Portal privacy information

Business portal notice, 8 October 2026. This notice covers invited staff and business-owner accounts, and draft business onboarding.

Who is responsible

Think Menai Ltd, company number 16363058, trades as Yma and YmaNow. Our address is Capel Bethel Vestry, Stryd Fawr, Caernarfon, LL54 6PL. Contact [email protected] about your information.

Information we use

We use your name, email address, password hash, account and staff permissions, session records and security checks to provide and protect your account. We do not store your password as readable text. Staff invitations and password recovery are necessary account messages, not marketing subscriptions.

Business onboarding records include business and venue details, optional public contact details, draft descriptions, chosen categories and tags. Assisted admission records the staff member, customer, time and reason. Admission does not prove customer mailbox ownership or publish a listing. Please do not enter unnecessary personal or sensitive information in descriptions or admission reasons.

We process information needed for an individual's requested account service on the basis of contract. Our legitimate interests cover secure operation, staff access management, dealing with business representatives and investigating faults or disputes. You can object to processing based on legitimate interests.

Authorised staff can create an owner account, link it to a business, edit draft details and send a password-setup invitation. The owner chooses their own password and confirms control of their email through a single-use link. Staff changes and invitation requests are recorded in an audit log. Creating an owner account does not give that person staff access or subscribe them to marketing.

Access, providers and storage

Authorised Yma staff can see account and onboarding information needed for their work. Your password is not shown to staff. The portal uses Think Menai's hosted infrastructure and restricted backups. When transactional email is enabled, SMTP2GO receives the recipient address, message and single-use account link to deliver the requested email. Our email service handles replies and support messages.

SMTP2GO operates internationally. We check its processing terms and relevant UK transfer safeguards before enabling transactional sending. Contact our privacy address for information about those arrangements. We do not sell your personal information.

Media, maps and member offers

If you choose postcode search, the entered postcode is sent to Postcodes.io to centre the map. This does not return individual addresses or select your exact pin position.

We store uploaded business media, credits, accessibility descriptions, venue pins and event details. Images are re-encoded to remove embedded metadata. Video files retain their original format. Draft media is available only to the business and authorised Yma staff. Loading the interactive map requests tiles from OpenStreetMap and shares your IP address and the map area with that service.

For invited member offers, we record membership status and expiry, offer terms, short-lived redemption codes and redemption attempts. Participating businesses can validate codes and see their own redemption receipts, but do not receive members’ names or email addresses through this workflow. Yma staff can administer memberships and investigate misuse. Membership does not create a payment subscription or marketing consent.

How long information is needed

We retain account and business records while the account or business relationship is active. After access ends, we review what is still needed to resolve requests, maintain an accountable admission history, investigate security incidents or meet legal obligations. Retention is limited to those purposes, with access restricted where appropriate. Backups are restricted recovery copies and are not used for routine access after an approved deletion.

Verification links expire after 24 hours. Password-setup and recovery links expire after 30 minutes, and work once. Sessions expire after eight hours, with a two-hour inactivity limit. Expiry prevents use of a token or session; it does not itself delete its database record. Security, audit and provider records are reviewed according to operational need. A fuller retention schedule is being finalised before public onboarding opens.

Cookies

The portal uses essential browser-session and authentication cookies to sign you in, protect forms and keep the account secure. It does not use advertising or analytics cookies. Signing out revokes the portal login. No optional marketing consent is bundled with staff access.

Your language choice is stored in an essential preference cookie for up to one year. You can change it using the English / Cymraeg switcher.

Your rights

You can ask for access, correction, deletion or restriction and, where applicable, portability or object to processing. Some information may need to be retained for a legal obligation or a specific dispute. Contact our privacy address; we normally respond within one month. You can complain to the Information Commissioner's Office.

Current scope

Public business registration is closed during the staff setup. Drafts are not publicly discoverable. This portal does not take payments, activate consumer sign-in, publish business profiles or enrol you in marketing. Staff access is for authorised adults acting for Yma.