Skip to main content
YathumUre

Privacy Policy

Last updated: November 7, 2026

This policy explains what personal data we process when you use this directory, why, and what your rights are under the EU General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection (FADP). We collect as little as possible: families can browse and contact vendors without an account.

1. Who is responsible

The controller of your personal data is Codersclub BV, enterprise and VAT number BE 0788.811.027, RPR Antwerpen, Jozef Hendrickxstraat 111, 2900 Schoten, Belgium. For any privacy question or request, email info@yathumure.com.

2. Families and visitors

You don't need an account to search, view profiles or contact vendors.

  • Searches. We record which category, speciality, event, language and place (such as a city name) was searched, and the distance used, to produce anonymous statistics about demand. If you describe what you need in your own words, single words we could not understand are counted per day so we can teach the search those words; the sentence itself is not stored. These records are not linked to you.
  • “Use my current location”. If you allow it, your browser sends your approximate coordinates to our server to find nearby vendors. We use them only for that search and do not store them.
  • Place search. The text you type into the place field is sent from our server to Mapbox to suggest matching places. Mapbox does not receive your IP address from us.
  • Contact buttons and links. When you tap a vendor's WhatsApp, phone or email button, or open their website or social media link, we count the click (vendor, channel and time) so vendors can see how many enquiries they receive. When you use the share button, we count the share in the same way. We don't record who clicked or shared. The conversation itself then happens directly between you and the vendor, via WhatsApp, your phone or your email provider, under their own privacy policies.
  • Shortlist. Vendors you save are stored only in your browser (local storage) on your device. We don't receive or keep your shortlist.
  • Technical data. Like any website, our servers and hosting providers process your IP address and browser details to deliver pages, keep the service secure and prevent abuse (for example, limiting repeated login attempts). We don't use them to identify you.

Contact form

If you use our contact form, we receive your name, email address and message by email so we can answer you. We don't store the message in our database. The legal basis is our legitimate interest in answering your question (GDPR art. 6(1)(f)). We delete the email once your question is handled, unless we need it for a follow-up.

3. Launch notification list

If you sign up on our pre-launch page, we store your email address, whether you are a family or a vendor, your city (optional) and the date you gave consent. We use this only to email you when the directory launches. The legal basis is your consent (GDPR art. 6(1)(a)). You can withdraw it at any time by emailing info@yathumure.com, and we will delete your details.

If your city is not on our list, you can search for it. As with the place search, the text you type is sent from our server to Mapbox. The city you pick (its name, country and the map position of the city centre, never your address) is stored with your sign-up, and we may add it to our list of cities.

4. Vendors

Account

To list a business you create an account with your email address and a password. Passwords are stored only as a secure hash. We send you emails needed to run your account: email verification, password resets, and notices when your listing is approved or needs changes.

Public listing

Once approved, the following is shown publicly and can be found by search engines: business name, description, categories and specialities, events, home city, travel distance, other cities served, languages, price range, photos, your logo if you add one, and the phone number, WhatsApp number, email address, website and social media links you choose to publish.

Private information

Your business address and its map coordinates are used only to calculate distances in searches. They are never shown publicly. Your login email, moderation history and contact-click statistics are visible only to you and our administrators. We also count how often your listing is shown in search results and how often it is opened. These are daily totals per listing: they say nothing about who the visitors are, and no cookies are used for them.

Legal basis

  • Providing your account and listing: performance of our agreement with you (GDPR art. 6(1)(b)).
  • Reviewing listings before and after publication, keeping the service secure, and producing statistics: our legitimate interest in running a trustworthy directory (GDPR art. 6(1)(f)).

5. Reviews

Clients can review a vendor through the review link the vendor shares with them, or our team enters a review a client has sent us, with their permission.

  • What is public: the name you enter, your city (optional) and your review, on the vendor's page.
  • What stays private: your email address. We use it only to confirm that you wrote the review and to handle your requests about it. It is never shown to the public or to the vendor.
  • Checks: a review is published only after you confirm your email and our team has checked it. Reviews that are never confirmed are deleted after 7 days.
  • Legal basis: your consent, given when you send the review (GDPR art. 6(1)(a)). You can withdraw it at any time by emailing info@yathumure.com; we then remove your review and email address.
  • Retention: as long as the review is shown, or until the vendor's listing is deleted.

6. Cookies and local storage

  • Session cookie (yu_session): set only when a vendor or administrator logs in, to keep them signed in. It is strictly necessary and expires after at most 7 days or when you log out.
  • Local storage (yu_shortlist): holds your shortlist on your own device.
  • Session storage (yu_src): if you arrive through one of our campaign links (for example from Instagram), the campaign name is kept in your browser tab until you close it. If you then register as a vendor or join the launch waiting list, we store that campaign name with your sign-up to learn which posts work. It does not identify you.

We don't use advertising or tracking cookies, and no third-party analytics. Fonts are served from our own servers.

7. Service providers

We use the following providers to run the service. They process data only on our instructions under a data processing agreement:

  • Hetzner Online GmbH: hosting of the website, the database and vendor photos (Germany (EU))
  • Brevo: sending account and notification emails (France (EU))
  • Mapbox: address and place search (US)

Where a provider processes data outside the European Economic Area, the UK or Switzerland, we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework and its UK and Swiss extensions) or Standard Contractual Clauses (with the UK addendum where needed). The EU, the UK and Switzerland recognise each other's data protection as adequate, so data can move between them. We never sell personal data.

8. How long we keep data

  • Vendor account and listing: for as long as the account exists. When the account is deleted, we delete the account, listing, photos, reviews and contact-click statistics.
  • Photos you remove are deleted from storage straight away.
  • Launch notification list: until you withdraw consent, or once the launch announcement has been sent.
  • Search statistics contain no personal data and are kept to understand demand.

9. Your rights

You have the right to:

  • access the personal data we hold about you, and receive a copy in a portable format;
  • correct inaccurate data;
  • have your data deleted. Vendors can do this themselves at any time from their dashboard (“Delete my account”), and it takes effect immediately;
  • restrict or object to processing based on our legitimate interests;
  • withdraw consent at any time, without affecting processing that happened before.

To exercise these rights, email info@yathumure.com. We reply within one month. You can also complain to a data protection authority, in particular in the country where you live or work — for example the Belgian Gegevensbeschermingsautoriteit / Autorité de protection des données, the Dutch Autoriteit Persoonsgegevens, the French CNIL, your German state data protection authority, the Danish Datatilsynet, the UK Information Commissioner's Office (ICO) or the Swiss Federal Data Protection and Information Commissioner (FDPIC).

10. Security

Data is sent over encrypted connections. Passwords are hashed, repeated failed logins lock the account temporarily, and access to administration is restricted to authorised staff.

11. Children

The service is not aimed at children under 16. Vendor accounts are for adults running a business.

12. Changes

We update this policy when our data handling changes. The date below shows the latest version. We will email vendors about significant changes. See also our Terms of Use.