GDPR · Luxembourg
Privacy Policy
What personal data we process, why we process it, who we share it with and what rights you have.
Last updated: 19 July 2026
Who is responsible for your data
The controller for the processing described in this policy is: Yet Another Artificial Intelligence Company S.a r.l.-S, trading as Yet Technologies 15 Avenue Dr Klein, L-5630 Mondorf-les-Bains, Luxembourg RCS Luxembourg: B292637 - VAT: LU36410809 Email: ask@yet.lu - Phone: +352 621 436 580 We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. Privacy requests are handled directly by our management.
What data we collect
We only collect data you give us or that is strictly necessary to operate this website. When you use the contact form: • Your name, email address, and optionally phone number and company • The service you are interested in, your project description, timeline and budget range • The user agent string of your browser, included in the notification email as a basic anti-abuse measure When you subscribe to our newsletter: • Your email address, the name you provide, your language preference • A record of your consent and the date you subscribed • If you open a newsletter or click a link in one: your IP address, user agent and a timestamp When you use our public AI demonstrations (for example the VAT assistant): • The content of the messages you type, and any VAT number you submit for verification • Your IP address, held briefly in memory for rate limiting only When you simply browse the site: • Standard server and CDN log data generated by our hosting provider • If, and only if, you consent: Google Analytics measurement data (see Cookies and analytics below) We do not ask for special categories of personal data, we do not operate public user accounts, and we do not use automated decision-making or profiling that produces legal effects.
Why we process your data, and on what legal basis
Responding to your enquiry Purpose: to answer your message and take steps at your request prior to entering into a contract. Legal basis: Article 6(1)(b) GDPR (pre-contractual steps), and Article 6(1)(f) GDPR (our legitimate interest in responding to business enquiries). Sending our newsletter Purpose: to send you the content you asked for, and to measure whether our emails are opened and read. Legal basis: Article 6(1)(a) GDPR (your consent). You may withdraw consent at any time using the unsubscribe link in any newsletter. Operating and securing the website Purpose: to deliver the site, keep it available and prevent abuse, spam and automated attacks. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in a secure and functioning website). Analytics Purpose: to understand how the site is used so we can improve it. Legal basis: Article 6(1)(a) GDPR (your consent). No analytics data is collected unless you accept analytics in the cookie banner. Running our public AI demonstrations Purpose: to process the request you submit and return an answer. Legal basis: Article 6(1)(b) GDPR (performing the service you requested) and Article 6(1)(f) GDPR (demonstrating our capabilities). Meeting our legal obligations Purpose: accounting, tax and commercial record-keeping. Legal basis: Article 6(1)(c) GDPR (compliance with a legal obligation under Luxembourg law).
Service providers and international transfers
We use a small number of providers who process personal data on our behalf under Article 28 GDPR data processing agreements. We do not sell personal data and we do not share it for third-party advertising. Vercel Inc. - website hosting and content delivery. Amazon Web Services - transactional and newsletter email (SES), database storage of newsletter subscribers and email engagement (DynamoDB), and file storage (S3). Data is held in AWS EU regions (eu-central-1, eu-west-1, eu-west-2). Google Ireland Limited - Google Analytics 4. Only active if you consent. OpenAI - processes the text you submit to our public AI demonstrations and our internal content tooling. It is called from our servers only; your browser never contacts OpenAI directly. Cloudflare - Turnstile, loaded on the contact page as spam protection. Some of these providers are established outside the EU or have parent companies in the United States. Where personal data is transferred outside the EEA, the transfer is covered by the European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework, together with supplementary technical measures such as encryption in transit. You may request a copy of the relevant transfer safeguards by writing to ask@yet.lu.
How long we keep your data
• Contact form enquiries: kept in our mailbox for as long as needed to handle your request and any resulting business relationship, and in any event no longer than 3 years after our last contact, unless a contract or a statutory accounting obligation requires longer. • Newsletter subscriptions: kept until you unsubscribe. After you unsubscribe we retain your email address in a suppression state so that we can honour your opt-out and not contact you again. • Newsletter open and click records: automatically deleted after 90 days. • AI demonstration conversations: not stored on our servers after the response is returned. • Analytics data: retained by Google Analytics for a maximum of 14 months. • Contractual, accounting and tax records: retained for 10 years, as required by Luxembourg commercial and tax law.
How we protect your data
We apply technical and organisational measures appropriate to the risk, including: • Encryption in transit using TLS for all traffic to and from this website • Encryption at rest for data held with our cloud providers • Access control on the principle of least privilege, with administrative access restricted to named individuals • Rate limiting and spam protection on public forms and endpoints • Logging of administrative access, and regular review of dependencies for known vulnerabilities No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the CNPD within 72 hours and, where the risk is high, inform you directly.
Your rights
Under the GDPR you have the right to: • Access the personal data we hold about you, and receive a copy • Have inaccurate data corrected • Have your data erased where one of the grounds in Article 17 applies • Restrict processing in the circumstances set out in Article 18 • Receive the data you provided to us in a portable, machine-readable format • Object to processing carried out on the basis of our legitimate interests • Withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal To exercise any of these rights, write to ask@yet.lu. We will respond within one month. We may ask you for information to confirm your identity before acting on a request. Exercising your rights is free of charge.
Right to lodge a complaint
If you believe we have handled your personal data unlawfully, we would like the chance to put it right, so please contact us first at ask@yet.lu. You also have the right to lodge a complaint with the Luxembourg supervisory authority at any time: Commission nationale pour la protection des donnees (CNPD) 15, boulevard du Jazz L-4370 Belvaux Luxembourg Telephone: +352 26 10 60 1 Website: www.cnpd.lu If you live in another EU or EEA country, you may instead complain to the supervisory authority of your country of residence or workplace.
Changes to this policy
We update this policy when our processing changes, when a new service provider is introduced, or when the law requires it. The date at the top of this page always reflects the current version. Where a change materially affects how we use your data, we will make it prominent on the site and, where the change relies on consent, ask you again.
Contact us about privacy
For any question about this policy or about how we handle your personal data: Email: ask@yet.lu Post: Yet Another Artificial Intelligence Company S.a r.l.-S, 15 Avenue Dr Klein, L-5630 Mondorf-les-Bains, Luxembourg We aim to acknowledge privacy enquiries within 5 working days and to resolve them within one month, as required by Article 12(3) GDPR.