Privacy statement

Who is responsible

YM Creations, located at Patrijzenweg 1, 1121 EX Landsmeer, the Netherlands, registered with the Dutch Chamber of Commerce (KVK) under number 96175354, is the controller for your personal data. For privacy questions, contact contact@ymcreations.com or +31 6 53 40 02 20.

What we process and why

Contact form and project planner

When you send a message through the contact form or the project planner, we process your name, email address and message and, if you fill them in, your company name and phone number. The project planner also records your answers about the project and your confirmation that you are acting on behalf of a business. We use this to answer your request and, if you want one, to make a proposal. The legal basis is that these steps are needed to enter into an agreement at your request.

Your request is stored in our database and you receive a confirmation by email. If it does not lead to a collaboration, we delete the request twelve months after the last activity.

With a request we also record through which channel the visit to the website began: a referring website, a search engine, an AI assistant such as ChatGPT, or a campaign, and on which page of our site the visit started. We use this to understand which channels lead to business requests. The legal basis is our legitimate interest in assessing our own visibility. For this we do not store the full referring web page, a visitor id, browser characteristics or an IP address; only the name of the source, the channel, a campaign name, keyword and ad variant if the link carried them, and the path of the first page. If you arrived through a Google ad and consented to marketing, we also keep with the request the code Google gave that ad click (gclid, gbraid or wbraid), so we can trace which ad led to a request or an assignment. Without that consent we do not keep that code. This data belongs to the request and is deleted together with it.

Clients, quotes and invoices

If you work with us, we process what the agreement and the administration require: your contact details, company details such as address, Chamber of Commerce and VAT number, and the quotes, invoices and payments that belong to the collaboration. The legal basis is the performance of the agreement and, for the administration, the statutory retention duty. Invoices and other personal data and documents that form part of our tax administration are kept for at least the statutory retention period of seven years. After that, we keep them longer only if there is still a valid legal or administrative reason to do so.

Messages we send from our administration, such as quotes, invoices and payment information, are logged so we can see what was sent and when. The content of messages that are not part of the financial administration is deleted after twelve months.

Payments and direct debit

Payments and direct debit mandates run through Mollie. For that we share your name, email address, the amount and a description with Mollie. Your bank details, such as your account number, are entered at Mollie and are not stored by YM Creations. For our administration we do keep the payment amount, the payment status and the references Mollie assigns to the payment, the customer and the mandate, as far as they are present in our system. For the payment data Mollie processes for its payment service, Mollie is an independent controller; Mollie's privacy policy applies to it.

Visiting the website and security

The website is hosted by Vercel. Every visit involves technical data such as your IP address, your browser and the page requested, used to deliver and protect the website. We use these logs only for security and for fixing errors. The legal basis is our legitimate interest in a secure, working website.

Analytics

Only with your consent do we use Google Analytics to understand how the website is used and to improve it. Data about your visit is then shared with Google. Without consent, Google Analytics is not loaded. You can change your choice at any time under Cookie settings at the bottom of the page. The cookie statement has the details.

Behaviour recordings (Microsoft Clarity)

Only if you give separate consent for behaviour recordings do we load Microsoft Clarity. Clarity records how you use the website: where you click, how far you scroll and how you move from page to page. From that, Clarity creates reconstructed session recordings and click, scroll and attention heatmaps, and flags moments where visitors may get stuck, such as repeated or ineffective clicks and quickly going back. We use this to make the website easier to use. Without that consent Clarity is not loaded, not even if you consented to analytics. The legal basis is your consent; you can withdraw it at any time under Cookie settings.

Forms, such as the contact form and the project planner, are masked in the recordings, and Clarity is not loaded on the payment and direct debit pages. We send Clarity no names, email addresses or other data by which you can be recognised, and we do not link recordings to a request or a client. Clarity does recognise a browser on a later visit by a pseudonymous code in a cookie; see the cookie statement.

For Clarity, Microsoft and YM Creations are each an independent controller. Under Microsoft's terms, Microsoft may also use the personal data it collects through Clarity for its own purposes, including providing and improving its services and creating user profiles, including for advertising (Microsoft Advertising). We signal to Clarity that storage for advertising purposes is not allowed; what Microsoft does with the data is governed by the Microsoft privacy statement. Microsoft keeps recordings for thirty days and click and heatmap data and labelled recordings for nine months.

In addition, we retrieve per-page totals from Clarity, such as the number of sessions, the average scroll depth and the number of repeated or ineffective clicks. We keep these ourselves and use them only in our own admin area; we do not copy recordings or heatmaps.

Advertising measurement (Meta Pixel)

Only if you give separate consent for marketing do we load the Meta Pixel of Meta Platforms Ireland Limited. With it we measure which ads on Facebook and Instagram lead to a visit to the website or to an inquiry, and Meta uses those measurements to show our ads more often to people for whom they are likely to lead to an inquiry. We can also show people who visited the website an ad again later (remarketing). For every page you view, the pixel sends Meta the address of that page, together with technical data such as your IP address and browser and a pseudonymous code from a cookie. When you send an inquiry through the contact form, the project planner or the websitecheck and we have received it, we tell Meta that an inquiry was made and through which form. That report is sent from your browser through the pixel and also directly from our server (Conversions API), under the same identifier so Meta counts the inquiry once; from our server we only send the address of the page, your IP address, your browser details and the codes from Meta's cookies, and only if you consented to marketing. What you type into a form, such as your name, email address, phone number, website address or message, is not sent to Meta. Without that consent the pixel is not loaded, not even if you consented to analytics or behaviour recordings, and it is never loaded on the payment and direct debit pages. The legal basis is your consent; you can withdraw it at any time under Cookie settings.

