Privacy Policy
This explains what we do with your personal data, why, and how to make us stop. Plain language, no hiding.
1. Who is responsible for your data
The controller of your personal data is TAFLO sp. z o.o., trading as YHYM Marketing, registered at ul. Lipowa 2, 33-206 Smyków, Poland (KRS 0000078480 · NIP 5840203417 · REGON 002895389).
For anything about your data, write to taflospzoo@gmail.com or ring +44 1527 342977.
2. What we collect, and when
When you send the audit form: your name, the type of business you run, your email address and your phone number. We collect nothing else on this site — there are no accounts, no comments and no payments taken here.
When you email or ring us: whatever you tell us, plus the record of the message itself.
Automatically: our hosting provider keeps standard server logs, which include IP addresses, for security and to keep the site running. We do not use those logs to build profiles of visitors.
We do not knowingly collect data from anyone under 16, and we do not ask for special category data (health, beliefs, and so on). Please do not send it to us.
3. Why we use it, and our legal basis
To answer your enquiry and prepare an audit — because you asked us to, and because it is in our legitimate interest to respond to people who contact us about our services (Art. 6(1)(b) and 6(1)(f) GDPR).
To provide services and manage the relationship if you become a client — performance of our contract with you (Art. 6(1)(b)).
To keep accounting and tax records — compliance with our legal obligations under Polish law (Art. 6(1)(c)).
To defend or pursue claims — our legitimate interest (Art. 6(1)(f)).
We do not use your data for automated decision-making or profiling, and we will not send you marketing you did not ask for.
4. Who else sees it
We keep the circle small. Your data may be handled by:
Our form provider. The audit form is delivered by FormSubmit, which passes the submission to our inbox. It sees the contents of the form in transit.
Google (Google Workspace / Gmail). Enquiries arrive in and are stored in our email account.
Our hosting provider, which operates the servers this site runs on.
Our accountants and, where necessary, legal advisers, for invoices, tax and disputes.
They act on our instructions under data processing agreements, or in the case of professional advisers under their own duties of confidentiality. We do not sell your data, and we do not share it with advertisers or data brokers.
5. Transfers outside the EEA
Some of the providers above are based in the United States. Where data is transferred outside the European Economic Area, it is protected by the safeguards permitted under Chapter V GDPR — in practice the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. You can ask us for details of the safeguards that apply.
6. How long we keep it
Enquiries that do not become clients: up to 12 months from your last contact with us, then deleted.
Client records: for the duration of the engagement, and for six years afterwards where accounting and tax rules require it.
Accounting documents: five years from the end of the tax year they relate to, as Polish law requires.
Server logs: a short rolling period set by our host, typically no more than 30 days.
7. Cookies and tracking
This site does not run advertising or analytics trackers. We use only cookies that are strictly necessary for the site to function — and if you never log in, in practice you may see none at all.
If we later add analytics or advertising tools such as Google Analytics or the Meta Pixel, we will ask for your consent before they load, and update this policy first. You can also block or delete cookies in your browser settings at any time.
8. Your rights
Under the GDPR you have the right to: know what we hold about you and get a copy of it; have inaccurate data corrected; have your data erased; restrict how we use it; object to processing based on legitimate interests; receive your data in a portable format; and withdraw consent at any time where we relied on it.
To use any of these, email taflospzoo@gmail.com. We will reply within one month. There is no charge unless a request is excessive or repetitive.
If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
9. Security
We use access controls, strong authentication on our accounts, encrypted connections and a need-to-know approach internally. No transmission over the internet is completely secure, so please do not send us sensitive information by email; ring us instead.
10. Is it required?
Giving us your details is voluntary, but we cannot prepare an audit or answer an enquiry without them. Where the law requires us to keep records — invoices, for example — providing that data is a legal requirement of doing business with us.
11. Changes
If we change how we use personal data we will update this page and the date at the top. Where the change is significant and affects existing clients, we will tell you directly.
This policy is provided for information and does not constitute legal advice.
← Back to the site