Privacy Policy.

SIA "New Tech" ("Yena", "we", "us") values the privacy of visitors and users of www.yena.ai and Yena's cloud-based platform (the "Website" and the "Platform"). This Privacy Policy explains how Yena processes Personal Data when acting as data controller for the Website and for Yena's own commercial and administrative activities.

For more information on security, sub-processors, and compliance, visit our Security page.

For Personal Data processed through the Platform on behalf of a Client, the Data Processing Agreement (DPA) governs, as reflected in the Terms and Conditions.

1. Scope of this Policy

This Privacy Policy applies to Personal Data processed by Yena as data controller in relation to:

• visitors of the Website;
• prospects and customers (and their contact persons);
• individuals communicating with Yena (e.g., via forms, email, events).

This Policy complements the Agreement, including the Terms and Conditions, the DPA, and the SLA.

2. Data Controller

The data controller is:

SIA "New Tech"
Mazā Nometņu iela 31, Rīga, LV-1002, Latvia
Commercial Register (Komercreģistrs) No. 40203731548
Contact: [email protected]

3. Personal Data We Process

Depending on context, we may process:

• identification and contact details (name, email, phone, role, company);
• communications (messages, requests, support tickets);
• technical data (IP address, device and log data, cookies);
• account and access data (login details, authentication data, audit logs);
• billing and contract data (where applicable).

We do not intentionally collect dates of birth unless exceptionally required for a specific lawful purpose. We do not collect special categories of personal data (Article 9 GDPR) in relation to prospects or customers.

4. Purposes and Legal Bases

We process Personal Data for the following purposes:

4.1. Website operation and communications

• Responding to questions, demo requests, and contact submissions.

Legal basis: legitimate interests and/or steps prior to entering into a contract.

4.2. Sales and relationship management

• Managing prospect and customer relationships, follow-up, events.

Legal basis: legitimate interests and/or performance of a contract.

4.3. Contract administration and billing

• Subscriptions, Order Forms, invoicing, payments, accounting, compliance.

Legal basis: performance of a contract and legal obligations.

4.4. Security, integrity, and fraud prevention

• Maintaining security, preventing abuse, monitoring availability and integrity of the Platform.

Legal basis: legitimate interests and legal obligations where applicable.

4.5. Disputes and enforcement

• Handling claims, disputes, litigation, and enforcing the Agreement.

Legal basis: legitimate interests and/or performance of a contract and legal obligations.

4.6. Marketing

• Sending product updates, newsletters, event invitations, satisfaction surveys.

Legal basis: legitimate interests and, where required by law, consent (opt-out available at any time).

4.7. Cookies

• Operating the Website and measuring usage.

Legal basis: legitimate interests and, where required, consent. See the Cookie Policy.

5. Sharing of Personal Data

We may share Personal Data with:

• service providers and sub-processors (e.g., hosting, database, analytics, payment processing, email delivery) strictly as needed and under appropriate contractual safeguards;
• third-party integrations enabled by the Client (the Client controls configuration; third-party terms apply);
• authorities where required by law or a valid legal request.

We do not sell Personal Data. A current list of sub-processors — including Stripe (payments), Supabase (database), and our AI service providers — is available on the Security page.

6. International Transfers

Yena's primary production infrastructure is hosted in the European Union (Frankfurt, Germany), with a secondary database managed by Supabase in Basel, Switzerland. Switzerland is recognised by the European Commission as providing an adequate level of data protection under Article 45 GDPR.

Where a service provider operates outside the EEA and no adequacy decision applies, Yena implements appropriate safeguards, including Standard Contractual Clauses (SCCs) under Article 46 GDPR and supplementary measures such as encryption, pseudonymisation, and strict access controls.

7. Data Retention

We retain Personal Data no longer than necessary for the purposes above, taking into account:

• the duration of the customer relationship and the Agreement;
• statutory retention obligations (e.g., accounting and tax records under Latvian law, typically ten (10) years);
• applicable limitation periods for claims.

Retention of Client Data processed through the Platform is governed by the DPA and the Client's instructions, as further described in our Terms and Conditions.

8. Security

Yena applies appropriate technical and organisational measures to protect Personal Data, including access controls, encryption at rest and in transit, continuous monitoring, and least-privilege principles. Details are set out on the Security page. No system is completely secure, and residual risk cannot be eliminated.

9. Your Rights

Where applicable under GDPR and other laws, you may have the right to:

• access, rectification, erasure, restriction;
• objection (including to direct marketing);
• data portability (where applicable);
• withdraw consent at any time (without affecting prior processing);
• lodge a complaint with a supervisory authority.

Requests can be sent to [email protected]. We may request reasonable verification to protect your data. The supervisory authority for SIA "New Tech" is the Latvian Data State Inspectorate (Datu valsts inspekcija, DVI), www.dvi.gov.lv. You may also lodge a complaint with the supervisory authority in your country of residence.

10. Client Data Processed Through the Platform

For Personal Data processed through the Platform on behalf of a Client — including candidate profiles, CVs, contact details, interview notes, and activity logs — the Client is the data controller and Yena acts as data processor, as set out in the DPA forming part of our Terms and Conditions.

Yena processes such data only to provide the Services and as described in the Agreement. Candidates and other data subjects seeking to exercise their rights in relation to Client Data should contact the Client acting as controller; Yena will support the Client in responding, as contractually required.

11. AI and Third-Party AI Providers

Yena provides AI-powered features, including candidate matching, resume parsing, and job-description assistance. As set out in the Agreement and regardless of the marketing materials or defaults of the underlying model providers:

• Yena does not use Client Data — including anonymised or aggregated Client Data — to train, fine-tune, validate, or improve any AI or machine-learning model, whether operated by Yena, its affiliates, or any third party.
• Yena does not make Client Data available to third-party AI providers for training or model-improvement purposes.
• Where third-party AI providers are used to deliver a feature, Yena applies contractual safeguards (including data processing agreements, enterprise/business-tier terms, and, where offered, zero-data-retention settings) no less protective than those set out in our Agreement.
• AI outputs are generated on a probabilistic or non-deterministic basis and are intended as decision support. Human review is required for decisions producing legal or similarly significant effects on candidates, in line with Article 22 GDPR and Regulation (EU) 2024/1689 (the EU AI Act).

If the EU AI Act classifies a given Yena feature as a high-risk AI system, and the Commission publishes applicable contractual clauses, those clauses govern the feature as set out in the Terms and Conditions.

12. Updates

We may update this Privacy Policy from time to time. The updated version will be published on this page and will be effective as of the stated date. Material changes will be notified via email or an in-app notification where reasonably practicable.

13. Contact

SIA "New Tech"
Mazā Nometņu iela 31, Rīga, LV-1002, Latvia
Reg. No. 40203731548 (Komercreģistrs)
Privacy: [email protected]
Legal: [email protected]

EU data subjects have the right to lodge a complaint with the Latvian Data State Inspectorate (www.dvi.gov.lv) or with the supervisory authority in their EU country of residence if they believe our processing of their personal data infringes data protection law.