Privacy Policy

1. Introduction

Welcome to YAM Digital Limited ("we," "our," or "us"). This Privacy Policy explains how we collect, use, and protect your personal information when you visit our website, contact us via phone, email, or messaging, or use our services. We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018, and the ePrivacy Directive as transposed into Irish law (S.I. No. 336/2011).

When you call our business line, your call is answered by an AI assistant that records audio, generates a transcript, and extracts relevant details to help us follow up on your enquiry. Section 18 of this policy explains this in detail.

2. Data Controller

The data controller responsible for your personal information is:

YAM Digital Limited
Company Registration Number (CRO): 812950
Registered Office: The Mill Enterprise Hub, Newtown Link Road, Drogheda, A92 CD3D, Ireland
Email: [email protected]
Phone: +353 61 788 110
Website: https://yam.ie

For data protection inquiries, please contact us at [email protected].

3. Information We Collect

We collect the following types of information:

3.1 Information You Provide

When you submit our contact form, we collect:

• Your name (required)
• Email address (required)
• Phone number (optional)
• Message content (optional)
• UTM parameters (source, medium, campaign, content, term) – automatically captured from the URL for marketing attribution

3.2 Automatically Collected Information

When you visit our website, the following data may be collected automatically by our hosting infrastructure:

• IP address
• Browser type and version
• Device information
• Pages visited and time of access
• Referring website

We use Google Analytics, where enabled, to understand website usage and relevant actions such as enquiries. Optional analytics and advertising measurement are subject to your cookie/privacy choices and applicable consent requirements; see Section 10 for the current controls and their limitations.

We may also use OpenAI Ads measurement technologies, through our website and server, to understand whether advertising results in visits, enquiries, or other relevant actions. Measurement information may include event details, the page URL, and identifiers such as __oppref and __obref, where applicable.

When you submit an enquiry, limited information such as your email address and, where supplied, phone number may be used for conversion measurement and matching. These contact identifiers are hashed using SHA-256 before being sent to OpenAI for this purpose, rather than being sent as readable email addresses or phone numbers. Hashing does not make these identifiers anonymous: they can still be used for matching.

3.3 Cloudflare Turnstile

Our forms use Cloudflare Turnstile, a CAPTCHA alternative, to protect against spam and abuse. Turnstile may process your IP address and browser metadata to verify that you are a real user. This data is processed by Cloudflare, Inc. under their Privacy Policy. Cloudflare is certified under the EU–U.S. Data Privacy Framework. We use Turnstile on the basis of our legitimate interest in preventing spam (Article 6(1)(f) GDPR).

3.4 Information from Phone Calls

When you call our business line (+353 61 788 110), we collect the following:

• Caller ID – your phone number, as transmitted by the telephone network (unless you have hidden it)
• Call audio – the full audio recording of the conversation
• Call transcript – a text transcription of the conversation generated automatically by our AI voice platform
• Information you provide during the call – including your name, company, role, email address, project details, the reason for your call, and any other information you choose to share
• Call metadata – date, time, duration of the call, which AI agent handled the call, and routing information
• AI-extracted summary and classification – our AI agents may classify your call (e.g., as a sales enquiry, support request, or message) and extract a structured summary to help our team respond efficiently

You will be informed at the start of the call that the call is recorded and processed for service quality and follow-up purposes. If you do not wish your call to be recorded or processed by an AI agent, please contact us via email at [email protected] or via the contact form on our website instead.

3.5 Information from Messaging Channels

If you contact us via WhatsApp (+353 85 146 4070), we collect:

• Your name and profile information as displayed by WhatsApp
• Phone number
• Message content and any attachments you send
• Date and time of the messages

WhatsApp messages are processed by Meta Platforms, Inc. under their own privacy policy.

