Controller and contact details
Y Innovation Lab Kft.
Registered office and postal address: 1103 Budapest, Gergely utca 112/C S2/1., Hungary
Company registration number: 01-09-429696
Hungarian tax number: 32543003-2-42 · EU VAT number: HU32543003
Contact person: Szabó András
hello@yinnolab.com · +36 30 251 6551
The company above operates yinnolab.com and its investment application form. It is responsible for handling applications. András Szabó accesses the material on its behalf. Other companies shown on the website do not automatically receive your application or become its controllers.
Send privacy requests to the email or postal address above. You can also request deletion or withdraw consent directly at szundi@gmail.com, the mailbox that receives applications. No account is needed.
What data do we process?
Your name, email address, company or project name, message of up to 2,048 characters, and PDF presentation are required. Your phone number is optional. We receive these data directly from you. Include only personal data needed for the enquiry in the message and presentation. Do not send health data, identity documents, private contact lists or other special-category data.
We store the form language, submission ID and time, filename, file size and private storage reference. We record both declarations, their server-side acceptance time, text and legal version. A fingerprint derived from the submitted data lets us handle retries safely. We also store email status, attempt count, error codes and the provider message ID. Your IP address is not stored in the application database.
Purposes and legal bases
We use the application data and PDF to assess the enquiry, discuss it with you and keep track of it. The legal basis is your consent under GDPR Article 6(1)(a). We use a phone number only if you supply one. We do not subscribe you to a newsletter, use the enquiry for direct marketing or use the presentation to train AI models.
Consent is voluntary. You can ask about the terms or discuss another submission method without using this form. We cannot run this form-based process without processing the data needed to receive and assess an application. Accepting the terms does not give general permission to process your data.
Proving consent, securing the service and handling a specific legal claim may require a separate, documented legitimate interest under GDPR Article 6(1)(f). These interests include preventing abuse and proving lawful conduct. We use only necessary data and weigh your rights. A disclosure required by law may rely on Article 6(1)(c). These grounds do not give us a general right to continue assessing an application after consent is withdrawn.
Storage, email and access
Application data go to Cloudflare D1. The PDF goes to private Cloudflare R2 object storage. Cloudflare also serves the website and API. The PDF has no public storage URL. The email service can fetch the attachment through a signed URL valid for no more than 24 hours.
Resend (Plus Five Five, Inc.) sends the data and PDF to szundi@gmail.com. This is András Szabó’s Gmail mailbox, so Google also stores the email and attachment. Gmail holds a separate copy. We do not describe this as a Google Workspace account. The email provider may also process delivery and security metadata.
Authorised people involved in the company’s assessment can access the material. Before involving an external expert, we define the task, access scope and suitable confidentiality and data protection duties. A later investment by a different person or a new processing purpose is not automatically covered by this consent. It needs a further notice and a proper legal basis. We disclose data to authorities only on a proper legal basis.
International transfers
Cloudflare, Resend and Google use international infrastructure. Processing may take place outside the European Economic Area, including in the United States. The checkbox is not general consent to risky transfers under GDPR Article 49.
An adequacy decision applies only to recipients within its scope. Otherwise, appropriate safeguards, such as standard contractual clauses and any necessary supplementary measures, are required. Ask us at the contact address above for details and access to the relevant safeguards.
Provider information: Cloudflare data processing terms, Resend data processing terms, Resend subprocessors, Google transfer framework.
Retention: up to 48 months
We keep the application, PDF and declarations for no more than 48 calendar months from submission. This is not a minimum period. We delete earlier if the purpose ends, you withdraw consent or we grant a valid deletion request. The longer period supports the development and discussion cycle of early-stage projects. A loss of interest does not automatically justify continued storage. An internal review does not restart the deadline.
A task runs every ten minutes to delete expired database records and PDFs. If the service fails, deletion resumes after recovery. Downloads of expired files are blocked in the meantime. The same deadline applies to the email, attachment, forwarded copies and local copies. Those copies require separate deletion; storage deletion does not remove the Gmail copy. Provider backups expire under the relevant contract schedule and must not be used for further assessment.
A specific dispute or legal duty may justify keeping the minimum necessary data on a separate legal basis for as long as needed. It does not permit automatic, unlimited retention of the whole presentation. A later investment agreement may have separate records and privacy terms.
Withdrawal and your rights
You can withdraw consent at any time by email, without giving a reason. For example: “I withdraw my consent to processing my investment application.” Include the email address used for submission and, if possible, the project name. Withdrawal does not affect earlier lawful processing. We then stop consent-based assessment and contact. The application can no longer proceed in its original form.
Subject to the GDPR, you can request access, a copy, correction, deletion, restriction and data portability. You can object to processing based on legitimate interests for reasons related to your situation. We verify identity only as needed and do not routinely request identity documents. We normally respond within one month. Complex or numerous requests may require up to two further months; we explain any extension within the first month.
Security and human decisions
We restrict access, use private storage and protect downloads with expiring signatures. The form uses file size limits, PDF format checks and a submission rate limit. These are not a full malware scan or an absolute security guarantee. Cloudflare uses the IP address for a short-lived, per-minute submission counter. We do not put it in the application record. The provider may also process technical data under its own contractual arrangements.
We do not make solely automated investment decisions with legal or similarly significant effects, and we do not profile applicants. A person assesses applications. Technical form validation is not a business decision.
Language, local storage and external links
At the root URL, we first check your saved language choice, then the browser language list. The first Hungarian or Croatian language in that list selects the matching site language. If neither is listed, Cloudflare’s country signal selects Hungarian for Hungary, Croatian for Croatia and English elsewhere. An unknown country defaults to English. Direct /hu/, /en/ and /hr/ URLs do not run automatic country detection. The language selector does not save your IP address or country.
The HU / EN / HR choice is saved in browser local storage under y-language until you clear the site data. It serves only your requested language setting, not tracking. There are no embedded advertising cookies or analytics trackers. Images and fonts load from this website. External sites apply their own privacy rules when you open their links.
Complaints and remedies
You can contact us first, but this is not a condition for going to an authority or court. You can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): 1055 Budapest, Falk Miksa utca 9–11.; postal address: 1363 Budapest, Pf. 9.; email: ugyfelszolgalat@naih.hu. You can also use another competent EEA supervisory authority or court under the GDPR.
Version and legal framework
Version: 2026-10-08.1. We link declarations to this version. Later changes do not extend consent retrospectively. An archived copy is available. Legal framework: the GDPR and the Hungarian Information Act. Presentations are also covered by the Submission Terms.