YNF Deals · Legal
GDPR Privacy Notice (EU & UK)
This notice explains how YNF Deals handles personal data when you visit ynfdeals.com from the European Union or the United Kingdom. It supplements our main Privacy Policy with the specific information the GDPR and UK GDPR require. The most important thing to know: although we currently ship only within the United States, if you browse our site or create an account from the EU or UK you have the full set of rights described below, and you can exercise any of them by emailing [email protected].
1. Who this notice covers
This notice applies to you if you use ynfdeals.com from the European Economic Area or the United Kingdom. It reflects the EU General Data Protection Regulation (GDPR) and the UK GDPR, and sits alongside our Privacy Policy, Cookie Policy, and Terms of Service. Where this notice and the Privacy Policy overlap, this notice governs for EU and UK visitors.
Our site is reachable worldwide, but we currently ship only within the United States. From the EU or UK you can still browse the store, create an account, save items, take the Fragrance Finder quiz, and watch our TikTok LIVE auctions — and this notice covers the personal data involved in all of that.
Purchases made through TikTok Shop are checked out on TikTok's own platform. For the data TikTok collects at its checkout and on its platform, TikTok acts as a separate controller under its own terms and privacy policy.
2. Who we are
YNF Deals is the controller of the personal data described in this notice. We are a United States retailer of authentic Arabian and designer/niche fragrances, selling through the ynfdeals.com online store and through live auctions on TikTok LIVE and TikTok Shop.
Our registered address is 585 W Merrick Rd Ste 28 C, Valley Stream, NY 11580, United States. Our privacy contact — which also serves as our data protection contact — is [email protected]. Full contact details are in section 9.
3. What we collect and why
3.1 The data we hold
We collect only what the site needs to work. Depending on how you use ynfdeals.com, this includes:
- Account data — your name, email address, delivery addresses, and sign-in credentials. You sign in with a one-time email code or with Google sign-in; if a password is used, it is stored hashed, never in plain text.
- Order data — what you bought, order status, and payment confirmations from Stripe. We never store full card numbers; payment credentials go directly to Stripe.
- Preference data — your fragrance profile, saved items, and answers you give the Fragrance Finder quiz.
- Support data — messages and tickets you send through the account Support area or by email.
- Device and security data — sign-in and security logs, and the first-party ynf_fp device-recognition cookie used for fraud prevention and to record proof of legal consent.
- Consent records — a tamper-evident record of the legal terms you accepted and the consents you gave.
3.2 Legal bases
The GDPR requires a legal basis for each use of your data. Ours are:
| Purpose | Examples of data used | Legal basis |
|---|---|---|
| Processing your orders and running your account | Name, email, delivery address, order history, payment confirmations | Contract — Article 6(1)(b) |
| Fraud prevention and service security | ynf_fp device-recognition cookie, sign-in and security logs, order patterns | Legitimate interests — Article 6(1)(f) |
| Email marketing and non-essential features | Email address, marketing preferences, fragrance profile | Consent — Article 6(1)(a) |
| Keeping tax and accounting records | Order, invoice, and payment records | Legal obligation — Article 6(1)(c) |
Where we rely on legitimate interests, we have balanced those interests — protecting our customers and our service from fraud and abuse — against your rights, and you may object at any time (section 4). Marketing email is sent only with your consent, and every message contains an unsubscribe link; you can also unsubscribe at /ynf/newsletter/unsubscribe.
We set only first-party cookies for essential functions — sign-in, shopping bag, language and preferences — plus the ynf_fp cookie described above. We use no third-party advertising cookies and no third-party analytics pixels. Cloudflare, our CDN and security provider, may set its own operational cookies for security. Details are in the Cookie Policy.