4. How We Use Your Information

We use your personal information for the following purposes:

• To respond to your enquiries received via phone, email, contact form, or messaging
• To process and follow up on calls received on our business line, including by transcribing calls, extracting key details, and routing your enquiry to the appropriate team member
• To classify enquiries (e.g., new project, existing client matter, message) so we can respond efficiently
• To communicate about potential projects and collaborations
• To deliver and manage services for clients with whom we have a business relationship
• To improve our website, services, and AI agent performance (using anonymised or aggregated data only)
• To attribute relevant actions to advertising, measure conversions, and understand advertising effectiveness, as described in Sections 3.2 and 10
• To comply with legal and accounting obligations
• To protect our rights, property, and safety, and that of our clients

5. Legal Basis for Processing

We process your personal data based on:

• Consent: When you submit the contact form and tick the consent checkbox, you provide consent for us to process your data to respond to your inquiry
• Legitimate Interest: To operate our business communication channels (including phone calls answered by AI agents), respond to enquiries, maintain website security, and improve our services. See Sections 12 and 18 for details on phone call processing.
• Contract: To fulfill service agreements with existing clients, including support and project communications
• Legal Obligation: To comply with applicable laws, including accounting and tax compliance

Processing your enquiry and measuring advertising are separate purposes. The contact form acceptance described above relates to handling your enquiry; it does not constitute consent to advertising or OpenAI Ads tracking. You do not need to agree to optional analytics or advertising measurement to submit an enquiry.

6. Data Storage, Security and Retention

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Your data is stored on secure servers with access controls.

We retain your personal information for the following periods:

• Contact form submissions: 24 months from the date of submission, after which they are permanently deleted
• Phone call recordings and transcripts: Up to 12 months from the date of the call, after which they are deleted from our processing systems. Call summaries and contact details may be retained longer as part of our CRM (see below)
• Phone call summaries and lead records (CRM): For the duration of the business relationship plus 7 years for accounting and legal compliance purposes; or 24 months if no business relationship is established
• WhatsApp / messaging conversations: Retained for the duration of the conversation and up to 24 months afterwards for follow-up; longer if a business relationship is established
• Client project data: For the duration of the business relationship and up to 7 years afterwards for legal and tax compliance purposes
• Session data: Automatically deleted when the session expires (typically 2 hours of inactivity)

7. Data Sharing

We do not sell, trade, or rent your personal information to third parties.

For enquiry handling, communications, and website security, we use the following third-party service providers ("processors") who process personal data on our behalf:

Telephony and AI processing

• Twilio Inc. (USA) – provides our business phone number and routes incoming calls. Twilio processes caller phone numbers, call audio, and call metadata. Twilio is certified under the EU–U.S. Data Privacy Framework. See Twilio Privacy Notice.
• ElevenLabs Inc. (USA) – provides the AI voice platform that answers our calls, generates transcripts, and extracts call summaries. ElevenLabs processes call audio, transcripts, and your conversation contents. We have a data processing agreement with ElevenLabs and rely on Standard Contractual Clauses for the international transfer. See ElevenLabs Privacy Policy.
• Google LLC (USA) – provides large language model services (Gemini) used by some of our AI voice agents to understand and respond to caller requests, and provides our business email infrastructure (Google Workspace) for [email protected]. Google processes call transcripts, conversation context, and the contents of emails sent to or from our business address. Google is certified under the EU–U.S. Data Privacy Framework. See Google Privacy Policy.
• Anthropic, PBC (USA) – provides large language model services (Claude) used by some of our AI voice agents (sales and support) to understand and respond to caller requests. Anthropic processes call transcripts and conversation context. Transfers governed by Standard Contractual Clauses (SCCs) approved by the European Commission. See Anthropic Privacy Policy.

Workflow and notifications

• n8n (self-hosted, EU) – workflow automation platform we operate on our own infrastructure to receive call data and send notifications to our team
• Telegram (Telegram FZ-LLC, UAE) – used internally by our team to receive notifications about incoming calls and messages. Telegram processes the structured summary of your call (your name, company, contact details, summary of your enquiry) for the purpose of notifying our team. See Telegram Privacy Policy.

Forms and security

• Cloudflare, Inc. (USA) – Turnstile CAPTCHA on our website forms; certified under the EU–U.S. Data Privacy Framework

Communication

• Meta Platforms, Inc. (WhatsApp) – when you contact us via WhatsApp; certified under the EU–U.S. Data Privacy Framework. See WhatsApp Privacy Policy.

