Privacy Policy

Welcome to Revuto's Privacy Policy!

Please note that this Privacy Policy applies to personal data collected and processed by Revuto OÜ, a company registered in Estonia, Harju maakond, Tallinn, Kristiine linnaosa, Kotkapoja tn 2a-10, 10615, TIN: 16108647, VAT number: EE102322835, and Eucalyptus International Inc., Suite 9, Ansuya Estate, Revolution Avenue, Victoria, Mahe Suite 9, Seychelles (collectively "REVUTO, "we" or "us"). 

REVUTO companies, as joint data controllers, collect and process personal data relating to interactions on the Website and Revuto App (as defined in the Definitions section of the Terms of Use). This Privacy Policy describes how REVUTO uses and protects any information you give us. 

In some cases, other controllers may process your data. For example, if you decide to open an electronic money account and obtain a virtual debit card to manage your subscriptions via Revuto App, Paynovate (as defined in Terms of Use) or Paynovate (as defined in Terms of Use) will act as joint controllers with Revuto. For more information about how these controllers process personal data (as listed in the table below), please see their applicable privacy policies. This Policy applies to the data processing that takes place through or in connection with the following: (a) your use of the Website (as defined in Definition Section of our Terms of Use), (b) your use of the Software (as defined in Definition Section of our Terms of Use) (c) your use of the Revuto App (as defined in Definition Section of our Terms of Use). 

We believe in full transparency, which is why we keep our Privacy Policy simple and easy to understand. 

We strongly urge you to read this Privacy Policy and make sure that you fully understand and agree with it. If you do not agree to this Privacy Policy, please do not access or otherwise use the Website and Revuto App. 

Any capitalized but undefined term in this Privacy Policy shall have the meaning given to it in the Definitions section of the Terms of Use. 

1. DEFINITIONS

2. DATA CONTROLLER

3. WHAT DATA DO WE COLLECT ABOUT YOU AND WHEN?

4. PERSONAL DATA WE PROCESS

5. WHAT WE DO NOT DO?

6. PERSONAL DATA SECURITY

7. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

8. INTERNATIONAL TRANSFER OF YOUR PERSONAL DATA

9. HOW LONG DO WE KEEP YOUR DATA?

10. YOUR RIGHTS

11. CALIFORNIA RESIDENTS PRIVACY NOTICE

12. CHANGES TO PRIVACY POLICY

1. DEFINITIONS

When we say "consent" we mean your explicit consent on the processing of personal data. Persons aged 18 or older may give free consent to the processing of their personal data.

When we say "cookies" we mean small pieces of data stored on your device (computer or mobile device). This information is used to track your use of the Website and to compile statistical reports on website activity. For further information about the use of cookies and how you can manage them, please read our Cookie Policy.

When we say "Data controller“ we mean the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

When we say "Data Processors" or "processor," we mean any natural or legal person who processes the data on behalf of the Data Controller. In addition, we may engage various service providers to process your data more effectively. In such cases, they are either our processors or sub-processors.

When we say "Data Subject", bsp;"you" or "your" or we mean any natural person that shares personal data with us via Revuto.

When we say “GDPR” we mean the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

When we say "processing," we mean any operation or set of operations that is performed on personal data or sets of personal data. This includes activities such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

When we say "personal data" or "data," we mean any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, either directly or indirectly. Therefore, data about a company or any legal entity is not considered personal data, but registering on behalf of a legal entity may involve sharing personal data. For example, information relating to one-person companies may constitute personal data where it enables the identification of a natural person. The rules also apply to all personal data relating to natural persons in the course of professional activity, such as the employees of a company or organization, business e-mail addresses like "[email protected]". This Privacy Policy does not apply to information from which no individual can reasonably be identified (anonymized information).

When we say „Special categories of personal data“ we mean personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, and biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

2. DATA CONTROLLER

Revuto OÜ is a company registered under the laws of Estonia, and as a Data Controller it determines the purposes and means of processing personal data. Data controllers are responsible for your personal data. The purpose of data processing is the reason why we process your personal data. The table in Section 4 of the Privacy Policy presents the purposes and legal basis for data processing. In such cases, REVUTO is responsible for your personal data.

If we obtain your consent to process your personal data for one purpose (for example, to obtain a Revuto Debit Card) and need to use it for a different purpose (in accordance with Section 4), we will require your prior consent to use your data for that purpose. 

3. WHAT DATA DO WE COLLECT ABOUT YOU AND WHEN?

We may collect and receive information about you in various ways:

• (i) Information you provide through the use of the Revuto Services, Revuto Website, and Revuto App (for example, by creating an account on the Website).
• (ii) Information you decide to provide through getting in touch with us via our Contact page.
• (iii) Information we collect through the use of cookies in accordance with our Cookie Policy (for example, your time zone).

4. PERSONAL DATA WE PROCESS

5. WHAT WE DO NOT DO?

REVUTO will never:

• Sell any kind of personal information or data
• Disclose this information to marketers or third parties not specified in Section 7
• Process your data in any way other than stated in this Privacy Policy.

