Effective Date: [06-Sept-2016]
Last Updated: [05-July-2026]

1. Our Commitment to Data Protection

Yoan One Solutions LLC ("Yoan One," "we," "us," or "our") is committed to protecting personal data and processing it responsibly, transparently, and securely.

This GDPR & Data Protection Policy describes the framework we use to support compliance with the European Union General Data Protection Regulation ("GDPR"), the UK GDPR where applicable, and other applicable data protection requirements.

This Policy should be read together with our Privacy Policy and other applicable privacy, security, and data governance policies.

2. Scope

This Policy applies to personal data processed by Yoan One in connection with applicable business activities, including:

• B2B lead generation and demand generation

• Content syndication

• Email and digital marketing

• Webinar and event registration

• Account-based marketing

• Data services

• Data validation and enrichment

• Client and prospect management

• Website and digital activities

• Vendor and business-partner relationships

• Internal business operations

It applies to relevant employees, contractors, systems, processes, and third parties handling personal data on behalf of Yoan One.

3. Roles and Responsibilities

Depending on the processing activity and contractual relationship, Yoan One may act as:

Data Controller — where Yoan One determines the purposes and means of processing personal data.

Data Processor — where Yoan One processes personal data on documented instructions from a client or other controller.

Where Yoan One acts as a processor, processing is governed by applicable contractual requirements, including a Data Processing Agreement ("DPA") where required.

Where Yoan One engages processors or subprocessors, appropriate data protection, confidentiality, security, and contractual requirements are applied.

4. GDPR Data Protection Principles

Yoan One seeks to process personal data in accordance with the GDPR principles of:

• Lawfulness, fairness and transparency

• Purpose limitation

• Data minimization

• Accuracy

• Storage limitation

• Integrity and confidentiality

• Accountability

Personal data should only be processed for defined and legitimate purposes and should be appropriate and relevant to those purposes.

5. Records of Processing Activities

Where required by GDPR, Yoan One maintains appropriate Records of Processing Activities ("ROPA").

Depending on the processing activity, records may document:

• Processing activity

• Purpose of processing

• Categories of data subjects

• Categories of personal data

• Data sources

• Applicable lawful basis

• Recipients or categories of recipients

• Processors or subprocessors

• International transfers

• Retention requirements

• Appropriate security measures

The ROPA is reviewed and updated where appropriate to reflect material changes in processing activities.

6. Lawful Basis for Processing

Yoan One identifies an appropriate lawful basis before processing personal data where GDPR applies.

Depending on the circumstances, lawful bases may include:

• Consent

• Performance of a contract

• Compliance with a legal obligation

• Protection of vital interests

• Performance of a task in the public interest, where applicable

• Legitimate interests

The applicable lawful basis depends on the specific processing activity and circumstances.

Yoan One does not assume that one lawful basis applies to every processing activity.

Where appropriate, the lawful basis is documented through relevant records such as the ROPA or related compliance documentation.

7. Legitimate Interests

Where Yoan One relies on legitimate interests under Article 6(1)(f) GDPR, the relevant processing is assessed to determine whether:

1. A legitimate, lawful, clear, and present interest exists;

2. The processing is necessary to achieve that interest; and

3. The interests, rights, and freedoms of affected individuals do not override that interest.

Where appropriate, this assessment is documented through a Legitimate Interest Assessment ("LIA") or equivalent compliance record.

Legitimate interests may, depending on the circumstances, include activities such as managing business relationships, certain B2B marketing activities, fraud prevention, information security, service improvement, and protecting legal or business interests.

Reliance on legitimate interests does not remove an individual's applicable rights, including the right to object to certain processing.

8. Consent

Where consent is the applicable lawful basis, Yoan One seeks to ensure that consent is:

• Freely given

• Specific

• Informed

• Unambiguous

• Provided through an appropriate affirmative action

Consent should not rely on pre-ticked boxes or inactivity where GDPR requires affirmative consent.

Where multiple purposes require separate consent, appropriate choices should be provided where required.

Individuals must be able to withdraw consent as easily as reasonably practicable.

Withdrawal does not affect the lawfulness of processing conducted before consent was withdrawn.

9. Consent Records

Where Yoan One relies on consent, appropriate records are maintained to demonstrate consent where required.

Depending on the applicable system and processing activity, records may include:

• Individual or record identifier

• Consent status

• Date and time

• Source or collection method

• Purpose

• Applicable consent language/version

• Withdrawal or opt-out information

Consent records are retained in accordance with applicable legal, operational, and evidentiary requirements.

10. Transparency and Privacy Information

Yoan One seeks to provide clear and accessible information regarding how personal data is processed.

Where personal data is collected directly from individuals, appropriate privacy information is provided at or around the point of collection where required.

Where information is obtained indirectly, including from third-party or publicly available sources, Yoan One applies applicable GDPR transparency requirements.

