Book a demo
Privacy

Privacy policy

As of: July 2026

This Privacy Policy informs you about the processing of personal data when you visit our website yakady.de ("Website") and when you use our browser-based application for creating asylum follow-up applications at asylfolgeantrag.de ("Web App").

1. Controller

Yakady gGmbH
Gänsemarkt 33
20354 Hamburg
Germany
E-mail: hello@yakady.de

2. Processing activities

We process personal data in the following contexts:

2.1 Visiting the Website

Purposes: When you visit our website, we process your data for the technical operation and IT security of the website. The connection is encrypted (TLS/SSL).

Categories of data:

  • IP address
  • Browser type and version
  • Date and time of access
  • Pages accessed
  • Device information
  • Referrer URL

Legal basis: The processing is based on our legitimate interest in a secure and functional web presence (Art. 6(1)(f) GDPR). We are also legally obliged to ensure an appropriate level of data security (Art. 32 GDPR).

Storage period: We store this data for a maximum of 14 days.

2.2 Using the Web App

With our tool you can create a draft asylum follow-up application. Your application data stays local: All information about your flight history, your file reference number and your address remains exclusively in your browser and is not transmitted to us. Only if you voluntarily leave contact details for impact measurement do we store them (see section 2.3).

Purposes: We process the data you provide in order to enable you to create an asylum follow-up application. In addition, to detect automated access (bot entries) we log technical metadata (timestamps of the processing steps, no application contents).

Categories of data:

  • Name
  • Nationality
  • Contact details
  • Residence status
  • Family members
  • Identity documents
  • File reference number
  • Flight history

Legal bases: The processing of your personal data to create the asylum follow-up application is based on different legal grounds, depending on the type of data collected.

Mandatory fields (e.g. name, file reference number, nationality): The processing of the data requested in the mandatory fields is necessary for the performance of our contract with you or to carry out pre-contractual measures at your request (Art. 6(1)(b) GDPR). Without this information, the asylum follow-up application cannot be created.

Optional free-text fields (e.g. supplementary descriptions of your reasons for flight): The processing of the data entered in the optional free-text fields is based on your voluntary consent (Art. 6(1)(a) GDPR). You may fill in these fields, but you are not obliged to do so. The tool can be used without restriction even without filling in the optional fields. You can withdraw your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out up to the withdrawal.

Special categories of personal data (Art. 9 GDPR): When creating an asylum follow-up application, special categories of personal data may also be processed, such as information about your ethnic origin, religion, political opinion or state of health. For the processing of this data we obtain your explicit consent to the processing of this sensitive data (Art. 9(2)(a) GDPR). You can withdraw this explicit consent at any time with effect for the future.

Storage period: Your application data is not stored on our servers, as it is processed exclusively locally in your browser. We store the consent records (consent text, version, timestamp – without your contact details) for 3 years for evidentiary purposes. We store metadata for a maximum of 14 days.

2.3 Processing for statistical purposes

After creating an application, users of legal age may voluntarily leave contact details for a follow-up survey for impact measurement. Use of the tool is independent of this voluntary information – consent is not a requirement for using the Web App.

Categories of data:

  • First name
  • Last name
  • City
  • Telephone number

Purposes: We process your contact details for impact measurement (follow-up survey on the outcome of the procedure), for creating anonymised statistics, and optionally to help with follow-up questions (only with separate consent). As part of a follow-up survey, we ask whether you submitted the application and how the procedure turned out. We do not store any free text about your flight history. Contact is made by call, SMS or messenger service.

Legal bases: The processing is based on your consent (Art. 6(1)(a) GDPR). For data on the outcome of the procedure, Art. 9(2)(a) GDPR additionally applies. When consent is given, we log the consent text, the version and the timestamp. The legal basis for the anonymisation of your data is Art. 6(1)(a) GDPR in conjunction with Art. 89 GDPR.

Minors: Contact details of minors are not collected. The opt-in field is only shown after confirming "I am 18 years or older".

Storage period: We store your data until the follow-up survey is completed, at most 12 months from consent. After that we anonymise the data (only city and outcome of the procedure in aggregated form) or delete it. In the event of withdrawal, a deletion request or expiry of the period, we delete your data completely, including all backups. We store the consent records (consent text, version, timestamp – without your contact details) for 3 years for evidentiary purposes.

No further purposes: We do not use your data for advertising, do not sell or share any data, do not create profiles and do not use your data for training AI models.

2.4 Contact by e-mail

If you contact us by e-mail, we process your data to handle enquiries and support requests.

Categories of data: When you contact us by e-mail, we store your contact details and the content of the enquiry.

Legal basis: The processing is based on our legitimate interest in communicating with you (Art. 6(1)(f) GDPR).

Storage period: We store your data until the processing is completed, but at most for 3 years. Longer storage only takes place where there is a statutory storage obligation.

2.5 Newsletter / Community

You have the option of subscribing to our newsletter or joining our WhatsApp community.

Newsletter: To send our newsletter, we collect your e-mail address and, optionally, your name. Registration takes place using the double opt-in procedure: after registering, you receive a confirmation e-mail with a link to verify your registration. Only after clicking this link are you added to our mailing list.

WhatsApp community: To join our WhatsApp community we need your telephone number. Via the community we inform you about news, conduct surveys and create anonymised statistics on usage and reach. Further information on data processing by WhatsApp/Meta can be found in section 4 (Recipients).