6. PERSONAL DATA SECURITY

REVUTO takes the privacy and security of its members' personal information seriously. We maintain administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of your information. 

Upon assessing whether a measure is adequate and which level of security is appropriate, we consider the nature of the personal data we are processing and the nature of the processing operations we perform, the risks to which you are exposed by our processing activities, the costs of the implementation of security measures and other relevant matters in the particular circumstances.

Some of the measures we apply include access authorization control, information classification (and handling thereof), protection of integrity and confidentiality, data backup, firewalls, data encryption, and other appropriate measures. We equip our staff with the appropriate knowledge and understanding of the importance and confidentiality of your personal data security.

We protect the personal information you provide online when registering as a user of our Website or Revuto App. Access to your personal information is available via a password you set. This password is encrypted both during transmission from your browser to our servers and while stored on our systems. To protect the security of your personal information, never share your password to anyone. Please notify us immediately if you believe your password has been compromised.

Whenever we save your personal information, it’s stored on servers and in facilities accessible only to selected REVUTO personnel and our contractors. We encrypt all data you submit through the Website in transit using Transport Layer Security (TLS) to prevent unauthorized parties from viewing it. Remember – all information you submit to us by email is not secure, so please do not send sensitive information in any email to REVUTO. We never request that you submit sensitive or personal information via email, so please report any such requests to us by emailing [email protected].

Steps you can take to help us keep your information safe

There are many steps you can take to help us keep your information safe. First and foremost, choose complex, independent passwords for each website and service you maintain an account with. This helps keep any breach of any of your accounts isolated to one service. Also, don’t use anything related to your birthday, address, phone number, PIN number or any other easily guessable information in your password.

REVUTO urges you to exercise caution when using public computers or networks, like at a coffee shop or library. To best protect your personal information and login information, don’t use such computers to access your sensitive accounts, and if you must, ensure that you logout of your account entirely.

When either you or we update information in your account, such as the status of your account or Revu Token (REVU) balance, we typically send you notice of these changes via email or text message. In recent years, individuals, businesses, and even governments have seen a rise in “phishing” attacks. Phishing occurs when someone attempts to obtain your password or other sensitive information. Scammers often do this by impersonating a trusted user or by offering a compelling reason to open a malicious email attachment, click on a link, or give over information. We never ask for your sensitive personal information, such as passwords, via email, other insecure methods, or through any site not under the revuto.com domain. Please notify us at [email protected] if you ever receive suspicious correspondence from us.

7. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

REVUTO utilizes external processors for certain processing activities. We use information audits to identify, categorize, and record all personal data processed outside the company, so that the information, processing activity, processor, and legal basis are all documented, reviewed, and readily accessible.

We have strict due diligence procedures and measures in place, and we review, assess, and conduct background checks on all processors prior to forming a business relationship. We obtain company documents, certifications, and references, and ensure that the processor is adequate, appropriate, and effective for the task we are employing them to perform.

We audit their processes and activities both prior to the contract and during the contract period to ensure compliance with data protection regulations and review any codes of conduct that require them to confirm compliance.

This is the list of processors with whom we share your personal data:

We may also share your personal data with our outside accountants, legal counsel, and auditors.

• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation;
• to prevent and detect fraud or crime;
• in response to a subpoena, warrant, court order, or as otherwise required by law.

Finally, personal information may be disclosed or transferred as part of, or during negotiations of, a merger, consolidation, sale of our assets, as well as equity financing, acquisition, strategic alliance or in any other situation where personal information may be transferred as one of the business assets of Revuto.

We do not have a list of all third parties with whom we share your data, as this would depend on your specific use of our Services. However, if you would like further information about who we have shared your data with, or a list specific to you, you can request this by emailing [email protected].

8. INTERNATIONAL TRANSFER OF YOUR PERSONAL DATA

We may transfer your personal data to countries other than the one you reside in. In these cases, we will transfer your personal data only:

1. To the countries within the EEA;
2. To the countries that do not form the EEA but are considered to ensure an adequate level of protection;
3. To the countries that do not belong to those specified under items 1 and 2, but only by applying the appropriate safeguard measure in accordance with the GDPR.

9. HOW LONG DO WE KEEP YOUR DATA?

The period for which we store your personal data depends on the particular purpose for the processing of personal data, as explained in detail in Section 4 of this Privacy Policy. We retain personal data for as long as we reasonably require it for legal or business purposes. In determining data retention periods, we consider applicable law (see Section 21 of the Terms of Use), contractual obligations, and our Users' expectations and requirements. When we no longer need your personal information, or when you request that we delete it, where this is legal, we will securely delete or destroy it.

Personal data we collected for your early access to Revuto will be deleted by the end of February 2022, provided you have not continued using our Services.

However, as an exception to the retention periods in Section 4 of this Privacy Policy, the data may be processed to determine, pursue, or defend claims and counterclaims.