Privacy information may include:

• Identity of the controller

• Categories of personal data

• Purpose of processing

• Lawful basis

• Data sources

• Recipients

• International transfers

• Retention

• Individual rights

• Contact information

11. Data Sources

Depending on the processing activity, Yoan One may obtain business and professional information from:

• Individuals directly

• Clients

• Business partners

• Registration and event activities

• Publicly available business sources

• Professional or business directories

• Third-party data providers

• Other lawful business sources

Yoan One seeks to assess the appropriateness of data sources and applies relevant contractual, privacy, security, and due-diligence requirements where applicable.

12. Data Minimization and Purpose Limitation

Yoan One seeks to collect and process only personal data that is adequate, relevant, and reasonably necessary for identified purposes.

Personal data should not be used for materially incompatible purposes unless:

• An appropriate lawful basis exists;

• The additional processing is compatible with the original purpose; or

• Appropriate additional notice or consent is provided where required.

Data collection fields and processing activities may be periodically reviewed to support data minimization.

13. Data Accuracy, Validation and Enrichment

Yoan One takes reasonable steps to maintain personal data that is sufficiently accurate and current for its intended purpose.

Where appropriate, data quality activities may include:

• Validation

• Standardization

• Deduplication

• Cleansing

• Correction

• Updating

• Matching

• Enrichment

Where data is obtained or enriched from additional sources, Yoan One considers applicable transparency, lawful-basis, accuracy, and data-protection requirements.

Individuals may request correction of inaccurate personal data in accordance with applicable rights.

14. Special Categories of Personal Data

Yoan One's B2B marketing and lead-generation services are generally not designed to intentionally collect or process special categories of personal data.

Where such processing is necessary, Yoan One will identify both:

• An appropriate lawful basis under Article 6 GDPR; and

• An applicable condition under Article 9 GDPR.

Appropriate additional safeguards will be applied where required.

15. Direct Marketing

Where GDPR applies to direct-marketing activities, Yoan One considers the applicable lawful basis together with relevant electronic-marketing and communications requirements.

Depending on the circumstances, consent or legitimate interests may apply.

Individuals have the right to object to processing of their personal data for direct-marketing purposes.

Where a valid objection or opt-out is received, Yoan One takes appropriate steps to cease relevant direct-marketing processing and may retain limited suppression information necessary to ensure that the individual's preference continues to be respected.

Additional operational requirements may be addressed through our DNC and marketing-compliance procedures.

16. Data Subject Rights

Subject to applicable conditions and exceptions, individuals may have the following GDPR rights:

• Right to be informed

• Right of access

• Right to rectification

• Right to erasure

• Right to restriction of processing

• Right to data portability

• Right to object

• Right to withdraw consent

• Rights relating to certain automated decision-making and profiling

Yoan One maintains processes for receiving, reviewing, verifying, and responding to valid data-subject requests.

Requests are handled within applicable statutory timelines.

17. Right to Object to Direct Marketing

Individuals may object at any time to the processing of their personal data for direct-marketing purposes.

Where such an objection applies, Yoan One will cease processing the relevant personal data for those direct-marketing purposes, subject to maintaining limited suppression information where necessary to respect the request.

Individuals may also use applicable unsubscribe or Do Not Contact mechanisms.

18. Profiling and Automated Decision-Making

Where applicable, Yoan One may use information for activities such as:

• Audience segmentation

• Campaign targeting

• Lead qualification

• Engagement analysis

• Marketing personalization

• Data matching

Where profiling is performed, Yoan One considers the applicable lawful basis, transparency requirements, individual rights, and risks associated with the processing.

Yoan One does not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals unless permitted by applicable law and appropriate safeguards are implemented.

19. Data Protection Impact Assessments

Where processing is likely to result in a high risk to individuals' rights and freedoms, Yoan One conducts a Data Protection Impact Assessment ("DPIA") where required by GDPR.

A DPIA may consider:

• Nature and scope of processing

• Purpose

• Necessity

• Proportionality

• Risks to individuals

• Existing safeguards

• Additional mitigating controls

DPIAs are reviewed or updated when material changes to the relevant high-risk processing occur.

20. Privacy by Design and by Default

Yoan One seeks to incorporate privacy and data-protection considerations into relevant systems, processes, products, campaigns, and services.

Where appropriate, this includes consideration of:

• Data minimization

• Purpose limitation

• Access controls

• Retention

• Security

• Transparency

• Individual rights

• Default privacy settings

• Vendor and technology risks

Privacy considerations should be addressed during the design or material modification of relevant processing activities.

21. Data Retention and Deletion

Personal data is retained only for as long as reasonably necessary for the purposes for which it is processed and in accordance with applicable legal, contractual, regulatory, and operational requirements.

Retention considerations may include:

• Processing purpose

• Contractual obligations

• Applicable laws

• Client requirements

• Legal claims

• Security requirements

• Consent evidence

• Suppression requirements

When information is no longer required, appropriate deletion, anonymization, or secure disposal measures are applied.