Other circumstances

We may also share your information:

• When required by law or legal process
• With professional advisors (accountants, lawyers) under confidentiality obligations
• To protect our rights, property, or safety, or that of our clients
• With your explicit consent

The enquiry-handling, communication, and security processors described above are bound by data processing agreements that require them to handle your data in accordance with GDPR.

Analytics and advertising measurement

Where Google Analytics is enabled, website usage and event information is shared with Google. For OpenAI Ads measurement, relevant event information, applicable attribution/browser identifiers, and hashed contact identifiers may be shared with OpenAI as described in Section 3.2. These disclosures concern website analytics, advertising attribution, conversion measurement, and understanding advertising effectiveness.

8. Communication Channels

We offer the following communication channels:

• Email ([email protected]) – hosted on Google Workspace; replies typically within one business day
• Phone (+353 61 788 110) – answered by an AI voice assistant; see Section 18 for details
• WhatsApp (+353 85 146 4070) – processed by Meta Platforms, Inc. under their Privacy Policy
• Website contact form – see Section 3.1

If you prefer not to interact with our AI voice assistant, please use email, the contact form, or WhatsApp instead.

9. Your Rights (GDPR)

Under the General Data Protection Regulation, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restriction: Request limitation of processing
• Right to Data Portability: Receive your data in a structured, machine-readable format (JSON or CSV)
• Right to Object: Object to certain types of processing
• Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month of receipt, as required by GDPR Article 12(3).

10. Cookies and Local Storage

Our website uses the following cookies and browser storage:

Strictly Necessary (no consent required)

• yam_session: Session cookie required for website functionality and form security (CSRF protection). Expires with the session, typically after 2 hours.
• XSRF-TOKEN: Security token that protects against cross-site request forgery. Expires with the session.

Privacy preference storage

• cookie_consent (localStorage): Remembers the general Accept/Decline choice made through our cookie banner. It remains until you reset your choice through Cookie Settings or clear browser data. It is used to remember your preference rather than to measure advertising.

Analytics and attribution storage

• Google Analytics: Where enabled, may use cookies such as _ga to distinguish visits and measure website usage and events.
• OpenAI Ads measurement: May use first-party cookies such as __oppref, which stores an advertising attribution identifier, and __obref, which stores a browser reference for our website.
• yam_lead_attribution_v1 (sessionStorage): Stores campaign parameters, landing page, and referrer information during your browser session so they can accompany an enquiry.

Optional analytics and advertising technologies are subject to your cookie/privacy choices and applicable consent requirements. Their purposes are separate from necessary website functions and processing your enquiry.

You can revisit the general banner choice through Cookie Settings in the website footer. Optional analytics and advertising measurement are activated only with your consent. Declining optional cookies does not activate OpenAI Ads measurement. Withdrawing consent through Cookie Settings stops further OpenAI Ads measurement and disables Google Analytics collection. You can submit an enquiry regardless of your advertising consent choice. You may also manage cookies through your browser and contact [email protected] about your privacy choices.

11. International Data Transfers

Some of our service providers are based outside the European Economic Area (EEA), specifically:

• Twilio Inc. – United States; certified under the EU–U.S. Data Privacy Framework
• ElevenLabs Inc. – United States; transfers governed by Standard Contractual Clauses (SCCs) approved by the European Commission
• Google LLC – United States; certified under the EU–U.S. Data Privacy Framework
• Anthropic, PBC – United States; transfers governed by Standard Contractual Clauses (SCCs) approved by the European Commission
• Cloudflare, Inc. – United States; certified under the EU–U.S. Data Privacy Framework
• Meta Platforms, Inc. (WhatsApp) – United States; certified under the EU–U.S. Data Privacy Framework
• Telegram FZ-LLC – United Arab Emirates; transfers based on appropriate safeguards under GDPR Article 46

Where transfers occur outside the EEA, we ensure appropriate safeguards are in place in compliance with GDPR Chapter V (Articles 44–50), including Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions under Article 45, or certification under recognised frameworks.

