may also lodge a complaint with your supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO); in the UK, the Information Commissioner's Office (ICO).

  1. Security

We protect personal data with industry-standard measures including encryption in transit (HTTPS), authenticated access, and least-privilege access controls. No system is perfectly secure, but we work to keep your data safe.

  1. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top reflects the latest version.

  1. Contact

Questions, requests, or complaints about your personal data:

privacy@ykraft.tech