10. YOUR RIGHTS

As a Data Subject in the EEA whose personal information we hold, you have certain rights under the GDPR. This section of the Privacy Policy aims to provide you with a general understanding of these rights. In relation to each of the rights noted below, we provide a reference to the specific provision of the GDPR from which that right arises.

Right of Access (Article 15 GDPR)

You can request a copy of the personal data we hold about you.

We have ensured that appropriate measures have been taken to provide such information in a concise, transparent, intelligible, and easily accessible form, using clear and plain language. Such information is provided in writing free of charge. It may be provided by other means when authorized by the Data Subject and with prior verification as to the subject’s identity.

Information is provided to the Data Subject at the earliest convenience, but no later than 30 days from the date the request was received. Where the retrieval or provision of information is particularly complex or is subject to a valid delay, the period may be extended by two further months where necessary.

Right to Correction of Your Personal Data(Article 16 GDPR)
If the personal data we have about you is incorrect, you have the right to request that we correct that data. When notified of inaccurate data by the Data Subject, we will rectify the error within 30 days and, if we have disclosed the personal data in question to any third party, inform them of the rectification.
Right to Be Forgotten or Right to Erasure (Article 17 GDPR)

You have the right to request from us that your personal data is deleted in certain circumstances, including:

• - The personal data are no longer needed for the purpose for which they were collected;
• - You withdraw your consent (where the processing was based on consent);
• - You object to the processing, and no overriding legitimate grounds justify us processing the personal data;
• - The personal data have been unlawfully processed; or
• - To comply with a legal obligation.

However, this right does not apply where, for example, the processing is necessary:

• - To comply with a legal obligation; or
• - For the establishment, exercise or defense of legal claims.

Right to Restriction of Processing (Article 18 GDPR)

If the accuracy of the personal data is contested, you consider the processing unlawful, but you do not want it erased; we no longer need the personal data, but you require it for the establishment, exercise, or defense of legal claims; or you have objected to the processing and verification, you can exercise your right to the restriction of processing.

Right to Withdraw the Consent (Article 13(2)c) GDPR)

If you have provided your consent to the collection, processing and transfer of your personal data, you have the right to fully or partly withdraw your consent. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented unless there is another legal ground for the processing.

Right to Lodge a Complaint

If you have any concerns or requests in relation to your personal data, please contact us at [email protected], and we will respond as soon as possible, but no later than 30 days.

If you are unsatisfied with how we process your data, you may contact the competent supervisory authority.

In case you believe that we are processing your personal data in violation of the GDPR, you have the right to lodge a complaint with the supervisory authority located in the EEA where you reside or work or where the alleged infringement took place.

11. 1. CALIFORNIA RESIDENTS PRIVACY NOTICE („Notice“)

This Section supplements the information contained in REVUTO's Privacy Policy and applies to visitors, users, and other individuals who reside in the State of California and whose personal information falls within the scope of the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”).

REVUTO respects the privacy rights of California residents and processes their personal information in accordance with applicable California privacy laws.

Any capitalized term not otherwise defined in this Notice shall have the meaning assigned to it under the CCPA, REVUTO's Terms of Use, Privacy Policy, or Cookie Policy, as applicable.

This Notice forms an integral part of our Privacy Policy.

Information We Collect

For information regarding the categories of personal information collected by REVUTO, please refer to Section 4 of this Privacy Policy – Personal Data We Process.

Information regarding the sources from which personal information is collected is provided in Section 3 – What Data Do We Collect About You And When?

Use of Personal Information

REVUTO collects and processes personal information for the business and commercial purposes described in Section 4 of this Privacy Policy.

Sharing Personal Information

REVUTO may disclose personal information to service providers, contractors, and other third parties for the purposes described in Section 7 of this Privacy Policy – With Whom Do We Share Your Personal Data?

REVUTO also uses third-party cookies and similar technologies for advertising and analytics purposes, as further described in our Cookie Policy.

Depending on their configuration and use, certain advertising technologies may constitute the sharing of personal information for cross-context behavioral advertising under the CCPA. Where applicable, REVUTO provides consumers with the right to opt out of such sharing.

Sale and Sharing of Personal Information

REVUTO does not sell personal information for monetary consideration.

However, under the CCPA, the term "sale" may include certain disclosures of personal information for valuable consideration other than money, and "sharing" may include disclosures for cross-context behavioral advertising, regardless of whether monetary consideration is exchanged.

Where REVUTO's processing activities constitute a sale or sharing of personal information under applicable law, REVUTO will comply with the relevant disclosure and opt-out requirements.

REVUTO does not knowingly sell or share the personal information of consumers under 16 years of age without the affirmative authorization required by applicable law.

Your Rights and Choices

California residents may exercise the rights described below where REVUTO is subject to the CCPA and acts as a business determining the purposes and means of processing their personal information.

