Privacy Policy

Vialmas S.A.S. ("Vialmas", "we", "our") is committed to protecting the privacy of its users in accordance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679) and the French Data Protection Act (loi Informatique et Libertés). This privacy policy describes how we collect, use, share and protect your personal information.

The data controller is Vialmas S.A.S., 75 Avenue des Champs-Élysées, 75008 Paris, France. Our Data Protection Officer (DPO) can be contacted at: dpo@vialmas.com

We collect the following types of data:

• Identification data: surname, first name, date of birth, nationality, European identity document number
• Contact details: postal address (EU), email, telephone number
• Financial data: income, employment situation, banking history (KYC/AML)
• Connection data: IP address, browser type, pages visited, security logs
• Transaction data: transaction history, SEPA beneficiaries, statements
• Biometric data: fingerprint, facial recognition (authentication only, with consent)

Your data is used for:

• Performance of the contract: opening and managing the account, executing banking transactions
• Legal obligation: anti-money laundering (AML/CFT), tax reporting, regulatory compliance (ACPR, AMF)
• Legitimate interest: service improvement, fraud prevention, security
• Consent: marketing communications, non-essential cookies, biometrics

Your data may be shared with:

• European regulatory authorities (ACPR, AMF, CNIL, tax authorities)
• Service providers acting on our behalf (EU hosting, KYC, payments)
• Card networks (Visa, Mastercard) - PCI-DSS certified
• Anti-fraud bodies (TRACFIN, Europol where required)
• Partner banks for SEPA/SWIFT transfers

Transfers outside the EU: Where data is transferred to third countries, appropriate safeguards are put in place (European Commission Standard Contractual Clauses, adequacy decisions).

Your data is kept for the duration of the contractual relationship and for the statutory retention periods: 5 years after account closure for KYC data (AML/CFT), 10 years for accounting records (French Commercial Code), 3 years after the last contact for marketing data.

Under the GDPR, you have the following rights:

• Right of access (Art. 15): obtain a copy of your personal data
• Right to rectification (Art. 16): correct inaccurate or incomplete data
• Right to erasure (Art. 17): request the deletion of your data ("right to be forgotten")
• Right to data portability (Art. 20): receive your data in a structured format (JSON, CSV)
• Right to object (Art. 21): object to the processing of your data
• Right to restriction (Art. 18): restrict processing in certain cases
• Right to withdraw your consent: at any time for processing based on consent

Exercising your rights: Through the app, by email to dpo@vialmas.com, or by post. Reply within 1 month at most.

Complaint: You may lodge a complaint with the CNIL (cnil.fr).

We implement technical and organisational measures in line with best practice: TLS 1.3 and AES-256 encryption, strong authentication (2FA, biometrics), pseudonymisation, ISO 27001-certified hosting in the EU, regular penetration testing and 24/7 SOC monitoring. In the event of a data breach, we will notify the CNIL within 72 hours and the individuals concerned where necessary.

Our website uses cookies. Essential cookies are necessary for the website to function. Analytics and marketing cookies require your prior consent. You can manage your preferences through our cookie banner or your browser settings.

This policy may be updated. Substantial changes will be notified by email and/or in-app notification. The current version is always available on our website.