Privacy Policy
This Privacy Policy explains how Yes House collects, uses, stores, and shares personal data, and the rights you have under EU Regulation 2016/679 (RGPD / GDPR) and the French Loi Informatique et Libertés (n°78-17).
Data controller
The data controller is the legal entity identified in the Mentions Légales. For any data-protection request:
- Email: hello@yes.house
- Postal: [TODO: registered address in France — see Mentions Légales]
What we collect, why, and on what legal basis
| Data category | When we collect it | Purpose | Legal basis (RGPD Art. 6) |
|---|---|---|---|
| Form submissions (name, email, country of residence, nationality, budget range, target regions, listing URLs, timeline, notes) | When you submit a Visit Pack or Buyer Sprint application | To respond to your enquiry and assess the engagement | Art. 6(1)(b) — pre-contractual measures at your request |
| Email correspondence | When you email or WhatsApp us | To handle your enquiry and document the engagement | Art. 6(1)(b) — contract performance |
| Anonymised analytics (IP address, page views, referrer, device, session) | When you accept analytics cookies | To understand how visitors find and use the site | Art. 6(1)(a) — your consent |
| Consent state | On every visit | To remember your accept/reject choice | Art. 6(1)(c) — legal obligation under CNIL guidance |
We do not collect special-category data (health, religion, political opinion, etc.). We do not use form-submission data for advertising, profiling, or sale to third parties.
Processors and recipients
We share data with the following processors only, under data-processing agreements:
| Processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Tally B.V. | Hosts the Visit Pack and Buyer Sprint application forms; receives form submissions on our behalf | Belgium (EU) | EU intra-community processing — no extra-EU transfer mechanism required |
| Google LLC | Google Analytics 4 (GA4) and Google Tag Manager (GTM) — anonymised analytics, only after consent | United States | EU–US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs) |
| GitHub, Inc. | Hosts the static yes.house site (no form data passes through) | United States | EU–US DPF and SCCs (no personal data is transmitted to GitHub by the static site beyond standard server logs at the host’s discretion) |
We do not use any other analytics, advertising, retargeting, or attribution tools.
Retention
| Data category | Retention period |
|---|---|
| Form submissions and email correspondence | 24 months from last contact, unless we are engaged (in which case data is retained for the duration of the engagement plus the legal limitation period applicable in France, typically 5 years under Art. 2224 Code civil) |
| GA4 anonymised analytics | 14 months (set in GA4 admin) |
Consent state cookie (yh_consent) |
12 months from your last action |
Email correspondence in the hello@yes.house mailbox |
Active until manual deletion; subject to access/erasure requests |
After the retention period, data is deleted or anonymised.
Your rights
Under RGPD Articles 15–22, you have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectify inaccurate or incomplete data (Art. 16)
- Erase your data (“right to be forgotten”, Art. 17)
- Restrict processing (Art. 18)
- Portability — receive your data in a structured, machine-readable format (Art. 20)
- Object to processing (Art. 21)
- Withdraw consent at any time without affecting the lawfulness of past processing (Art. 7(3))
- Lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL) — www.cnil.fr/en/plaintes
To exercise any of these rights, email hello@yes.house. We will respond within one month (extendable to three months under Art. 12(3) for complex requests).
Cookies
The yes.house cookie banner is shown on first visit and offers equal-weight Accept and Reject buttons, in accordance with CNIL deliberation 2020-091. By default — and on Reject — analytics tags are blocked via Google Consent Mode v2 (analytics_storage: denied). Only the first-party yh_consent cookie is set in either case, to remember your choice.
You can withdraw or change your consent at any time using the Manage cookies link in the footer. The full inventory of cookies, their purposes and retention is in the Legal Notice § Cookies.
Security
The site is static and served by GitHub Pages over HTTPS. Form submissions travel directly from your browser to Tally over HTTPS; we receive them via Tally’s interface and via email notification. We do not store form submissions on our own servers.
Children’s data
Yes House services are aimed at adult buyers. We do not knowingly collect personal data from anyone under 16. If you believe we have, contact hello@yes.house and we will delete the data.
Changes to this policy
This policy may be updated to reflect changes in our processing or legal obligations. The “Last updated” date below reflects the most recent revision. Material changes affecting how we process your data will be communicated via the site banner.
Last updated: April 2026.