This privacy statement applies to citizens and legal permanent residents of the European Economic Area.
In this privacy statement, we explain what we do with the data we obtain about you via https://www.iyu.plusWe recommend that you read this statement carefully.
The entity that collects and processes your personal data is the company IYU Europe (“IYU”), a French simplified joint-stock company (SAS) with share capital of €500,000, registered with the Paris Trade and Companies Register (RCS) under number 914 354 006, whose registered office is at 7 rue Debelleyme 75003 Paris, authorized and supervised by the Autorité de Contrôle Prudentiel (4 pl de Budapest – 75009 – Paris) under number 17798W, and which is the publisher of this website.
In carrying out our processing, we comply with the requirements of the General Data Protection Regulation (GDPR).
You may contact us at the following address: support@iyu.plus
The personal data we process
As part of the processing we carry out, the Company collects and processes the following categories of data
Identification data
Contact data
Verification data
Financial data
Technical data
Customer relationship data
Legal bases, purposes, and retention periods of the processing carried out
In accordance with the GDPR, the personal data collected by the Company will be used to accomplish the purposes for which it was collected, for a retention period detailed in the table below:
| Purpose | Legal basis | Retention period |
| Creation and management of the customer account | Performance of the contract | During the contractual relationship, then 5 years after it ends |
| Provision of money transfer services | Performance of the contract | 5 years after the end of the relationship, subject to applicable statutory periods |
| Management of payment operations and issuance/receipt of funds | Performance of the contract; legal obligation depending on the case | 5 years for transactional data; 10 years for accounting records |
| Verification of identity and beneficiaries (KYC/KYB) | Legal obligation | During the relationship, then 5 years after it ends, subject to applicable statutory periods |
| Combating money laundering, terrorist financing, fraud, and abuse | Legal obligation | 5 years after the end of the relationship, in accordance with applicable obligations |
| Management of customers and the contractual relationship | Performance of the contract | 5 years after the end of the contract |
| Customer assistance and support | Legitimate interest | Duration necessary for processing |
| Management of physical branches and appointments | Performance of the contract; legitimate interest | Duration necessary to handle the request |
| Management of prospects and marketing | Consent or legitimate interest depending on the channel and the status of the prospect/customer | 3 years after the last contact for prospects; until consent is withdrawn for communications based on consent |
| Commercial communications and promotions | Consent for B2C e-mail/SMS; legitimate interest for certain existing customers depending on the case | Until consent is withdrawn or 3 years after the last contact |
| Management of the website and the application | Legitimate interest; consent for non-essential cookies | Duration technically necessary, or as set out in the cookie policy |
| Management of complaints, unpaid amounts, and disputes | Legitimate interest; legal obligation in the event of a dispute or debt collection | Up to 5 years after the end of the relationship, or longer if a dispute is ongoing |
| Compliance with accounting, tax, and regulatory obligations | Legal obligation | 10 years for accounting records |
| Management of GDPR rights requests | Legal obligation | 5 years from the end of the calendar year of the request |
| Management of partners, agents, and correspondents | Performance of the contract | During the relationship and in accordance with applicable retention obligations |
| Management of communications received and sent via the contact form | Legitimate interest | The time necessary for processing |
Once the stated retention periods have been reached, your data is deleted from all of the Company's servers.
Cookies
For more information about the cookies used by the Company, please refer to our cookie policy. Cookie policy.
Mandatory or optional nature of data collection and consequences of non-provision
When we collect your personal data, we inform you whether certain data must be provided or is optional.
Mandatory data is necessary for the operation of our services and the proper performance of the contract, and it will be indicated to you.If a mandatory data field is not provided, the Company will not be able to carry out its services.
Optional data is data you may choose to provide to improve your user experience (e.g. communication preferences). Not providing this data will have no effect on the performance of the contract or the provision of the service, but may limit the personalization of our offer.
Recipients of personal data
The personal data we process is used only for predetermined purposes necessary for carrying out our services, related to our business.
Your personal data is accessible to:
The Company's employees, in accordance with internal authorization policies defined
Our subcontractors
Regulated partners
Authorized further subcontractors
Public bodies and supervisory and licensing authorities
Your data is also shared with control bodies (in particular, the statutory auditor).
If our website or organisation is taken over, sold or involved in a merger or acquisition, your data may be disclosed to our advisers and any potential buyer and will be passed on to the new owners.
International transfers
Some of your data may be transferred to companies outside the European Union or a country deemed adequate.
In this case:
Where data is transferred to a country whose level of data protection has not been recognized as adequate under the GDPR, such transfers are based on appropriate safeguards specified in Article 46 of the GDPR, tailored to each provider, in particular through the conclusion of standard contractual clauses approved by the European Commission.
Security
We are committed to the security of personal data. We take appropriate security measures to limit misuse of and unauthorized access to personal data.
Third-party websites
This privacy statement does not apply to third-party websites linked from our website. We cannot guarantee that these third parties handle your personal data reliably or securely. We recommend that you read the privacy statements of these websites before using them.
Your rights over your data
Under data protection regulations, you have rights, including:
Right of access
You have the right to request information about the nature of the processing carried out, the origin or type of data collected, as well as copies of all the information we hold about you.
Right to rectification
You have the right to request rectification of information you believe to be inaccurate. Likewise, you have the right to ask us to complete information you consider incomplete.
Right to erasure, right to be forgotten
You have the right to ask us to delete your personal data in certain specific situations.
Where your data is processed on the basis of your consent or the Company's legitimate interest, you have the option of obtaining early deletion of your data. To exercise this right, simply let us know of your wish to withdraw your consent or to exercise your right to object to the processing of your data.
Outside the exercise of this right, your data is automatically deleted upon expiry of the aforementioned retention period.
Right to restriction
This right gives you the option of suspending the processing of your data after submitting a request for rectification, for example. If you have concerns about the legality of one of our processing activities, this right allows you to ask our teams to stop processing your data, without deleting it. In addition, if you wish to take legal action to assert, exercise, or defend your rights, this right also allows you to "freeze" your personal data.
Right to object
You have the right to object to the processing of your personal data in certain circumstances.
The right to object allows you to refuse to be included in data processing.
The user may object to any processing of their personal data and request its deletion, unless the company can demonstrate legitimate and compelling grounds for such processing, or the processing is necessary for the establishment, exercise, or defense of legal claims.
With regard to direct marketing solicitations that the user receives from the Company, the user may withdraw the consent they gave in order to stop receiving such solicitations.
This right may be exercised at any time and will be reminded to the user in the messages they receive from the Company.
Right to data portability
This right gives you the option of requesting access to your personal data, provided that such data is processed on the basis of your consent or as part of a contractual relationship. This data will be provided to you in a technically usable format, whether for your own use or for use by an entity other than the Company.
How to exercise your rights
To exercise your rights, please go to the following page: https://monexpertrgpd.com/exercice-des-droits/?client=IYU
For any questions relating to the protection of personal data, you may contact our Data Protection Officer (DPO):
Name : Mon Expert RGPD
Mail : conformite@monexpertrgpd.com
Complaint to the CNIL
If, after contacting us, you believe that your rights over your data are not being respected, you may lodge a complaint with the CNIL.
Effective date
We reserve the right to modify this policy, in whole or in part, at any time.
This version of the Company's privacy policy came into effect on July 20, 2026. 20 juillet 2026.