Right to Know and Access Personal Information

You have the right to request information regarding the personal information REVUTO has collected about you, including:

The categories of personal information collected;

The categories of sources from which the personal information was collected;

The business or commercial purposes for collecting, selling, or sharing personal information;

The categories of third parties to whom personal information has been disclosed; and

The specific pieces of personal information collected about you, subject to applicable legal exceptions.

Where required by law, you may request access to personal information collected beyond the preceding 12 months, subject to applicable limitations.

Right to Data Portability

You have the right to receive certain personal information in a readily usable format that, to the extent technically feasible, allows you to transmit the information to another entity without hindrance.

Right to Correct Inaccurate Personal Information

You have the right to request that REVUTO correct inaccurate personal information maintained about you, taking into account the nature of the information and the purposes for which it is processed.

Upon receiving and verifying your request, REVUTO will use commercially reasonable efforts to correct inaccurate personal information in accordance with applicable law.

REVUTO may request additional information reasonably necessary to verify your identity and evaluate the accuracy of the information concerned.

Right to Deletion

You have the right to request that REVUTO delete personal information collected from you, subject to exceptions permitted under the CCPA.

REVUTO may retain certain personal information where necessary to comply with legal obligations, complete transactions, provide requested services, protect against fraud or security incidents, exercise legal rights, or fulfill other purposes permitted by applicable law.

Where required by law, REVUTO will also instruct relevant service providers and contractors to delete personal information associated with an approved deletion request, subject to applicable exceptions.

Right to Opt Out of the Sale or Sharing of Personal Information

You have the right to direct REVUTO not to sell your personal information or share it for cross-context behavioral advertising, where such activities occur within the meaning of the CCPA.

REVUTO will honor valid opt-out requests in accordance with applicable legal requirements.

You may exercise this right by contacting REVUTO at [email protected] or through any additional privacy choice mechanisms made available on our Website.

Global Privacy Control (GPC) and Opt-Out Preference Signals

REVUTO recognizes Global Privacy Control (GPC) and other legally recognized opt-out preference signals as valid requests to opt out of the sale or sharing of personal information, where required by applicable law.

When REVUTO receives a valid opt-out preference signal through a browser, device, or other recognized mechanism, REVUTO will process the signal in accordance with applicable legal requirements without requiring the consumer to submit a separate request.

Such signals generally apply to the browser or device from which they originate and, where required by law, to associated consumer profiles or accounts that REVUTO can reasonably identify.

Consumers may enable GPC through participating browsers or browser extensions. Additional information about GPC is available at https://globalprivacycontrol.org/.

Right to Limit the Use and Disclosure of Sensitive Personal Information

Where REVUTO uses or discloses sensitive personal information for purposes that give rise to this right under the CCPA, you may request limitations on such use or disclosure in accordance with applicable law.

Certain uses of sensitive personal information necessary to provide requested services, ensure security, prevent fraud, or comply with legal obligations may be exempt from this right.

Right to Non-Discrimination

REVUTO will not unlawfully discriminate against you for exercising your privacy rights under the CCPA.

Unless otherwise permitted by applicable law, REVUTO will not deny you access to its Services, provide a different level or quality of Services, or charge different prices solely because you have exercised your privacy rights.

Exercising Your Rights

To exercise your rights under the CCPA, including the rights to access, correct, delete, or obtain a copy of your personal information, please contact REVUTO through:

Email: [email protected]

Revuto Live Support, available through www.revuto.com

You may submit a request directly or through an authorized agent in accordance with applicable law.

REVUTO may take reasonable steps to verify your identity or the authority of your representative before fulfilling requests that require verification. Verification requirements will be proportionate to the nature and sensitivity of the personal information involved.

REVUTO will generally respond to verifiable consumer requests within 45 calendar days of receipt, subject to any additional time permitted under applicable law. Where an extension is necessary and legally permitted, REVUTO will notify you of the reason and applicable extension period.

Requests to opt out of the sale or sharing of personal information, including valid opt-out preference signals, will be processed within the timeframe required by applicable law and will not be made subject to verification requirements prohibited by law.

You are not required to create an account solely to submit a privacy rights request.

If REVUTO cannot fulfill a request, we will provide an explanation where required by applicable law.

REVUTO will not charge a fee for processing or responding to privacy rights requests unless permitted by applicable law, including where a request is manifestly unfounded or excessive.

For additional information about privacy rights available to residents of other U.S. states, please refer to Section 12 of this Privacy Policy.

11. 2. U.S. STATE PRIVACY RIGHTS

This Section supplements REVUTO's Privacy Policy and provides additional information regarding the privacy rights of individuals residing in U.S. states other than California that have enacted applicable consumer data privacy laws.

These laws include, where applicable, the comprehensive consumer privacy laws of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, as well as other applicable U.S. state privacy laws.

The availability and scope of the rights described below depend on your state of residence, the applicable legislation, and the nature of REVUTO's processing activities.

