PrivaNext Platform - Wealth Management

Privacy

YAWLFIN SARLs, a company incorporated in Luxembourg, whose registered office is located at 9 LOUVIGNY, L-1946 LUXEMBOURG and whose registration number is Reg. No. 717571, recognizes the importance of privacy and is committed to protecting the confidentiality and security of users' personal data in accordance with European Union (hereinafter, EU) and international law.

All terms of this Privacy Policy have the meanings ascribed to them in the Terms and Conditions published on this website.

This Policy defines how the control and processing of the personal data of users accessing the Privanext service is carried out. The Policy also clarifies the bases for the processing of data that is collected or provided by Users, including the rights and methods of their protection.

YAWLFIN SARLs acts as a personal data operator, combining the functions of controller and processor of personal data in accordance with the EU GDPR.

By using the Website in any way, including but not limited to billing, purchasing and using any of the services provided through the Website, you agree to YAWLFIN SARLs' Privacy Policy. If you do not agree with this Privacy Policy, please do not provide any personal data and do not use the Website.

If you have any concerns or questions about this Privacy Policy and how data is handled, please contact customer service at contact@privanext.com.

1. Personal data

Personal data means information that can enable Privanext to identify users personally, including data about an individual who can be identified from such data, or from such data and other information to which Privanext has or is likely to have access.

YAWLFIN SARLs may collect the following personal information:

Forename
Last Name
E-mail address
Telephone number
Tax Residency
Nationality
Payment Information
IP address and server log files
Client's broker name
Other information provided at the user's option.

The main reason why Privanext collects the user's personal data is to provide, personalize, facilitate and/or improve its service, including the Platform and the Site, to users.

2. Reasons for collecting and using personal data

YAWLFIN SARLs may collect and use users' personal data for the following purposes:

to register and create an account to use the Platform
for the performance of the Company's services
To improve the Website, personalize the user experience, and enhance user interactions with the Website
to provide customer support and to protect the safety and security of the services
to send notifications about the user's account, to recover the password, and to notify a data breach
for promotional communications when the user is subscribed to them
to investigate violations
to pursue a legitimate interest in a way that could reasonably be expected in the course of running its business and that does not materially impact the rights, freedoms or interests of users; or
process user data to comply with any legal or regulatory obligations.

If Privanext intends to process, use or process personal data in a way that is not in accordance with this Policy, the company will post a notice of the change on the Site or Platform before the change takes effect. Users shall be deemed to have consented to such modification if no notice of objection is received within seven (7) days from the date of such modification. If users are located in the EU, Privanext will notify them of such changes through emails and such users will have to respond accordingly to indicate whether or not they consent to such changes.

3. Personal data processing methods and security

3.1 The use of personal data depends on the specific purposes for which it is processed.

3.1.1 In order to complete the user's registration, Privanext collects, stores and organizes the user's identification information, including through the use of automation tools. The Company may request that this information be updated to ensure that such credentials are accurate and up-to-date.

3.1.2. To provide a customer support service, personal data will be processed and managed by an employee of YAWLFIN SARLs through an email responding to the user's request.

3.2. Privanext has put in place security measures and procedures to ensure appropriate protection of the information processed, against unauthorized access, misuse, modification or disclosure.

3.3. Only authorized processors can access information collected from users. However, the company cannot guarantee that its security measures will always provide complete protection against all threats. If a personal data breach is discovered or suspected by the company, it will be notified within 72 hours, without delay, after becoming aware of it, to the competent supervisory authority and to users if necessary.

4. Storage of personal data and retention period

4.1 The Information will be stored on secure servers, controlled and maintained in accordance with sufficient guarantees of confidentiality. Privanext may store or transfer Information about data subjects located in the EU to servers located in countries deemed adequate by the European Commission, or in countries that the European Commission has not deemed inadequate, provided that such countries implement appropriate and adequate safeguards regarding the security of personal information.

4.2 Privanext will keep records of processing activities for the purpose of demonstrating compliance with the EU GDPR.

4.3 The information is stored on the servers only for the time necessary to provide the services and to maintain the integrity of the company's databases.

