Yoursafe Privacy Policy

1. Scope of Policy

This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed and used by us. We process your personal data in accordance with the General Data Protection Regulation (GDPR) and will always keep your data safe and private, and never sell your data to third parties.

Please read this carefully, as this policy is legally binding when you use our services. This policy, together with the Terms and Conditions, applies to your use of:

• our website at www.yoursafe.com and you.yoursafe.com (the “Site”);
• the Yoursafe App (“App”), once you have downloaded a copy of the App onto your mobile telephone or handheld device (“Device”); and
• any of the services accessible through the App or the Site (the “Services”).

Data controller

The authority responsible for the collection, processing and use of personal data is:

Yoursafe B.V. Danzigerkade 23D 1013 AP Amsterdam Netherlands

Data Protection Officer

We have appointed a Data Protection Officer (“DPO”), who is accessible via dataprotection@yoursafe.com. The DPO has a number of important responsibilities, including:

• monitoring Yoursafe’s compliance with the GDPR and other data protection laws;
• raising awareness of data protection issues, training Yoursafe staff and conducting internal audits; and
• cooperating with supervisory authorities on our behalf.

If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact us or our DPO at dataprotection@yoursafe.com.

2. Cookies

We use cookies to distinguish you from other users of the App or the Site. This helps us to provide you with a good experience when you use the App or browse our Site, and also allows us to improve the App and our Site.

3. How we protect your personal information

We are serious about guarding the security of your personal information and use a secure server to store your personal information. All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted using Transport Layer Security technology.

As you will know, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data during transmission, and any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

We restrict access to your personal information to those employees of Yoursafe who have a business reason for knowing such information. We continuously educate and train our employees about the importance of confidentiality and privacy of customer information. We maintain physical, electronic and procedural safeguards that comply with the relevant laws and regulations to protect your personal information from unauthorised access.

4. Information we may collect from you

Information you give us

You may give us information about you when you sign up to use our service, e.g. when you provide us with your personal details, such as your name and email address. This also includes information you provide through your continued use of our Services on our Site or App.

The information you give us may include your:

• name;
• address;
• e-mail address;
• phone number;
• financial information;
• payment reason;
• geographical location;
• social security number;
• personal description and photograph.

Facial verification. When you use the Yoursafe App, we may capture an image of your face using your mobile device. This image is immediately converted into a mathematical representation known as a facial template, which is used solely for verifying your identity during our KYC (Know Your Customer) procedures.

• We do not store or retain the original facial data.
• Only the facial template, which cannot be reverse-engineered into the original facial data, is securely stored.
• A facial template is an encrypted, one-way mathematical representation of specific facial features (such as the distance between your eyes), and it is not human-readable.

We may also need additional commercial and/or identification information from you, e.g. if you send or receive certain high-value or high-volume transactions, or as needed to comply with our anti-money laundering obligations under applicable law.

In providing the personal data of any individual (other than yourself) to us during your use of our Services, you promise that you have obtained consent from such individual to disclose his/her personal data to us, as well as his/her consent to our collection, use and disclosure of such personal data, for the purposes set out in this Privacy Policy.

Information we collect about you

• details of the transactions you carry out when using our Services, including the geographic location from which the transaction originates;
• technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform;
• information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our Site or App (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page; and any phone number used to call our Customer Support number.

Information we receive from other sources

We may receive information about you if you use any of the other websites we operate or the other services we provide. We also work closely with third parties and may receive information about you from them. For example:

• the banks you use to transfer money to us will provide us with your basic personal information, such as your name and address, as well as your financial information such as your bank account details;
• business partners may provide us with your name and address, as well as financial information, such as card payment information;
• advertising networks, analytics providers and search information providers may provide us with pseudonymised information about you, such as confirming how you found our website;
• credit reference agencies do not provide us with any personal information about yourself, but may be used to corroborate the information you have provided to us.

International transfers

We will transfer the information you have provided to us, and information collected and/or received from other sources (your “personal data”), to other countries or international/foreign organisations only if that country or international/foreign organisation has a personal data protection standard equivalent to this data protection policy and in line with GDPR and Dutch AVG provisions.