Your Privacy Rights

Depending on applicable law, you may have the following rights:

Right to Access Personal Information

You may request confirmation of whether REVUTO processes your personal information and obtain access to such information, subject to applicable legal exceptions.

Right to Correct Inaccurate Personal Information

You may request correction of inaccurate personal information maintained by REVUTO, taking into account the nature of the information and the purposes for which it is processed.

Right to Delete Personal Information

You may request the deletion of personal information collected or maintained about you, subject to applicable legal exceptions, including where retention is necessary to comply with legal obligations, prevent fraud, maintain security, or perform contractual obligations.

Right to Data Portability

You may request a copy of certain personal information in a portable and, where technically feasible, readily usable format that allows you to transmit the information to another organization.

Right to Opt Out of Certain Processing Activities

Depending on the applicable state law, you may have the right to opt out of:

The sale of your personal information;

The processing of your personal information for targeted advertising; and

Certain profiling activities that produce legal or similarly significant effects concerning you.

REVUTO will honor applicable opt-out requests in accordance with relevant legal requirements.

Rights Regarding Sensitive Personal Information

Where required by applicable state law, you may have the right to consent to, restrict, or otherwise control certain processing of sensitive personal information.

Global Privacy Control and Universal Opt-Out Mechanisms

REVUTO recognizes Global Privacy Control (GPC) and other legally recognized universal opt-out mechanisms in accordance with applicable U.S. state privacy laws.

Where required by law, REVUTO will treat valid opt-out preference signals as requests to opt out of the sale of personal information or its processing for targeted advertising.

GPC preferences generally apply to the browser or device from which the signal is transmitted and, where required by applicable law, to associated accounts or consumer profiles that REVUTO can reasonably identify.

Additional information about GPC is available at https://globalprivacycontrol.org/.

Right to Appeal

Where provided by applicable state law, you may appeal REVUTO's decision regarding a privacy rights request.

To submit an appeal, please contact [email protected] and indicate that your request concerns an appeal of a previous privacy rights decision.

REVUTO will review your appeal and respond within the timeframe required by applicable state law.

Where required by law, if REVUTO denies your appeal, we will provide information regarding your ability to contact the appropriate state regulatory authority.

Exercising Your Rights

You may submit privacy rights requests by contacting REVUTO through:

Email: [email protected]

Revuto Live Support, available through www.revuto.com

REVUTO may take reasonable steps to verify your identity or authority to submit a request, where permitted or required by applicable law.

We will respond to privacy rights requests within the timeframe required by the applicable state privacy law, subject to any legally permitted extensions.

Certain requests may be denied or limited where an exemption or exception under applicable law applies.

Non-Discrimination

REVUTO will not unlawfully discriminate against consumers for exercising their privacy rights under applicable U.S. state privacy laws.

Additional Information

Where REVUTO processes personal information on behalf of another organization acting as a controller or business, certain privacy rights requests may need to be addressed by that organization.

For additional information regarding how REVUTO collects, uses, stores, and discloses personal information, please refer to the relevant sections of this Privacy Policy and our Cookie Policy.

California residents should refer to Section 11 – California Residents Privacy Notice for information regarding their rights under the CCPA.

12. CHANGES TO PRIVACY POLICY

We reserve the right to change the Privacy Policy from time to time at our sole discretion. If we make any changes, we will publish the new rules on this web page and, if we have your email, we will notify you directly.

If you have previously consented to our Privacy Policy, your continued use of the Revuto after we make changes constitutes acceptance of the updated rules.

Annex, October 2024. 

Revuto’s PRIVACY POLICY

         1. Data Controller Information: Who is responsible for processing your data?

We recognize the importance of protecting the privacy of our customers' and users' personal information. This policy details how we collect, use, disclose, and protect the personal information provided by users of our services. It aims to regulate and provide information on the processing of personal data of current, potential, and former clients, as well as third parties whose data we may process as a result of the relationships we establish with our clients.

The company is legally authorized to process the information provided by users of our website. The controller of personal data collected through our website is :

●      Controller's Name: Revuto OU

●      Contact Email: [email protected]

For any inquiries or to exercise your rights related to the processing of personal data on our website, you can contact the responsible party using the provided contact methods.

         2. Purpose of Processing: What is the purpose of processing your data?

We use the collected information to provide financial services, process transactions, prevent fraud, customize our clients' experience, and comply with legal obligations.

Personal data will be obtained through information request forms or by contracting for our products or services. We may use the information to improve our services and, with clients' prior consent, to send marketing communications.

Personal data collected through our website will be used for the following purposes:

●      Provision of Financial Services: Data is collected to provide financial services, such as account opening, transaction management, requests for banking products, among others.

●      Compliance with Legal Obligations: Data collection and processing are carried out to comply with applicable legal obligations and financial regulations.

●      Client Management: Data will be used to maintain relationships with clients, including account management, communications related to financial services, and customer service.

●      Fraud Prevention and Security: Data collection and processing are performed to prevent and detect potential fraud, ensuring the security of financial transactions.

