Privacy Policy
Last updated: [DATE, e.g. 29 July 2026]
This Privacy Policy explains how YouX collects and processes your personal data when you visit our website at youxlab.co (the "Website") or otherwise get in touch with us. We are committed to protecting your privacy and handling your data in line with the EU General Data Protection Regulation (GDPR) and applicable Slovenian data-protection law.
1. Who is responsible for your data (Controller)
The controller of your personal data is:
[FULL LEGAL COMPANY NAME, e.g. YouXlab d.o.o. / sole proprietor name s.p.]<br>[REGISTERED ADDRESS, Ljubljana, Slovenia]<br>Registration number: [MATIČNA ŠTEVILKA]<br>VAT number: [ID ZA DDV]<br>Email: [CONTACT EMAIL]
For any question about this policy or your data, contact us at the email above. (Given the size and nature of our activity, we are not required to appoint a Data Protection Officer, but you can always reach us directly.)
2. What data we collect
We only collect what we need. Depending on how you interact with us, this may include:
Information you give us directly
- Contact / enquiry forms and "Schedule a call": your name, email address, company name (if provided), and the content of your message or booking. If a booking is made through a third-party scheduling tool, it may also collect the date and time you choose.
- Business correspondence: any information you share with us by email or during calls, e.g. about your product, website, or project.
Information collected automatically
- Technical and usage data: such as your IP address, browser and device type, and how you use the Website (pages visited, referring page). This is collected via our hosting provider and, where you consent, analytics cookies. See our Cookie Policy for details.
What we do not collect
- We do not require you to register or provide an email address to download our sample report.
- We do not knowingly collect special-category (sensitive) data, and we do not use automated decision-making or profiling that produces legal effects on you.
3. Why we use your data and our legal basis
| What we do | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Respond to your enquiry, booking, or message | To answer you and take steps at your request before any possible contract | Steps prior to a contract / our legitimate interest in responding (Art. 6(1)(b) / (f)) |
| Provide agreed services | To deliver a paid engagement you have with us | Performance of a contract (Art. 6(1)(b)) |
| Operate, secure, and improve the Website | To keep the site working, safe, and useful | Our legitimate interest (Art. 6(1)(f)) |
| Analytics and any marketing measurement | To understand and improve how the site performs | Your consent, given via the cookie banner (Art. 6(1)(a)) |
| Invoicing, accounting, and tax records | To meet our legal obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on your consent, you can withdraw it at any time (see Section 6). Withdrawing consent does not affect processing that already took place.
4. Who we share your data with
We do not sell your personal data. We share it only where necessary, with:
- Service providers (processors) who help us run the Website and business — for example our website hosting and forms provider ([e.g. Netlify]), any scheduling/booking tool ([e.g. Calendly]), any analytics provider ([e.g. Google Analytics / Plausible]), and our accountant. These providers process data only on our instructions and under a data-processing agreement.
- Professional advisers or authorities — where we are legally required to disclose information, or to establish, exercise, or defend legal claims.
5. International transfers
We aim to keep your data within the EU/EEA. Some of our providers (for example [Netlify / Google], based in the United States) may process data outside the EEA. Where that happens, we ensure appropriate safeguards are in place — such as the EU–U.S. Data Privacy Framework or the EU Standard Contractual Clauses — so that your data receives an equivalent level of protection. You can ask us for more detail using the contact email above.
6. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- request rectification of inaccurate or incomplete data;
- request erasure ("right to be forgotten");
- request restriction of processing;
- object to processing based on our legitimate interests;
- receive your data in a portable format (data portability);
- withdraw consent at any time, where processing is based on consent.
To exercise any of these rights, contact us at [CONTACT EMAIL]. We will respond within one month, as required by the GDPR.
If you believe we have handled your data unlawfully, you have the right to lodge a complaint with the Slovenian supervisory authority:
Informacijski pooblaščenec Republike Slovenije (IP-RS)<br>Dunajska cesta 22, 1000 Ljubljana — https://www.ip-rs.si
7. How long we keep your data
We keep personal data only as long as needed for the purposes described here:
- Enquiries and correspondence that do not lead to an engagement: kept for a reasonable period to handle follow-ups, then deleted [e.g. up to 12–24 months].
- Client project data and contracts: kept for the duration of the engagement and a reasonable period afterwards.
- Accounting and tax records: kept for the period required by applicable Slovenian tax and accounting legislation.
When data is no longer needed, we securely delete or anonymise it.
8. How we protect your data
We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, or misuse — for example encrypted (HTTPS) connections, access controls, and limiting access to those who need it. No method of transmission over the internet is completely secure, but we take reasonable steps to keep your data safe. If a data breach occurs that is likely to result in a high risk to your rights, we will notify the supervisory authority and, where required, you, without undue delay.
9. Cookies
The Website uses cookies and similar technologies. Non-essential cookies are only used with your consent. For full details, see our Cookie Policy.
10. Children
The Website and our services are intended for businesses and adults. We do not knowingly collect data from anyone under [16] years of age.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post any updated version here and change the "Last updated" date above. If changes are significant, we will take reasonable steps to make them clear.
12. Contact
Questions or requests about your data? Email us at [CONTACT EMAIL].