If you are logged in to Facebook or Instagram, or your browser holds cookies from Meta, Meta may link your visit to your Meta account. For collecting this data on our website and passing it on to Meta, YM Creations and Meta Platforms Ireland Limited are joint controllers; the arrangements for this are set out in Meta's Controller Addendum. For what Meta does with the data afterwards, including showing and measuring ads and improving its own services, Meta is an independent controller; that is governed by Meta's privacy policy. You can exercise your rights with us and with Meta.

Advertising measurement (Google Ads)

Only if you give separate consent for marketing do we load the Google tag for Google Ads of Google Ireland Limited. With it we measure which Google ads lead to a visit, an inquiry, a phone call or a WhatsApp message, and we can show people who visited the website an ad again later (remarketing). Google then receives the address of the page, technical data such as your IP address and browser, a pseudonymous code from a cookie and, if you arrived through an ad, the code of that ad click. When you send an inquiry that we have received, or tap our phone number or the WhatsApp link, we tell Google that this happened. With a received inquiry we also give the Google tag the email address and, if you entered it, the phone number from that inquiry (enhanced conversions). The tag hashes them in your browser (SHA-256) before they go to Google; Google uses them to link the inquiry to a click on an ad. Your name, company, website address and message are not sent to Google. Without that consent Google Ads is not loaded, not even if you consented to analytics, and the consent signals we pass to Google (Consent Mode) are set to denied for advertising. The legal basis is your consent; you can withdraw it at any time under Cookie settings.

For what Google does with this data, including measuring and showing ads, Google is an independent controller; that is governed by Google's privacy policy.

Visibility in search engines

To see how the website is found in search engines, we retrieve figures that Google and Microsoft keep about their own search results from Google Search Console and Bing Webmaster Tools: search terms, pages, clicks and impressions, added up per day or per period. This data comes from the search engines, not from your browser; nothing is placed on your device for it. Search terms that look like an email address, phone number, web address or code are not stored. We never link a search term to a request or to a person. The legal basis is our legitimate interest in understanding how the website can be found.

Which data you have to provide

Data marked as required in a form is needed to handle your request. Without it, we may not be able to handle your request or to perform an agreement. Optional fields are up to you.

Automated decision-making

YM Creations does not use personal data for automated decision-making or profiling that produces legal effects or similarly significant effects for you. The indication the project planner gives is a non-binding estimate based on your own answers; every request is decided on by a person.

Who we share data with

We do not sell data. We share it only with the parties needed to run the website and our services, and only for the purpose listed below.

• Supabase for the database and the storage of requests, client data and documents.
• Resend for sending email, such as confirmations, quotes and invoices.
• Vercel for hosting the website and its technical logs.
• Mollie for payments and direct debit; for the payment data Mollie processes for its payment service, Mollie is an independent controller.
• Google for analytics through Google Analytics, only with your consent, and for advertising measurement and remarketing through Google Ads, only with your consent for marketing; for Google Ads, Google is an independent controller.
• Microsoft for behaviour recordings and heatmaps through Microsoft Clarity, only with your consent for behaviour recordings; Microsoft is an independent controller for this.
• Meta for advertising measurement through the Meta Pixel, only with your consent for marketing; we are jointly responsible with Meta for the collection and transfer, and Meta is an independent controller for any further use.

Transfers outside the European Economic Area

We use external service providers for our website and services, including Vercel, Supabase, Resend, Google Analytics when you consent to analytics, Microsoft Clarity when you consent to behaviour recordings, and Meta and Google Ads when you consent to marketing. Depending on the infrastructure used, these providers may process personal data outside the European Economic Area.

Where personal data is processed outside the EEA, the safeguards required under applicable data protection law apply. Depending on the circumstances, this may for example include an adequacy decision of the European Commission or Standard Contractual Clauses approved by the European Commission.

We use Mollie for payments. Mollie acts as an independent controller for the payment data it processes for its payment services and describes international transfers in its own privacy policy.

How we protect your data

The connection to the website is encrypted. Access to client data is limited to YM Creations and protected by a personal login. Bank details you enter at Mollie are not stored by us.

How long we keep data

• Requests through the contact form or project planner that do not lead to a collaboration: twelve months after the last activity.
• Contact details of prospective clients where no collaboration follows: twelve months after the last contact or the last planned follow-up.
• Invoices and other personal data and documents that form part of our tax administration: at least the statutory retention period of seven years, and after that only for as long as there is still a valid legal or administrative reason.
• The content of other client messages: twelve months; the fact that a message was sent stays on record.
• Your cookie choice: six months.
• Search terms from Google Search Console and Bing Webmaster Tools: sixteen months.
• Per-page totals from Microsoft Clarity in our own database: ninety days. For what Microsoft itself keeps, see behaviour recordings above.

Your rights

In so far as they apply to the processing in question, you have the right to access your data, to have it corrected or deleted, to restrict its processing, to object, and to receive it in a portable form. Consent you have given, for analytics for instance, can be withdrawn at any time. Email contact@ymcreations.com. We normally respond within one month. If a request is complex or there are several requests, the GDPR allows that period to be extended; if so, we will let you know within that first month.

If you are unhappy with how we handle your data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

This statement may change when the website or our services change. The date at the top shows when the text was last updated.