Relevant retention requirements should be documented through internal retention schedules or procedures where appropriate.

22. Data Sharing and Processor Management

Yoan One may share personal data with appropriate clients, service providers, processors, subprocessors, or business partners where necessary and lawful.

Where third parties process personal data on our behalf, Yoan One seeks to ensure that appropriate contractual arrangements are established.

Depending on the relationship, these may address:

• Processing purpose and scope

• Confidentiality

• Information security

• Data-subject rights

• Subprocessing

• Security incidents

• International transfers

• Retention and deletion

• Audit or compliance requirements

Third-party relationships involving personal data may be subject to appropriate due diligence and ongoing review.

23. Data Processing Agreements

Where required under Article 28 GDPR, Yoan One enters into appropriate Data Processing Agreements with relevant controllers, processors, or subprocessors.

DPAs may define:

• Subject matter and duration

• Nature and purpose of processing

• Types of personal data

• Categories of data subjects

• Controller instructions

• Confidentiality

• Security obligations

• Subprocessor requirements

• Assistance with data-subject rights

• Incident notification

• Data return or deletion

• Audit and compliance obligations

Executed agreements are maintained according to applicable contract-management requirements.

24. International Data Transfers

Where personal data subject to GDPR is transferred outside the European Economic Area ("EEA") or another applicable protected jurisdiction, Yoan One considers whether an appropriate transfer mechanism is required.

Depending on the circumstances, safeguards may include:

• Adequacy decisions

• European Commission Standard Contractual Clauses ("SCCs")

• Other legally recognized transfer mechanisms or derogations

Where required, additional transfer-risk considerations and safeguards are assessed.

International transfers are documented where appropriate through relevant contracts, ROPA entries, or compliance records.

25. Information Security

Yoan One maintains administrative, technical, and organizational measures designed to protect personal data appropriate to the nature and risk of processing.

Relevant controls may include:

• Access controls

• Authentication

• Network security

• Data protection

• System monitoring

• Vulnerability management

• Backup and recovery

• Incident management

• Security awareness

• Vendor risk management

• Business continuity measures

Our information security and operational control environment is supported by applicable independent assurance and certification frameworks, including SOC 2 Type II and ISO/IEC 27001:2022, where applicable to the relevant scope.

Security measures are reviewed and improved as appropriate based on risk, technology, business changes, and applicable requirements.

26. Personal Data Breach Management

Yoan One maintains processes for identifying, reporting, investigating, containing, documenting, and remediating suspected personal data breaches.

Where required, Yoan One will notify the relevant controller, supervisory authority, or affected individuals within applicable legal or contractual requirements.

Personal data breaches and relevant response activities are documented where required.

27. Third-Party and Vendor Due Diligence

Where vendors or service providers may process personal data, Yoan One applies appropriate risk-based due diligence.

Depending on the relationship and risk, assessments may consider:

• Privacy practices

• Information security

• Processing location

• Subprocessors

• Certifications and assurance reports

• Contractual protections

• International transfers

• Incident-management capabilities

Higher-risk relationships may be subject to additional review or monitoring.

28. Accountability and Governance

Yoan One seeks to demonstrate accountability through appropriate governance and documentation.

Depending on the processing activity, this may include:

• Privacy and data-protection policies

• ROPA

• Lawful-basis assessments

• LIAs

• DPIAs

• Consent records

• Data retention documentation

• Data processing agreements

• Vendor assessments

• Data-subject request records

• Incident records

• Employee awareness and training

Policies and controls are periodically reviewed and updated as appropriate.

29. Employee Awareness and Confidentiality

Employees and other authorized personnel who handle personal data are expected to comply with applicable privacy, confidentiality, and information-security requirements.

Relevant personnel receive appropriate privacy and security awareness or training based on their roles and responsibilities.

Access to personal data should be limited to authorized individuals with an appropriate business need.

30. Complaints and Supervisory Authorities

Individuals may contact Yoan One with questions or concerns regarding the processing of their personal data.

Where GDPR applies, individuals may also have the right to lodge a complaint with the competent data protection supervisory authority.

We encourage individuals to contact us so that we have an opportunity to review and address privacy concerns.

31. Policy Review and Updates

This Policy is reviewed periodically and may be updated to reflect:

• Changes in applicable laws or regulatory guidance

• Changes in processing activities

• New technologies or systems

• Changes in services

• Audit or assessment findings

• Changes in organizational or security controls

The "Last Updated" date indicates the most recent revision.

32. Contact Us

For questions about this GDPR & Data Protection Policy, our data-protection practices, or an applicable privacy request, please contact:

Yoan One Solutions LLC
333 Park View Avenue
Yonkers, NY 10710
United States

Privacy Email: privacy@yoanone.com
General Email: info@yoanone.com
Phone: +1 914-268-4250

Where Yoan One has appointed a Data Protection Officer or EU/UK representative for a processing activity where such appointment is legally required, the applicable contact information will be made available as required.