4.5 If the user registers an account with YAWLFIN SARLs, the user's data will be stored for as long as the account is active. Once the account is deleted, all information relating to the user will be deleted, unless there is a legal basis justifying the retention of the data.

4.6 User information will be stored for a period of two years in cases where the account has been suspended or terminated due to non-compliance with the terms.

4.7 Privanext will delete all information about users at their request, no later than fifteen days after receipt of the request.

5. Collection and Use of Non-Personally Identifiable Data

5.1 If the User cannot be identified by or from the data collected by the Company and other information to which Privanext has or is likely to have access, then such data shall not be considered personal data by this Privacy Policy.

5.2 To investigate any breach or infringement, the Platform and any other third-party analytics platform collect and store in server log files:

(i) the operating system used by the accessing system.

(ii) the types and versions of software and browsers used

(iii) the Internet service provider of the access system

(iv) the date and time of access to the Services, and

(v) any other data and similar information that may be used in the event of an attack on computer systems.

5.3 The aforementioned information is necessary to provide and optimize the content of the Platform, to provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyberattack, and to ensure the long-term viability of the technology and systems of the Privanext website.

5.4 The anonymized data in the server log files is stored separately from all personal data provided by a data subject.

6. Transfer of data outside the EU

The requirements of European legislation oblige to inform that data may be transferred to countries where the level of guarantee and regulation of data privacy protection does not correspond to the high standards developed and applied in the EU. When transferring data to countries for which the European Commission has not indicated that the level of protection of personal data in these countries is proportional to EU regulations, there is a hypothetical probability of leakage of personal data and the elimination of this leakage within a reasonable period of time increases. In such circumstances, data may be disclosed and unauthorized persons may use it without the user's consent. By giving consent to the processing of data in accordance with this policy, the user unambiguously confirms that he/she is fully aware of and accepts the possible risks.

Privanext takes measures to minimize these risks for the User by including provisions in accordance with the standard contractual conditions approved by the European Commission in contracts and agreements with the recipients of such data.

7. User Rights and Application

7.1 Subject to the exceptions provided for by applicable laws, Users have the right to:

Request access to their personal data. This allows a User to receive a copy of their Personal Data held by YAWLFIN SARLs.
Request correction of their personal data. This allows a User to have any incomplete or inaccurate information corrected.
Withdraw consent. This allows a User to withdraw his/her consent given to Privanext to process his/her Personal Data. If a User withdraws his/her consent, Privanext may not be able to provide the User with access to certain specific features of the Site, the Platform and/or the Services.
Object to the processing of your personal data. This right exists when Privanext relies on a legitimate interest as a legal basis for the processing of a User's personal data but the User has a reason to object to the processing of his or her personal data. A user has the right to object when Privanext processes their personal data for direct marketing purposes.
Request the erasure of your personal data. This allows a user to request that Privanext remove or delete their personal data when there is no valid reason for the company to continue processing it. A user also has the right to request Privanext to delete or erase their personal data when they have exercised their right to object to processing.
Request the transfer of your personal data. This allows a user to request that Privanext provide the user, or a third party designated by the user, with their personal data in a structured, commonly used and machine-readable format. This right only applies to automated information that the User has initially consented to Privanext using.
Request the restriction of the processing of their personal data. This allows a user to request Privanext to suspend the processing of their personal data.
Lodge a complaint with the national supervisory authority.

7.2 If a user wishes to exercise any of the rights mentioned in Article 7.1 above, he is obliged to (i) make his request in writing and send it to contact@privanext.com; (ii) to provide Privanext with sufficient information to enable it to verify the user's security measures to ensure that Personal Data is not disclosed to a person who does not have the right to receive it; and (iii) to specify the right that the user wishes to exercise and to identify the personal data relevant for this purpose.

7.3. Privanext will endeavour to respond to all legitimate requests within thirty (30) days, unless a User's request is particularly complex or the User has made multiple requests. In this regard, Privanext will inform the user and keep him/her informed.

8. Data processing by third parties and Cookies

8.1 Privanext collects and uses the User's personal data only in accordance with this Privacy Policy, as required by the nature of the services. Privanext does not sell personal data to third parties.