The legal basis for processing personal data is based on the user's explicit consent. The relevant forms will include a checkbox for accepting the privacy policy as a requirement for registration or use of the services.

Personal data is obtained in accordance with legal regulations and with the explicit consent of the users. This information is provided to ensure transparency about the use and processing of personal data collected on our website.

         3. Third-Party Recipients of Personal Data: Who do we share your personal data with?

We may share personal data with third-party recipients to provide and improve our services. These third parties may act as data processors. Situations in which data might be shared include, but are not limited to:

●      Associated Financial Entities: We may share data with financial institutions to facilitate transactions, verify identities, or provide specific financial services.

●      Public Authorities, Official Bodies or Bank Supervision and Control Entities and Competent Tax Authorities: We may disclose personal data as required by banking and financial sector regulation, anti-money laundering and terrorism financing regulation, as well as consumer protection laws in force.

●      Service Providers: In certain circumstances, we contract external service providers, such as payment platforms, web analytics service providers, or fraud prevention services, who could access personal data in the course of their activities.

●      Third-Party Cookies: Our website may use third-party cookies, which collect data to improve the user experience. These cookies are used by external providers and could record personal information, provided the user gives their consent.

Users can manage cookie preferences in their browser settings, allowing or blocking third-party cookies on our website.

It is important to note that access to personal data by third-party recipients is subject to the user's explicit approval and consent. This information is provided to ensure transparency in the handling of personal data on our website.

         4. International Transfers

We commit to informing you transparently about any international data transfers that may occur. In some cases, personal data may be transferred outside the European Union.

These international transfers will occur in compliance with applicable data protection regulations. In particular, we will provide explicit, detailed notice of such transfers to ensure compliance with applicable data protection laws.

These transfers may involve sending data to companies with servers outside the European Union, such as in the United States or other countries.

Our commitment is to ensure that, regardless of international transfers, the protection and privacy of your personal data are maintained in accordance with applicable data protection standards and regulations.

         5. Data Retention Period: How long do we keep your data?

We commit to keeping the personal data provided by users only for the time necessary to fulfill the purposes for which they were collected, unless a legal or regulatory obligation requires a longer retention period.

The retention period for personal data may vary depending on the purpose of the processing and applicable legal obligations. Generally:

●      Current Clients' Data: Data from current clients will be retained for the duration of the contractual relationship and, once concluded, will be blocked for 10 years as mandated by anti-money laundering regulations.

●      Potential Clients and Former Clients' Data: Data from potential clients, as well as from former clients, will be retained for a reasonable period to maintain records and manage inquiries or complaints.

●      Legal Compliance and Regulatory Obligations: In certain cases, information may be kept for an additional period to comply with legal obligations, respond to legal and regulatory requirements, resolve disputes, prevent fraud, or enforce agreements. Eventually, we will abide by the legal prescription periods depending on the specific contracts you sign with us, for example, 21 years according to mortgage regulations.

After these periods have passed, or when the data are no longer necessary for the established purposes, we will securely delete the data in accordance with our internal policies and current data protection regulations.

         6. Rights of Access, Rectification, Opposition, and Cancellation

Our users have the right to exercise access, rectification, deletion, limitation, portability, and opposition rights regarding their personal data:

●      Access and Rectification: You can access your personal data and, if necessary, rectify it if it is inaccurate or incomplete.

●      Deletion: Under certain circumstances, you can request the deletion of your personal data.

●      Processing Limitation: You have the right to request the limitation of the processing of your data in certain situations.

●      Portability: You can request the transfer of your data to another data controller in a structured and readable format.

●      Opposition: You can oppose the processing of your data, including processing for direct marketing purposes.

To exercise any of these rights, or if you wish to obtain more information about the processing of your personal data, you can contact us through the provided contact methods. We are committed to addressing your requests and inquiries related to your data protection rights to ensure respect and protection for your personal data.

 LinkCy’s Privacy Policy

Introduction

LinkCy SAS regards as of paramount importance the protection and security of Personal Data.

LinkCy collects and processes your personal data in the context of its partnership with the following Partner:

Partner’s Name :  Revuto OU

Partner’s Email Address :  [email protected]

The Privacy Policy for Personal Data collected via LinkCy SAS within the framework of the activities for which it acts as an Agent of a Payment Service Provider (Paynovate SA) is detailed below, which sets out:

● How LinkCy SAS collects and processes your Personal Data;

● The security measures that LinkCy SAS implements to guarantee the confidentiality and integrity of your Personal Data;

● The rights you have to control them throughout your use of the Services.

This policy is effective as of 24/04/2021.

This Privacy Policy may be modified or supplemented at any time by LinkCy SAS, in particular with a view to complying with any legislative, regulatory, jurisprudential or technological developments. To check for updates to this Policy, you should regularly consult this page.

If the changes affect the processing activities carried out on the basis of the User's consent, LinkCy SAS must obtain your consent again.

We encourage you to read this policy carefully. If you do not agree with or you are not comfortable with any aspect of this Privacy Policy, please do not use the Application and Services or do not provide your Personal Data for the use of Services.

Who is the Data controller?

We – LinkCy, a SAS registered with the Paris Trade and Companies Register under number 852295732, with a capital of 13 089 € whose registered office is located at 42 Rue Boursault, 75017 Paris, France – are the controller of your Personal Data collected throughout the Site, as provided by the Applicable Laws (as defined below).

In accordance with Article 37 of the GDPR, the institution has appointed a Data Protection Officer (hereinafter DPO), whose contact details are as follows: Nicolas Dupouy ([email protected])

What are the Applicable Laws?

The processing of your Personal Data is carried out in accordance with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016), as well as in compliance with French legislation governing the protection of personal data and privacy in electronic communications, notably the French Data Protection Act (amended on 20 June 2018 to enhance personal data protection). This legislation also includes European directives and national laws relating to privacy protection in electronic communications, notably the "ePrivacy" Directive 2002/58/EC (collectively referred to as the "Applicable Laws").

The competent authorities for data protection in France are the National Commission on Informatics and Liberty (CNIL) for national compliance oversight and the European Court of Justice (ECJ) for matters involving European Union law.

What personal data is collected? How are they collected?

Personal Data means any information relating to an identified or identifiable natural person.

An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

As part of the provision of the Services, as defined in the General Terms and Conditions of Use, we may collect the following Personal Data directly through the Application, as defined in the General Terms and Conditions of Use:

● Identity: surname, first name, maiden name, marital date and place of birth, proof of identity;

● Personal life: personal email address, personal telephone number, personal postal address and proof of address;

● Professional life: employer, professional email address, professional telephone number, professional postal address, position, employment contract and pay slip;

● Economic data: Bank details, IBAN, Card details, account statement, LinkCy account balance, transaction(s), tax notice and proof of income;

● Connection data: identification and authentication data linked to the use of Services (username, password, other registration information), details of device used for connection.

Personal data is collected either directly from the data subjects or indirectly from third parties or from public available sources.

The processing operations concern the personal data of Users, Customers or Prospects.

Why is personal data collected?

The main purpose of collecting Personal data through the Application is to allow us to:

● Carry out all the Services offered by our company, as defined in the General Terms and Conditions of Use;

● Conclude or execute any contract with you and to respond to any request for services; ● Answer and satisfy your requests and eventual queries;

● Manage of customer account;

● Carry out customer loyalty operations;

● Carry out commercial prospecting operations;

● Development of statistics;

● Build up a file of registered members, users, customers and prospects; ● Verify the use and functionality of our Services;

● Develop our services (launch new products or services, improve the application, etc.);

● Protect our operations or those of others third parties and our rights and security or those of third parties;

● Ensure compliance with legal and regulatory obligation (fight against fraud, money laundering and terrorist financing), the General Terms and Conditions of Use and this Data Protection Policy;

● Resolve any disputes that we may have withs its Users and enforce contracts with third parties.

Furthermore, we may collect Personal Data for other purposes, while taking care to comply with applicable Personal Data protection legislation.

What legal ground(s) do we rely on?

Personal Data processing is necessary for:

● the execution of a contract for the provision of services to which the User is a party or the execution of pre-contractual measures taken at the User's request in accordance with Article 6(1)(b) of the GDPR

● compliance with legal and regulatory obligations in accordance with Article 6(1)(c) of the GDPR, such as the fight against money laundering and terrorist financing, the fight against tax fraud, the legislation on internal sanctions and embargoes, the banking and financial regulations;

● the purposes of the legitimate interests pursued by the data controller in accordance with Article 6(1)(f) of the GDPR, such as risk management, carrying out prospecting operations, improving our Services, etc.

Data processing may also be based on the prior consent of the data subjects in accordance with Article 6(1)(a) of the GDPR, in particular during prospecting operations.

How long do we keep your information?

We will keep your personal data in a secure environment for a maximum period of eight (8) years from the termination of the business relationship (closing of the payment account).

However, we may be required to retain certain Personal Data for a longer period of time, taking into account factors such as:

 ● legal obligation(s) under applicable law to retain the personal data for a certain period of time (for example, for compliance with tax and accounting requirements);

● the establishment, exercise or defense of legal proceedings (for example, for the purposes of potential litigation).

 While we continue to process your Personal Data, we will ensure that it is treated in accordance with this Privacy Policy. If not, we will securely delete or anonymize your Personal Data as soon as it is no longer required.

If you wish to know how long we keep your Personal Data for a particular purpose, you can contact us by writing to us at [email protected]

Who may we share your information with?

As your Personal Data is confidential, only persons duly authorized by us due to their functions can access your Personal Data, without prejudice to their possible transmission to the extent required by the applicable regulations. All persons for whom we are responsible for access to your Personal Data are bound by a confidentiality agreement.

