Privacy Policy Apps

Data Privacy Policy – Mobile Application

This Privacy Policy outlines the manner in which Helvo SA ("Helvo") collects and processes personal data in connection with the use of the Helvo mobile application (the "App").

For the purposes of this Policy, "personal data" refers to any information relating to an identified or identifiable natural person. Such data is protected under applicable data protection legislation and, in certain cases, by banking confidentiality obligations. Personal data may also extend to information related to legal entities, such as the names and contact details of shareholders, directors, or beneficial owners.

Personal data will only be disclosed to third parties where such disclosure is necessary for the performance of contractual obligations, where you have provided your explicit consent, or where disclosure is otherwise permitted or required by law.

Please note that the transmission of data over the Internet (for example, communication by email) may be subject to security risks. Absolute protection of data against unauthorized third-party access cannot be guaranteed.

This Privacy Policy may be updated at any time. You will be duly informed of any amendments. The current version is available at all times here in PDF format.

Responsible party

When you use the Helvo App, the collection, processing, and use of your personal data are carried out by:

Helvo SA
Chemin de Mongevon 25
1023 Crissier, Switzerland
("Helvo")
Email: [email protected]

Additional information about Helvo can be found in the legal notice contained in our price list.

Scope and definition

This Data Privacy Policy applies exclusively to the use of the Helvo app and any personal data that may be collected and stored in the context of its use—for instance, through the notified recording of telephone conversations with our employees—in order to fulfill legal obligations or for Helvo's legitimate business purposes.

This policy explicitly does not cover:

• The use of Helvo's website. Information regarding data protection for website use can be found in the applicable website-specific privacy policy;
• Third-party websites accessed via links provided within the Helvo app or website.

If you use our services solely for informational purposes or without holding a bank account, Helvo does not collect personal data except for data automatically transmitted by your browser or device to facilitate access to our website.

Legal bases for data processing

Helvo collects, processes, and uses your personal data lawfully and in good faith. Depending on the purpose of data processing, Helvo relies on the following legal bases:

a. Contractual Obligations

Personal data is primarily processed to establish or perform contracts with you, including the management, operation, maintenance, and improvement of the Helvo app and its services.

b. Legal Obligations

Helvo may be required to process or disclose personal data in order to comply with applicable laws or official directives.

c. Legitimate Interests

Personal data may be processed for purposes unrelated to contract performance to protect Helvo's or third parties' legitimate interests. Examples include monitoring and controlling operational risks, product development, marketing and market research, service-related communication, securing Helvo's claims, and ensuring the safety of customers and employees.

d. Consent

For processing unrelated to contractual obligations (e.g., sending newsletters), Helvo relies on your consent, which may be withdrawn at any time.

Collection and Processing of Personal Data

Helvo aims to collect only the data necessary to provide full functionality and security of the app and services. Personal data is shared with third parties only when legally required, with your explicit consent, or when third parties have legitimate interests. Additional consent is required for services involving further processing, such as mobile payment providers.

a. App Login

Upon registration via Helvo or Hypothekarbank Lenzburg AG, users may log in using their contract number or email and a login code.

b. Biometric Authentication

The Helvo app supports fingerprint and facial recognition login if the device allows it. Helvo does not receive your biometric data. For details on biometric authentication, contact the device provider.

c. Data Collected for Account Opening and Usage

Master Data: During account opening with Hypothekarbank Lenzburg AG, Helvo collects the following personal data:

• Full name, date, and place of birth
• Gender, marital status, nationality
• Email, home address, mobile number
• Audio and video recordings (e.g., calls, pictures, videos)
• Commercial usage, tax domicile, US tax liability
• ID type, number, issue date, and copy of ID document

Account Management: The app displays personal data such as account details, IBAN, name, email, mobile number, and home address.

Transactions and Card Payments: Transaction data (e.g., transfers, payments, withdrawals) is encrypted during transmission and stored to display account activity and enable all app features. Stored transaction data includes: IBANs, recipient details, merchant category, POS/ATM location, amounts, currencies, reference numbers, posting date and type, transaction IDs, and bank details.

Account Closure: After account closure, Helvo retains customer data for five years to prevent misuse. Proper uninstallation deletes local data, and users may request deletion from productive systems as permitted by law. Data in unstructured formats (e.g., support tickets or backups) may not be fully erasable.

Notifications: Users may activate notifications for account updates, transaction alerts, and budget notifications. This feature requires secure storage of the login code and uses Apple Push Notification Service, Google Cloud Messaging, or Huawei Push Service. Data transmission is encrypted.

d. Identification Procedure

Hypothekarbank Lenzburg AG must verify identities per FINMA regulations. Identification may be digital, via video or online verification, facilitated by Intrum AG. Video identification requires camera access for ID and user verification. Data, including video and photos, is encrypted, shared with Helvo and Hypothekarbank Lenzburg AG, and deleted within 90 days. Online identification uses encrypted ID copies and TAN verification.