5. Uses made of the information

Data protection legislation requires us to collect and process your personal data legally and correctly in relation to you, in order to protect your individual rights. Your personal data will only be collected for determined, explicit and legitimate purposes, defined below. The processing of your personal data must have a legal basis. Subsequent changes to this purpose are possible, but only to a limited extent and require a solid legal foundation.

How we use your information

We may use your information in the following ways:

• to carry out our obligations relating to your contract with us and to provide you with the information, products and services;
• to comply with any applicable legal and/or regulatory requirements;
• to securely verify your identity as required under EU Anti-Money Laundering and financial supervision regulations, including using facial templates (see above) during electronic onboarding or account updates;
• to notify you about changes to our Services;
• as part of our efforts to keep our Services safe and secure;
• to administer our Services and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
• to improve our Services and to ensure that they are presented in the most effective manner;
• to measure or understand the effectiveness of advertising we serve and to deliver relevant advertising to you;
• to allow you to participate in interactive features of our Services, when you choose to do so;
• to provide you with information about other similar goods and services we offer;
• to provide you, or permit selected third parties to provide you, with information about goods or services we feel may interest you; or
• to combine information we receive from other sources with the information you give to us and information we collect about you. We may use this information, and the combined information, for the purposes set out above (depending on the types of information we receive).

Who we may share your data with

You give us the right to share your personal data with the payment Card Networks pursuant to the requirements of the network rules under the applicable payment facilitation contracts and card issuing agreements, or with third-party service providers who help with certain parts of our business operations, including payment processing, fraud prevention, validation of user credentials, secure data storage and other similar services. We ensure that these parties only use personal information in connection with the services they perform for us.

You also give us the right to share your personal data further with:

• our management board, on a need-to-know basis, with the implementation of appropriate safeguards in relation to them, in order to ensure the integrity and security of your personal data;
• companies providing money laundering and other fraud prevention and crime prevention services, and companies providing similar services, including financial institutions, credit bureaux and regulatory authorities with which data are shared;
• counterparties in any payment transaction, where such personal information may be limited to your name or names, and your account number;
• courts of law, law enforcement authorities, regulators, lawyers or other persons, if it proves to be justly necessary to establish, exercise or defend a right to a fair hearing.

Biometric data. We do not share your facial image with any third parties. This biometric data is processed solely by Yoursafe B.V. within the EU, using secure internal systems.

6. Data retention

As a regulated financial institution, Yoursafe is required by law to store some of your personal and transactional data beyond the closure of your account with us. Your data is only accessed internally on a need-to-know basis, and it will only be accessed or processed if absolutely necessary.

Facial templates created during the KYC process are stored for a maximum of 5 years after account closure or last use, in line with applicable financial sector regulations and fraud prevention needs. After this period, the data is automatically deleted unless legal retention obligations require otherwise.

We will always delete data that is no longer required by a relevant law or jurisdiction in which we operate.

7. Your rights

You have the following rights concerning your personal data:

• right of access (Art. 15 GDPR);
• right of rectification (Art. 16 GDPR);
• right to erasure (Art. 17 GDPR);
• right to restriction of processing (Art. 18 GDPR);
• right to data portability (Art. 20 GDPR);
• right to object (Art. 21 GDPR).

Data Subject Access Requests (DSAR)

You have the right to request information about the way Yoursafe handles your personal information (DSAR). A DSAR may be a request about what personal data is collected in general, what personal data is collected on you, a request to delete your personal data, or a request to take your personal data somewhere else.

• You may submit a DSAR via email to dataprotection@yoursafe.com.
• Yoursafe first needs to verify your identity and existence within Yoursafe’s ecosystem, and will track the request through to resolution within 30 working days.

Any DSAR of Yoursafe Account holders that relates to the Yoursafe Debit Card is also shared with the card-issuing financial institution, unless we are not allowed to do so under applicable laws.

8. Changes to our privacy policy

Any changes we make to our privacy policy will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy policy.

9. Contact

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to privacy@yoursafe.com.