We can also share your Personal Data with our subcontractors, within the framework of the contracts governing the business relationship with us, and in particular:

● Our subsidiary company

● Our Payments Services Provider

● Our other Service Providers

● Our Partners, as defined in the General Terms and Conditions of Use

These subcontractors have access only to the data strictly necessary to execute the contracts established with LinkCy SAS.

We guarantee that the different subcontractors implement the necessary and adequate security measures to ensure the security, confidentiality and integrity of personal data processed on behalf of LinkCy SAS.

In certain circumstances and only where required by Applicable Laws, we may disclose some of your Personal Data to competent administrative or judicial authorities or any other authorized third party.

Is my Personal Data transferred outside the European Union?

The processing and hosting of the Personal Data are carried out within the territory of the European Union.

Nevertheless, if we transfer Personal Data outside the territory of the European Union, we guarantee that these transfers are executed to States which are subject to an adequacy decision by the European Commission, justifying an adequate level of protection, within the meaning of Article 45 of the European General Regulation 2016/679 of 27 April 2016 on the protection of personal data.

In the absence of an adequacy decision, we may transfer Personal Data outside the European Union to Subcontractors, under the conditions provided for in Article 46 of the European General Regulation 2016/679 of 27 April 2016 on the protection of personal data, in particular through the development of standard subcontracting clauses approved by the Commission.

How do we secure personal data?

We implement the appropriate measures in order to guarantee the protection and confidentiality of your Personal Data, and specifically, to prevent its destruction, loss, alteration, unauthorized disclosure, or unauthorized access to this data.

These measures include:

● Training to relevant staff to ensure they are aware of our privacy obligations when handling personal information;

● Careful selection of subcontractors;

● administrative and technical controls to restrict access to Personal Data on a “need to know” basis;

● technological security measures, including firewalls, encryption and anti-virus software, and authentication devices;

 Although we use appropriate security measures once we have received your Personal Data, the transmission of data over the internet (including by e-mail) is never completely secure. We endeavor to protect Personal Data, but we cannot guarantee the security of data transmitted to us or by us. We will inform you promptly in the event of a violation of your Personal Data that could pose a serious risk to you.

What are your rights regarding your personal data?

You have the right to the Personal Data that concerns you, and that is processed by LinkCy SAS:

● The right to be informed: you have the right to receive clear, transparent and easily understandable information about how we use your Personal Data. That is why we provide you with the information contained in this Privacy Policy.

● The right of access: you have the right to obtain confirmation from us as to whether or not your Personal Data is processed by us, as well as certain other information about how it is used. You also have the right to access your Personal Data by requesting a copy

of your Personal Data. We may refuse to provide information where this would reveal Personal Data about another person or adversely affect the rights of another person.

● The right of rectification: you may ask us to take action to correct your Personal Data if it is inaccurate or incomplete (for example, if we have the wrong name or address).

● The right to forget: this right allows you, in simple terms, to request the deletion or removal of your Personal Data where, for example, there is no compelling reason for us to continue to use it or its use is illegal. However, this is not a general right to deletion, and exceptions apply, for example, when we need to use the information to defend a legal claim or comply with a legal obligation.

● The right to limit processing: you have the right to "block" or prevent further use of your Personal Data when we assess a request for rectification or as an alternative to deletion. Where processing is limited, we may still retain your Personal Data, but we may not use it further.

● The right to data portability: you have the right to obtain and re-use certain Personal Data for your own purposes in different companies (which are separate data controllers). This only applies to Personal Data that you have provided to us, which we process with your consent. In this case, we will provide you with a copy of your data in a structured, commonly used, machine-readable format or (where technically possible) we can transmit your data directly to another Data controller.

● The right to object: you have the right to object to certain types of processing, for reasons relating to your particular circumstances, at any time. We will be allowed to continue processing Personal Data if we can demonstrate that the processing is justified by compelling and legitimate reasons that override your interests, rights and freedoms, or if we need it for the establishment, exercise or defense of legal claims.

● The right to withdraw your consent: where we process your Personal Data on the basis of your consent, you have the right to withdraw your consent at any time. However, such withdrawal does not affect the lawfulness of the processing that took place prior to such withdrawal.

● The right to provide us with instructions on the use of your Personal Data after your death - you have the right to provide us with instructions on the management (e.g., retention, deletion and disclosure) of your data after your death. You may change or revoke your instructions at any time.

How to contact us?

If you wish to access, correct, modify, or delete the Personal Data we have about you, object to their processing, exercise your right to portability, file a complaint, exercise any of the above-mentioned rights or simply obtain more information about the use of your Personal Data, please contact [email protected]

We will endeavor to find a satisfactory solution to ensure compliance with the Applicable Laws.

In the absence of a response from us or if you are not satisfied with our response or proposal, or at any time, you have the ability to lodge a complaint before the CNIL (the French data protection authority) or with the supervisory authority of the Member State of the European Union of your country of residence.