Privacy Policy

1. Who we are

This website (de-yan.com, the “Site”) is operated by DE-YAN (“we,” “us,” or “our”), a brand experience studio with offices in North America, Latin America, and the European Union. For the EU and UK General Data Protection Regulation (together, “GDPR”), DE-YAN is the data controller for personal data processed through the Site. For US state privacy laws, we are the “business” that determines the purposes and means of processing. Questions? Contact privacy@de-yan.com.

2. Scope

This policy applies to the public marketing website only. It does not cover any separate product or client engagement governed by its own agreement, including our Prism Break game, which has its own privacy policy.

3. The information we collect

Information you give us directly

When you submit our contact form, we collect your name, email address, and the contents of your message. When you apply through our careers pages, we collect your name, email, phone number, location, the role applied for, work-authorization and remote-work preferences, salary expectations, your resume, and any other details you include. Location entries may be converted into approximate geographic coordinates to standardize them.

Information collected automatically

Depending on your cookie choices, we and the third-party services in Section 5 may collect your IP address and approximate location, device and browser information, the pages you view and links you click, referring URLs, reconstructions of your interactions with pages (for example mouse movement, clicks, and scrolling), and, for business-identification tools, information that may associate your visit with an identifiable individual or company (such as your name, employer, professional profile, or business email).

Cookies and similar technologies

We use cookies and similar technologies (local storage, pixels, and device identifiers). Apart from strictly necessary technologies and our cookieless analytics, these load only after you consent through our cookie banner. See Section 6.

4. Why we use your information

We process personal data for the purposes below. Where the GDPR applies, our legal basis is shown alongside each purpose.

Respond to enquiries

Replying to contact-form messages. Basis: our legitimate interest in answering you, or steps taken at your request before entering a contract.

Process job applications

Reviewing and contacting applicants and recruiting administration. Basis: steps taken at your request before a possible employment relationship, and our legitimate interest in recruiting.

Operate and secure the Site

Hosting, spam and fraud prevention, and error logging. Basis: our legitimate interest in a functioning, secure site.

Measure and improve the Site

Understanding which content performs. Basis: your consent (for cookie-based and identity analytics) or our legitimate interest (for cookieless aggregate analytics).

Marketing and business development

Identifying organizations interested in our work and audience insight. Basis: your consent.

Where we rely on consent, you may withdraw it at any time. Where we rely on legitimate interests, you may object (see Section 9).

5. Third-party services and recipients

We do not sell your personal data for money. We do use third-party services that process personal data on our behalf or receive it as independent controllers. Some of these constitute “sharing” or a “sale” under certain US state laws (see Section 10). The Site uses:

Analytics and measurement

Fathom Analytics (Canada): privacy-focused, cookieless, aggregate analytics that does not identify you and runs without consent. Google Analytics 4, delivered through Google Tag Manager (Google LLC, USA): cookie-based analytics collecting your IP address, device data, and on-site behavior; loaded only with your consent.

Visitor and business identification

RB2B (USA) and Apollo (USA) identify individual visitors and their associated company, which may reveal your name, employer, professional profile, or work email. Loaded only with your consent.

Behavioral analytics

Yandex Metrika (YANDEX LLC): analytics that may include session recording and heatmaps. Data collected by Yandex Metrika is processed on servers located in the Russian Federation. Loaded only with your explicit consent. Please review Section 8 before consenting.

Functional and content services

Google reCAPTCHA (Google LLC, USA) protects our forms from spam, subject to the Google Privacy Policy. Vimeo (USA) serves embedded video in Do Not Track mode, though it still receives your IP address. Sanity and Vercel (USA) provide our content management and hosting (server logs include IP addresses). Make and Monday.com process contact and job-application submissions. Geoapify (Germany) standardizes location text on job applications.

6. Cookies and your consent

The Site is cookieless by default. When our consent banner is active: strictly necessary technologies and our cookieless analytics (Fathom) run without consent; all cookie-based and identity tools (Google Analytics 4, RB2B, Apollo, Yandex Metrika, and any other tag delivered through Google Tag Manager) load only after you click “Accept.” If you decline or take no action, these tools are not loaded and send no data. Your choice is stored locally in your browser, and you can change it at any time using the cookie preferences control. Withdrawing consent stops future loading; it does not delete data already collected, which you may request separately under Section 9. Use the controls at the top of this page to change your choice or opt out.

7. How long we keep your information

We keep personal data only as long as necessary: contact enquiries for as long as needed to handle your request and a reasonable period afterward; job applications for the recruitment process and, where permitted, a limited period afterward; analytics and identification data for each provider’s retention period; and server logs for a short period for security and troubleshooting. When data is no longer needed, we delete or anonymize it.

8. International data transfers

Your personal data may be transferred to and processed in countries outside your own, including the United States (Google, Vercel, Sanity, RB2B, Apollo, Monday.com) and the Russian Federation (Yandex Metrika). These countries may not provide the same level of data protection as your home jurisdiction. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, or on your explicit consent for the specific transfer. Because transfers to the Russian Federation via Yandex Metrika may not be covered by an adequacy decision or standard safeguards, we load Yandex Metrika only with your explicit, informed consent. You may decline.

9. Your rights

EEA, UK, and Switzerland (GDPR)

You may access, rectify, erase, restrict, or object to our processing of your personal data; request data portability; withdraw consent at any time without affecting prior processing; and lodge a complaint with your local data protection authority.

California (CCPA/CPRA) and other US states

You may know what personal information we collect, use, and disclose; access, delete, and correct it; opt out of the “sale” or “sharing” of personal information (our use of tools such as RB2B, Apollo, Yandex Metrika, and Google Analytics may constitute sharing or a sale); limit the use of sensitive personal information; and not be discriminated against for exercising your rights. We honor recognized opt-out preference signals such as Global Privacy Control where required.

How to exercise your rights

Email privacy@de-yan.com, or decline or withdraw consent on our cookie banner. We will verify your request and respond within the time required by law.

10. Sale and sharing of personal information

We do not sell personal information for monetary payment. However, some tracking technologies we use (business-identification tools such as RB2B and Apollo, behavioral analytics such as Yandex Metrika, and advertising-capable analytics such as Google Analytics) may involve disclosures that qualify as a “sale” or “sharing” under California and other US state laws. You can opt out at any time by declining cookies on our banner or by contacting privacy@de-yan.com.

11. Children’s privacy

The Site is not directed to children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, contact privacy@de-yan.com and we will delete it.

12. Security

We use technical and organizational measures appropriate to the risk, including transport encryption (HTTPS), a strict content security policy, server-side validation of all form input, and spam protection. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

13. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide a more prominent notice. Your continued use of the Site after changes take effect constitutes acceptance of the updated policy.

14. Contact

Questions, requests, or complaints can be sent to privacy@de-yan.com or by mail at: