Privacy Policy
Ypsilon Services International B.V.
Effective date: 28 August 2026 | Previous version: 5 May 2025
At a glance
This policy explains how Ypsilon Services International B.V. handles personal data when it acts as a controller. For many customer applications, YSI is only the app developer or technical service provider. The customer organisation is normally the controller, its privacy notice applies, and its employees, customers and other app users should contact that organisation about their personal data or account. YSI processes that data only on the customer’s documented instructions.
01. INTRODUCTION
Ypsilon Services International B.V. ("YSI", "we", "us" or "our") respects your privacy and is committed to handling personal data fairly, transparently and securely. This Privacy Policy applies to our website, YSI-branded mobile applications made available through the Apple App Store and Google Play, and other services that link to it. Those applications may be offered to users in Australia and New Zealand, as well as other markets.
We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation or "GDPR"), the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming) and, where applicable, the Australian Privacy Act 1988 (Cth) and Australian Privacy Principles, the New Zealand Privacy Act 2020 and its Information Privacy Principles, and other applicable privacy and electronic-communications rules. In this policy, "personal data" includes "personal information" as that term is used in Australian and New Zealand privacy law. App-store privacy disclosures, data-safety labels and permission prompts supplement this policy and should be read with any service-specific notice.
02. WHO WE ARE
Ypsilon Services International B.V.
Telfordstraat 51
8013 RL Zwolle
The Netherlands
Chamber of Commerce (KvK): 90357078
VAT: NL865288501B01
Privacy requests: privacy@ypsilonpayments.com | General enquiries: info@ypsilonpayments.com
YSI is part of the Ypsilon group and is a wholly owned subsidiary of:
Ypsilon Holding A.G. - Aegeristrasse 8, CH-6300 Zug, Switzerland.
03. SCOPE AND OUR ROLE
This policy applies where YSI determines why and how personal data is processed, including data collected:
-
through our website and YSI-branded applications, including apps distributed through the Apple App Store and Google Play;
-
when you create or use an account, request support or communicate with us;
-
when you engage with us as a client, prospective client, supplier or business partner; and
-
from a client or service provider where the law permits that collection.
For many white-label, custom or client-branded applications, YSI is engaged only as the developer or technical service provider for a customer organisation. App users may be that customer’s employees, contractors, members, clients or end customers. The customer normally determines why and how personal data is processed and acts as the controller; YSI acts as its processor and follows its documented instructions. The customer’s privacy notice governs that processing. Requests about access, correction, deletion, account closure, consent or complaints must therefore be directed to the organisation that made the app or account available to you. If YSI receives such a request, we may forward it to the customer and assist the customer in responding, but we may not be authorised to decide or fulfil the request ourselves. YSI may also process limited data as a controller for its own legal, security or business-administration purposes, as described here.
04. PERSONAL DATA WE MAY COLLECT
The data collected depends on the service, your relationship with us and the permissions you choose. It may include:
-
Identity and contact data: name, organisation, job title, postal address, email address and telephone number.
-
Account and authentication data: username, account identifiers, credentials or authentication records, preferences and account status.
-
Service and transaction data: service requests, orders, tickets, wallet or payment-related records and other records needed to deliver a feature. Where regulated payment or identity-verification services are involved, the applicable provider or client notice will describe any additional identification, financial or verification data.
-
Communications and support data: messages, form submissions, support history, feedback and attachments you choose to provide.
-
Technical and usage data: IP address, device and app identifiers, browser and operating-system information, log data, timestamps, diagnostic information, security events, app interactions and analytics data.
-
Cookie and similar-technology data: cookie identifiers, consent choices and information collected through comparable web or mobile technologies.
-
Location data: approximate location derived from an IP address and, where a feature requires it and you grant device permission, precise or approximate device location while the app is in use or in the background.
-
Business and relationship data: contract, billing, procurement, due-diligence and correspondence records relating to clients, suppliers and partners.
Please do not provide special-category personal data (such as health, biometric, political or religious information) unless a service specifically requests it and the processing is permitted by law.
05. WHERE PERSONAL DATA COMES FROM
We may obtain personal data:
-
directly from you;
-
automatically from your device, browser or use of a service;
-
from a YSI client that provides or sponsors a service;
-
from Ypsilon group companies; and
-
from service providers such as hosting, authentication, analytics, communications, security or payment providers, where applicable.
Where New Zealand privacy law applies and we collect personal information about you indirectly on or after 1 May 2026, we take reasonable steps to ensure you are made aware of the collection and the matters required by Information Privacy Principle 3A as soon as reasonably practicable, unless an exception applies.
06. PURPOSES AND LEGAL BASES
We use personal data only when permitted by applicable law. Where GDPR applies, the principal purposes and legal bases are set out below.
Where we rely on legitimate interests, we consider the nature and impact of the processing and balance our interests against your rights and expectations. You may request more information about that assessment. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.
The GDPR legal bases in the table apply where GDPR governs the processing. In Australia and New Zealand, we handle personal information for the stated purposes in accordance with the applicable collection, use and disclosure rules, including obtaining consent where required.
07. WHEN WE SHARE PERSONAL DATA
We may disclose personal data, only as necessary, to:
-
Ypsilon group companies, including Ypsilon Holding A.G., for group administration, security, support and other compatible purposes;
-
service providers, including providers of hosting, backup, authentication, analytics, communications, customer support, professional services, security, fraud-prevention and other platform functions;
-
payment, financial or identity-verification providers, where a service requires them and the relevant controller notice identifies the processing;
-
clients, where you use a client-branded service or where disclosure is needed to perform a client engagement;
-
public authorities, courts and advisers, where required by law or reasonably necessary to protect rights, safety and security; and
-
transaction counterparties, in connection with a proposed or completed merger, financing, reorganisation or transfer of a business, subject to appropriate safeguards.
Service providers acting as processors are contractually required to use personal data only for authorised purposes and to protect it. Where an app includes a third-party software development kit or library that processes personal data, we assess the relevant data handling and require appropriate protection consistent with applicable law and platform requirements. We do not sell precise location data or share it with third parties for advertising.
08. INTERNATIONAL TRANSFERS
Personal data may be accessed from or transferred to countries outside the European Economic Area (EEA). Switzerland is currently recognised by the European Commission as providing an adequate level of data protection. For transfers to other countries, we use a lawful transfer mechanism where required, such as an adequacy decision, the European Commission’s Standard Contractual Clauses, and supplementary safeguards appropriate to the risk.
You may contact us for information about the safeguard used for a relevant transfer and, where available, a copy of that safeguard, subject to lawful redactions.
For individuals in Australia, where Australian Privacy Principle 8 applies to an overseas disclosure, we take reasonable steps as required to ensure that the overseas recipient does not breach the Australian Privacy Principles, unless an exception applies. For individuals in New Zealand, where Information Privacy Principle 12 applies to an overseas disclosure, we disclose personal information only where the recipient is covered by comparable safeguards or another permitted basis or exception applies.
09. DATA RENTENTION
We keep personal data only for as long as needed for the purpose for which it was collected and to meet legal, accounting, security and dispute-resolution requirements. Retention is determined by the following criteria:
-
account and service data is generally kept while the account, contract or client service is active and for a reasonable period afterward;
-
support and communications records are kept for as long as needed to resolve the matter and maintain an appropriate business record;
-
security, fraud-prevention and diagnostic records are kept for periods proportionate to the relevant risk;
-
consent and preference records are kept as evidence of your choices; and
-
records subject to tax, accounting, regulatory or legal requirements are kept for the period required by applicable law.
When data is no longer needed, we delete or anonymise it, unless deletion is technically impracticable in a backup; in that case, the data remains protected and is removed in accordance with the backup lifecycle. Service-specific notices or contracts may state more precise periods.
10. YOUR PRIVACY RIGHTS
Who to contact first
Check which organisation made the app, login or account available to you. If it was provided by your employer or another organisation that is a YSI customer, that organisation is normally the controller and your primary privacy contact. Send requests about access, correction, deletion, account closure, consent or complaints to that organisation. YSI will assist it as processor where required and may forward requests we receive, but we may not be authorised or able to decide the request ourselves. Contact YSI directly only where YSI is identified as the controller or for YSI’s own processing.
European Economic Area (GDPR)
Subject to the conditions and exceptions in applicable law, you may have the right to:
-
be informed about how your personal data is used;
-
access your personal data and receive a copy;
-
rectify inaccurate or incomplete personal data;
-
erase personal data in certain circumstances;
-
restrict processing in certain circumstances;
-
object to processing based on legitimate interests and object at any time to direct marketing;
-
data portability for certain data processed by automated means on the basis of consent or contract;
-
withdraw consent at any time where consent is the legal basis; and
-
complain to the Autoriteit Persoonsgegevens or another competent supervisory authority.
Where YSI is the controller, exercise a right by emailing privacy@ypsilonpayments.com and describing your request. If your app or account was provided by a customer organisation, send the request to that organisation instead. We may ask for information needed to verify your identity and locate the relevant data. Where the GDPR applies, we normally respond within one month, although an extension may be permitted for complex or numerous requests. Rights are not absolute, and the responsible controller will explain any lawful limitation or refusal.