8.2 Privanext may disclose Users' Personal Data to government authorities or agencies if it believes that doing so is reasonably necessary to comply with any law, regulation, ordinance, subpoena, rule of a self-regulatory organization or audit, or to protect the safety of any person, to deal with fraud, security or technical issues, or to protect its legal rights, interests and the interests of others, such as, for example, in connection with the acquisition, merger or sale of securities or a business (e.g., due diligence). Privanext will not share users' personal data with non-governmental entities unless such entities have been duly authorized to conduct specific government activities.

8.3 Privanext may disclose Users' personal data to partners, operators and agents under confidentiality agreements or similar arrangements, including carriers and payment processors who Privanext reasonably believes need such information to:

Provide services at the request of users
administer the Site or the business.
Provide Customer support
Update account information
in the event of a merger, sale, joint venture, assignment, transfer, or disposition of all or any portion of the Site's business or operations (including, but not limited to, in connection with bankruptcy or other similar proceedings)
Deliver updates, announcements, and newsletters
as otherwise authorized by the user

8.4 Although Users may encounter links on the Site to other websites, such as those relating to partners or third-party solutions, this Policy does not apply to the activities of such third-party platforms that may collect Users' personal data when accessing or using the services of such third parties in connection with Users' use of the Site or Platform. The privacy practices of these third parties are not covered by this Policy. Links on the Site do not imply that Privanext endorses or has reviewed the Third Party Platforms. Users should contact these platforms directly for information about their privacy policies, as Privanext is not responsible for the content or privacy practices of these external websites.

8.5 Privanext uses cookies to improve and simplify the user experience. In particular, to provide easier navigation on the website, to facilitate login, for internal security purposes, system administration to adapt advertisements to users' preferences, and others. The user can access the full cookie policy here.

9. Children's Online Privacy

YAWLFIN SARLs is committed to protecting children's privacy online. In order to protect privacy, Privanext does not knowingly collect personal data from children under the age of 18. In the event that Privanext becomes aware that personal data of a child under the age of 18 has been collected, the company will delete this information from its database and terminate the corresponding account, if applicable.

10. Limitation of Liability

10.1 Except where prohibited by law, in no event shall Privanext be liable for any direct, indirect, incidental, special, consequential or exemplary damages resulting from any aspect of Privanext's use of any third party's personal data provided by the User. These limitations apply to the fullest extent permitted by law. In some jurisdictions, some of the above limitations may not apply.

10.2 This Policy does not apply to unsolicited information that users provide to Privanext through the Site or by any other means. This includes, but is not limited to, information posted in public areas of the Site or Platform, such as message boards, ideas or comments, and other unsolicited submissions. All information mentioned will be considered non-confidential and Privanext will be free to reproduce, disclose, use and distribute it without limitation or attribution.

11. Third parties in the course of the activity

We engage with various third-party data processors for the processing of your personal data. We have contracts in place with them to which they are linked. They will keep the data safe and secure and keep it for the period we have indicated to them.

11.1 Application Analysis

Hosting and infrastructure

Microsoft Azure: We host the data and files that allow Privanext to run and be distributed. We process all the data listed above.

Fulfillment location: Microsoft data centers located in Europe.

Purchase & Transaction

Stripe: This service allows us to chat with you within the Privanext app and also to offer a help center. We collect browsing and usage data within the app. Please note that your conversations with us within the app are all recorded.

Place of processing: United States

Customer Relations

SendinBlue: This service allows us to chat with you in the Privanext app and also to offer a help center. We collect browsing and usage data within the app. Please note that your conversations with us within the app are all recorded.

Place of processing: In Paris in France,

Registration and authentication

Microsoft Identity Platform (Security Provider): To use Privanext, you need to have an itsme® account. By registering or authenticating yourself on the Privanext app, you allow us to identify you and give you access to our investment assistance service.

Place of treatment: Microsoft data centers located in Europe.

12. Changes to this Privacy Policy

YAWLFIN SARLs reserves the right to amend or modify this Privacy Policy at any time in response to changes in applicable data protection and privacy legislation. Any changes made by YAWLFIN SARLs will be published on this page and, if necessary, notified to the user by e-mail. It is the user's responsibility to periodically check the privacy policy.

Last updated: 29/04/2023