yellow logo

Privacy Notice

Controller: Yellow Method Oy (Business ID: 3210654-7) Address: Aatelitie 8, 01520 Vantaa, Finland Contact: privacy@yellowmethod.ai Supervisory Authority: Office of the Data Protection Ombudsman (tietosuoja.fi)

1. Introduction

This Privacy Notice describes how we process your personal data when you use our websites at yellowmethod.ai, app.yellowmethod.ai (and other subdomains) or our Services, in particular where Yellow Method acts as a data controller.

When we provide the Services to an organisation (typically, your employer), we usually process your assessment data on their behalf as a data processor. In those cases, your employer is responsible for telling you how they use your data, and this Notice should be read together with their privacy information.

2. Data We Collect

  • Identification & Contact: Name, email, phone number, age range, education, preferred language.
  • Professional Background: Education, work experience.
  • Contact Information: Work email address, phone number.
  • Employment Details: Employer name, team, role, function.
  • Assessment Data: Answers to organizational and individual assessments.
  • Device/Usage Data: IP address, browser type, logs, and cookies.

We usually receive your personal data either directly from you (for example when you complete an assessment or create an account) or from your employer, if they are our customer. If you choose not to provide certain information that is marked as required (for example, when creating an account or completing required assessment fields), you may not be able to use some or all of the Services.

We do not seek to collect special categories of personal data (such as information about your health, political opinions, religious beliefs or trade union membership) through the Services. Please do not include such information in free-text fields. If we ever need to process such data, we will ask for your explicit consent or rely on another appropriate legal basis and provide you with additional information.

3. Purposes and Legal Basis

We process data for the following purposes:

  • Provide & Operate Services (user accounts, periodic assessments, creativity insights, action recommendations, longitudinal reporting and historical benchmarking) — Contract (Art. 6(1)(b))
  • Customer Support & Billing — Legitimate Interest (Art. 6(1)(f))
  • Security & Fraud Prevention — Legitimate Interest / Legal Obligation (Art. 6(1)(c), 6(1)(f))
  • Product Improvement (Analytics) — Legitimate Interest in maintaining and improving our Services (Art. 6(1)(f))
  • Research (Aggregated/Anon Data) — Legitimate Interest in improving our Services and contributing to organizational research (Art. 6(1)(f)) plus processing of anonymized data (outside GDPR))
  • Marketing & Non-Essential Cookies — Consent (Art. 6(1)(a))

4. Research and Development

For scientific and statistical research, we primarily use aggregated or anonymized data. Where we process personal data to create these anonymous datasets, we rely on our legitimate interest in improving our Services and advancing organizational research, having balanced this against your rights.

5. Sharing and Roles

  • Service Providers: (e.g., AWS for hosting) acting as processors.
  • Your Employer: If you use the Services via your employer, your employer usually acts as Controller for the assessment data, and Yellow Method acts as Processor on their behalf, in line with our Data Processing Addendum. We share aggregated reporting with your employer as agreed with them.
  • Yellow Method as Controller: For account management, billing and Usage Data (such as logs and device data), Yellow Method acts as an independent Controller, as described in this Notice.
  • Authorities: If required by law.

6. International Transfers

We transfer data outside the EEA only to countries with an Adequacy Decision or by using Standard Contractual Clauses (SCCs) with additional safeguards.

7. Your Rights

You have the right to:

  • Access, Rectify, or Erase your data.
  • Restrict or Object to processing (specifically to direct marketing).
  • Data Portability.
  • Withdraw Consent at any time (for marketing/cookies), without affecting the lawfulness of processing based on consent before its withdrawal.
  • Lodge a Complaint with the supervisory authority in your country of residence (in Finland: tietosuoja.fi).

8. Automated Decision-Making

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. If this changes, we will update this Notice and provide you with additional information.

9. Retention

We keep personal data only for as long as necessary for the purposes described above. Because our Services provide longitudinal analysis and historical benchmarking, we generally retain data for the duration of your (or your employer's) subscription to the Services.

  • Account and contract data: for the duration of the customer relationship and a reasonable period thereafter (typically up to 24 months) for record-keeping, dispute handling and legal obligations.
  • Assessment data: retained for the duration of the Customer's (e.g., your employer's) valid subscription to enable historical reporting and progress tracking. Upon termination of the subscription, data is retained for a grace period of 6 months to allow for account reactivation or data export, after which it is deleted or irreversibly anonymized. This short post-termination retention is based on our legitimate interest in enabling a smooth termination or reactivation of the Services and dealing with any questions or disputes relating to the assessments.
  • Marketing data: until you withdraw your consent or object to marketing, and for a short period thereafter to record your preference.
  • Technical and security logs: for up to 24 months, unless we need to investigate security incidents or legal claims.

We may retain aggregated or anonymized information that no longer identifies you.

10. Cookies

We use strictly necessary cookies to run the site. We place non-essential (analytics/advertising) cookies only with your prior consent, which you can manage via our Cookie Settings.