Australia
Where Australian privacy law applies, you may request access to, or correction of, personal information we hold about you, opt out of direct marketing, and make a privacy complaint. Where practicable and lawful, you may also have the option of not identifying yourself or of using a pseudonym. We will respond within a reasonable period and explain any lawful refusal.
New Zealand
Where the New Zealand Privacy Act 2020 applies, you may ask whether we hold personal information about you, request access to it, and ask us to correct it. If we do not make a requested correction, you may ask us to attach a statement of correction to the information. You may also make a privacy complaint.
Account closure and deletion
If the app or account was provided by your employer or another customer organisation, request account closure and deletion from that organisation; it controls the account and will instruct YSI where YSI acts as its processor. If YSI is the controller, use any deletion option provided in the app or email privacy@ypsilonpayments.com. The responsible controller will delete or anonymise the data unless retention is required or permitted for legal, security, fraud-prevention, dispute-resolution or technical backup reasons, as explained in Section 9.
11. COOKIES, ANALYTICS AND DEVICE PERMISSIONS
Our website and applications may use cookies, software development kits and similar technologies for essential functionality, security, preference storage and measurement. Where required, we request consent before using non-essential analytics or similar technologies. You can manage available choices through the relevant cookie controls, browser settings or app settings. Withdrawing consent does not affect the lawfulness of earlier processing.
Location access is controlled through your device. A service will request permission before accessing precise device location. You can refuse or withdraw permission in device settings, although a location-dependent feature may then be unavailable. Background access is used only when the service supports it and you grant the relevant permission.
The Apple App Store privacy details and Google Play Data safety section provide app-specific summaries of collection, sharing and security practices, including relevant third-party software development kits. These summaries supplement this policy. If you believe a store disclosure is inaccurate or inconsistent with the app's behaviour, please contact us so that we can investigate and update it where appropriate.
12. AUTOMATED DECISION-MAKING
YSI does not use personal data under this general policy to make solely automated decisions that produce legal effects or similarly significant effects for you, unless a service-specific notice explains the processing, legal basis, significance, expected consequences and available safeguards. Security and fraud-detection tools may generate alerts or risk indicators that are reviewed or otherwise handled in accordance with the relevant service design.
13. SECURITY
We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Depending on the service and risk, these measures may include access controls, authentication, encryption, logging, backups, vulnerability management, supplier controls, incident procedures and staff awareness measures. No system is completely secure, and you should protect your credentials and notify us promptly if you suspect misuse.
If a privacy breach is notifiable under applicable law, we will notify the relevant regulator and affected individuals as required. This includes the Australian Notifiable Data Breaches scheme where an eligible data breach is likely to result in serious harm, and New Zealand's requirement to notify the Privacy Commissioner and affected people when a privacy breach has caused or is likely to cause serious harm.
14. CHILDRENS PRIVACY
Our general website and services are not directed to children under 16, and we do not knowingly collect their personal data in circumstances that require parental authorisation without obtaining that authorisation. A client service intended for younger users must provide an age-appropriate, service-specific notice and any required consent process. If you believe a child has provided personal data improperly, contact us.
15. THIRD PARTY SERVICES AND LINKS
Our services may link to or integrate with third-party websites, applications or services. A third party acting as an independent controller is responsible for its own privacy practices. We encourage you to review its privacy information before providing personal data.
16. CHANGES TO THIS POLICY
We may update this policy to reflect changes in our services, processing activities or legal requirements. We will publish the updated version with a new effective date and, where required, provide additional notice or request renewed consent. Material changes will not apply retroactively where doing so would be unlawful.
17. CONTACT AND COMPLAINTS
Client-provided apps
If your app, login or account was provided by your employer or another organisation that is a YSI customer, contact that organisation first through its privacy or support channel. It is normally responsible for your privacy, account and complaint requests. If you contact YSI, we may forward your request and contact details to that customer so it can respond.
YSI-controlled services
Ypsilon Services International B.V.
Telfordstraat 51
8013 RL Zwolle
The Netherlands
Privacy requests: privacy@ypsilonpayments.com
General enquiries: info@ypsilonpayments.com
Online policy: ypsilonwallet.com/privacy-policy
If YSI is the controller and you are not satisfied with our response, you may complain to the Autoriteit Persoonsgegevens (AP) or another competent EEA supervisory authority.
Autoriteit Persoonsgegevens: autoriteitpersoonsgegevens.nl/en
Where Australian or New Zealand privacy law applies, you may complain to the OAIC or OPC respectively, normally after first raising the matter with the responsible controller.
Office of the Australian Information Commissioner: oaic.gov.au/privacy/privacy-complaints
Office of the New Zealand Privacy Commissioner: privacy.org.nz/your-rights/making-a-complaint