You may request a copy of the safeguards in place for any specific transfer by contacting [email protected].

12. Automated Decision-Making

We use AI tools to assist with handling your enquiries, but we do not make automated decisions that produce legal or similarly significant effects about you, as defined under Article 22 GDPR.

Specifically:

• When you call our business line, an AI assistant answers, takes details of your enquiry, and routes the call to a specialist AI agent (sales, support, or message-taking). The AI assistant may also extract structured information from the call (e.g., your name, contact details, project type, urgency) and classify the priority of the enquiry to help our human team respond efficiently.
• All such classifications and summaries are advisory only. Final decisions about whether and how to engage with you (for example, whether to enter into a service agreement) are made by humans on our team, taking the AI summary as input alongside other context.
• You have the right to request that any classification or summary made about you be reviewed by a human, corrected, or deleted. Contact [email protected] to exercise this right.

If you prefer not to interact with our AI voice assistant, you may contact us via email ([email protected]), the contact form on our website, or WhatsApp (+353 85 146 4070).

13. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Data Protection Commission within 72 hours of becoming aware of the breach, as required by Article 33 GDPR. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay (Article 34 GDPR).

14. Children's Privacy

Our website is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

16. Contact Information

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: [email protected]
Phone: +353 61 788 110
Website: https://yam.ie
Address: YAM Digital Limited, The Mill Enterprise Hub, Newtown Link Road, Drogheda, A92 CD3D, Ireland
Company Registration: CRO 812950

17. Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Data Protection Commission (DPC) in Ireland:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2, D02 RD28
Ireland
Website: www.dataprotection.ie

18. AI Voice Agents

When you call our business line (+353 61 788 110), the call is answered by an AI voice assistant rather than a human. We are transparent about this and provide the following information so you can make an informed decision about whether to continue the call.

What happens when you call

1. Greeting and identification: An AI assistant introduces themselves and discloses that they are an AI on our team.
2. Routing: Based on the reason for your call, the AI may transfer you to a different specialist AI agent (e.g., for new project enquiries, existing client support, or to take a message).
3. Recording and transcription: The full audio of the call is recorded and a transcript is generated automatically by our AI voice platform. Our AI agents use industry-leading large language models from third-party providers based in the United States. This is necessary for the AI to function and for us to follow up on your enquiry accurately. Full details of all processors involved, including international transfers and safeguards, are listed in Sections 7 and 11.
4. Information extraction: The AI agent extracts key information from the call (such as your name, contact details, project description, and urgency) and generates a summary for our team.
5. Notification: A summary of your call, including any contact details you provided, is sent to our internal team through a secure messaging channel so the right person can follow up.

Lawful basis

We process your data during phone calls on the basis of:

• Legitimate interest (Article 6(1)(f) GDPR) – to operate a business communication channel and respond to your enquiry. We have assessed that this processing is necessary, proportionate, and that your rights are protected.
• Performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR) – when you are an existing client or are taking steps to enter into a contract with us.

Your rights regarding phone calls

In addition to the rights listed in Section 9, you have the right to:

• Be informed that the call is recorded and handled by an AI (this disclosure is provided at the start of every call)
• Request a copy of any recording or transcript of your own call
• Request deletion of any recording, transcript, or extracted summary
• Object to the processing of your data on legitimate interest grounds (Article 21 GDPR)
• Use an alternative communication channel that does not involve AI processing (email, contact form, or WhatsApp)

To exercise any of these rights regarding phone calls, contact [email protected] with your phone number and the approximate date and time of the call.

Limitations

• Our AI assistants speak English only
• The AI does not make decisions with legal effects on you (see Section 12)
• We do not use AI-extracted call data for purposes beyond responding to your enquiry, internal team notification, and complying with our legal obligations
• We do not use call recordings or transcripts to train AI models – your data is processed only for the purposes described above

Data Protection Impact Assessment

We have conducted an internal review of the data protection risks associated with using AI voice agents and have implemented appropriate safeguards. A more formal Data Protection Impact Assessment (DPIA) is available on request to qualified data subjects, supervisory authorities, or our processors' compliance teams.