Legal basis: The processing is based on your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by unsubscribing from the newsletter (link in every e-mail) or leaving the WhatsApp community.

Storage period: Your data is stored for as long as you are subscribed to the newsletter or are a member of the WhatsApp community. After unsubscribing or leaving, your data is deleted, unless there are statutory retention obligations.

2.6 Confirmation of the terms of use and liability notices

Before you use the application generator, you must confirm the notices there (in particular the liability notice and the distinction from legal advice) by ticking a box and clicking the button. We document this confirmation in order to be able to prove that the notices were accepted before use.

Categories of data: For this we do not store any personal data – in particular no name and none of your entries. We store only a randomly generated identifier, the time of confirmation and the version of the notices.

Purpose: Documentation and proof that the terms of use and liability notices were confirmed before use.

Legal basis: The processing is based on our legitimate interest in documenting the confirmation and reducing liability risks (Art. 6(1)(f) GDPR). No personal reference is established in the process.

Storage period: As the record contains no personal data, it cannot be attributed to a person; we keep it – in line with the other consent records – for documentation purposes for 3 years.

3. Use of cookies

We do not use cookies for analytics, marketing or tracking purposes and do not embed any consent-requiring cookies without your consent. A cookie consent banner is therefore not required. Technically necessary cookies or comparable technologies (e.g. local storage) that are required for secure operation and the functions you request are exempt from consent pursuant to Art. 6(1)(f) GDPR in conjunction with Section 25(2)(2) TDDDG.

Web App (asylfolgeantrag.de): The Web App sets no cookies. We store your consent choice in technically necessary local storage (localStorage) on your device, so that we can respect and document your decision; no consent is required for this pursuant to Section 25(2)(2) TDDDG. We carry out anonymous impact measurement only with your consent – cookie-free, without third-party services and exclusively via our own server; in doing so we use an anonymous session identifier in your device's session storage (sessionStorage), which ends when you close the browser tab. Only anonymous usage data with no personal reference is transmitted. You can withdraw your consent at any time.

Website (yakady.de): On our website we do not use any analytics or marketing cookies; web analytics (e.g. Vercel Web Analytics) is not activated.

4. Recipients of personal data

Access to the data transmitted to us is granted exclusively to authorised Yakady staff who have a legitimate interest in the access. We only use external service providers after careful selection. Where service providers act on our behalf, we conclude a data processing agreement (Art. 28 GDPR).

Hosting

Web App (asylfolgeantrag.de): The Web App is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner operates data centres within the EU and processes your data as a processor pursuant to Art. 28 GDPR exclusively in accordance with our instructions. Your contact details are stored encrypted. Further information on data protection at Hetzner can be found at: hetzner.com/de/rechtliches/datenschutz; contact: datenschutz@hetzner.com.

Website (yakady.de): Our website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. In doing so, technical access data (e.g. IP address) may be processed in order to provide the website and ensure its security (Art. 6(1)(f) GDPR). The associated data transfer to the USA takes place on the basis of the EU-US Data Privacy Framework, supplemented by standard contractual clauses. Further information on data protection at Vercel can be found at: vercel.com/legal/privacy-policy.

E-mail service

For sending e-mail we use Strato AG, Pascalstraße 10, 10587 Berlin, Germany. Strato transmits your e-mail enquiries to our mailbox and processes your data as a processor pursuant to Art. 28 GDPR exclusively in accordance with our instructions. Further information on data protection at Strato can be found at: strato.de/datenschutz.

WhatsApp / Meta

When you join the WhatsApp community, your telephone number is transmitted to Meta Platforms Ireland Ltd., Dublin, Ireland. Meta processes your data for information, communication and surveys. The third-country transfer takes place on the basis of the EU-US Data Privacy Framework and the standard contractual clauses. The processing is based on your consent (Art. 6(1)(a) GDPR).

Authorities

We only pass on your data to authorities (e.g. the BAMF) on the basis of your explicit consent or where there is a legal obligation.

Important: Transmission to countries of origin or persecuting states is excluded in all cases. We ensure that no data is transmitted to states from or in which persecution is threatened.

Funders and investors

To funders and investors we only pass on aggregated, anonymised figures (including place of residence at city/region level). We do not transmit names, telephone numbers or individual data records.

5. Your rights under the GDPR

You have the following rights under the GDPR. To exercise your rights, please contact hello@yakady.de or write to us by post at the address given above.

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to withdraw consent (Art. 7(3) GDPR)
  • Right to object (Art. 21 GDPR): You can object to the processing of your data at any time if you have personal grounds. We will then no longer process your data, unless we can demonstrate compelling legitimate grounds.
  • Right to lodge a complaint with the data protection authority (Art. 77 GDPR)

Competent supervisory authority: Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information), Ludwig-Erhard-Str. 22, 20459 Hamburg, mailbox@datenschutz.hamburg.de.

6. Automated decisions

We do not make any automated decisions (Art. 22 GDPR) and do not create profiles.

7. Changes to this Privacy Policy

We reserve the right to adapt this Privacy Policy in the event of changes to our data processing practices or legal developments. You will always find the current version at yakady.de. If you have any questions about our privacy information or the processing of your personal data, please contact us at hello@yakady.de.