4. Your rights and how to use them
Under the GDPR and UK GDPR you have the following rights. Every one of them can be exercised by emailing [email protected]; several are also available directly through the privacy tools in your account.
| Right | What it means | How to exercise it |
|---|---|---|
| Access | Get a copy of the personal data we hold about you | Privacy tools in your account, or email us |
| Rectification | Correct inaccurate or incomplete data | Edit your profile and addresses in your account, or email us |
| Erasure | Have your data deleted where we have no legal duty to keep it | Privacy tools in your account, or email us |
| Restriction | Pause our use of your data while a dispute or accuracy check is resolved | Email us |
| Portability | Receive your data in a machine-readable export | Privacy tools in your account, or email us |
| Objection | Object to processing based on legitimate interests | Email us with the processing you object to |
| Withdraw consent | Stop consent-based processing, such as marketing email | Unsubscribe link in any email, /ynf/newsletter/unsubscribe, or email us |
We respond within one month of receiving your request, and we may extend that by up to two further months for complex requests — we will tell you if so. We may ask you to verify your identity before acting, to protect your data from impersonation. Exercising these rights is free of charge.
Some limits apply by law. For example, we must keep order and tax records for seven years even if you ask for erasure, and consent records are retained as legal evidence. Where a limit applies, we will tell you what we kept and why.
You also have the right to complain to a supervisory authority: in the EEA, the data protection authority of the country where you live or work; in the UK, the Information Commissioner's Office. We would welcome the chance to resolve your concern directly first, but you are free to complain at any time.
5. Automated decision-making
Fraud screening of orders is partially automated. Our systems review signals such as order details, device recognition (the ynf_fp cookie), and account history, and may flag, hold, or decline an order that appears fraudulent. If an automated screen goes against you, you may request human review by emailing [email protected]: a person will look at the decision, consider what you tell us, and confirm or reverse it.
We also use AI-assisted tools to help draft product descriptions and triage support requests, and the Fragrance Finder quiz recommends products based on the preferences you state. None of these produce legal or similarly significant effects about you — a human handles your support case, and quiz recommendations are only suggestions.
6. Where your data is processed
We are based in the United States, and your personal data is processed and stored there. When you use our site from the EU or UK, this involves a transfer of your data outside the EEA or UK.
We protect transferred data through data processing agreements with our service providers, incorporating the EU Standard Contractual Clauses — and, for UK data, the UK Addendum to those clauses — with Stripe (payments), Cloudflare (CDN and security), Google (sign-in), and Resend (transactional email). Each provider processes data only on our instructions for the service it delivers, and each maintains its own privacy policy.
Data you give TikTok through TikTok Shop checkout or TikTok LIVE is transferred and protected under TikTok's own arrangements, as TikTok is a separate controller for its platform.
7. How long we keep your data
We keep personal data only as long as the purpose it was collected for requires, or as long as the law obliges us to. The key periods are:
| Data | Retention period |
|---|---|
| Account data | While your account is active, and up to 2 years after last activity |
| Order and tax records | 7 years (legal and accounting obligations) |
| Support tickets | 3 years after closure |
| Security and sign-in logs | 12 months |
| Consent records | Retained indefinitely as legal evidence, in a tamper-evident log |
| Packing quality-assurance videos | 90 days, unless needed for an active dispute |
The full schedule, with the reasoning behind each period, is published at /legal/data-retention. When a retention period ends, we delete the data or anonymize it.
8. We do not sell your data
We do not sell personal data, and we do not share it for cross-context behavioral advertising. There are no third-party advertising cookies and no third-party analytics pixels on our site — no Google Analytics, no Meta pixel.
The only parties that receive your data are the service providers named in section 6, TikTok when you transact on its platform, and delivery carriers (USPS, UPS, FedEx) for shipping US orders. We disclose data beyond that only where the law requires it — for example, tax authorities, or reporting fraud to law enforcement.
9. Contact
For any question about this notice, or to exercise any right in it, contact us — this address also serves as our data protection contact:
YNF Deals
585 W Merrick Rd Ste 28 C
Valley Stream, NY 11580, United States
Email: [email protected]
Phone: +1 516-884-3338