Customer Support

Helvo uses Freshworks Inc. systems to manage support requests. Collected information includes name, email, contract number, product type, language, and phone number. Data is stored in EU-based data centers under applicable data protection regulations. Communications are logged to improve future support.

All data centers are ISO27001 certified and governed by Swiss Data Protection law, with technical and organizational measures in place to prevent unauthorized access.

Data generated by the Helvo App

Helvo generates additional functionalities from collected data, including:

• Transaction Categorization: The app automatically categorizes transactions (e.g., rent, travel, salary) using account numbers, references, or recipient names. Users can reassign categories manually.
• Usage Data: Data generated during app use (IP address, device info, date/time, duration, and visited content) is collected to improve user experience and prevent misuse.
• Peer-to-Peer Payments: Users may send money to other Helvo customers. Access to the address book is requested to facilitate recipient identification.
• Invite Friends: Users may invite friends to Helvo. Upon successful invitation, personal data may be shared with the invitee as required for the service.
• Mobile Payments: To use Google, Samsung, and Apple mobile payment services, account data is encrypted into a token. Personal data may be shared with these providers as they provide the technology for the services.

Does Helvo use non-personal (anonymous) data?

Helvo may collect and use non-personal (anonymous) data, such as device-related statistics or anonymized transaction information, which cannot be traced back to any individual user. Such data is employed exclusively to optimize the performance and functionality of the Helvo app.

Protection of your personal data

All communication between Helvo and Hypothekarbank Lenzburg AG is fully encrypted using standardized TLS/SSL protocols.

Data Security: Transactions are processed through a secure application programming interface ("Open API") provided by Hypothekarbank Lenzburg AG and Helvo. All banking transaction data is stored in Hypothekarbank Lenzburg AG's data centers or Swiss data centers, which are ISO27001 certified. Helvo complies with the Swiss Data Protection Act and implements appropriate technical and organizational measures to safeguard personal data against unauthorized access and misuse.

Use of Third-Party Services

Helvo relies on selected third-party service providers, such as data centers, to support its operations. Personal data may be processed or stored by these providers, including encrypted transaction data in ISO27001-certified Swiss data centers, or customer support data managed by Hubspot Inc. in accordance with EU data protection regulations. All service providers are legally and contractually obligated to process personal data solely on Helvo's behalf, following Helvo's instructions and adhering to technical and organizational measures to ensure data protection.

Analysis Services and Tracking Technologies

Helvo uses selected analysis services and tracking technologies, such as those provided by Google, to conduct statistical analysis of app usage. This processing is based on Helvo's legitimate interest in improving the user experience. Data transmitted to Google is not combined with other Google data nor shared with third parties.

Information collected through these services is used exclusively for troubleshooting and optimizing the app experience. Usage data is generally stored on Google servers in Europe for a limited period and is not repurposed or transferred to other parties. Additional details are available in Google's privacy policy.

Email Communications

Helvo may send emails to users, who may unsubscribe from marketing or informational emails at any time, except for communications necessary to maintain or terminate the customer relationship (e.g., updates to the General Terms and Conditions).

For email delivery, Helvo stores users' email addresses, first names, preferred language, and, where applicable, customer segment attributes. The email service provider is contractually obligated to ensure an appropriate level of data protection.

Is my personal data transmitted abroad and how is it protected there?

Personal data may be transmitted to carefully selected third parties within and outside Switzerland if necessary to provide services (e.g., processing payments), required by law (e.g., automatic information exchange), or based on your consent. Helvo ensures that recipients of personal data maintain an adequate level of data protection, for example, through the use of standard contractual clauses issued by the European Commission.

For customer support purposes, all personal data described in Section 4 is stored either in Switzerland or in the European Union via the systems of Hubspot Inc., in compliance with the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (nFADP).

Retention period for personal data

Helvo processes and stores personal data for the duration of the business relationship, from initiation and account opening to contract termination, and beyond as required by statutory retention and documentation obligations. Personal data may also be retained for the period during which claims may be asserted against Helvo, to comply with legal obligations, or to safeguard legitimate business interests (e.g., for evidence or documentation purposes). Once personal data is no longer required for these purposes, it will be deleted or anonymized wherever possible.

Operational data (e.g., system logs and protocols) is generally retained for shorter periods, typically twelve months or less.

Data subjects have the right to block, erase, or destroy their personal data, subject to any legal restrictions. Consent for data processing may be revoked at any time with future effect; however, revocation may limit access to services or result in termination of the user relationship. Helvo will inform users in advance of any consequences, including potential costs, resulting from the withdrawal of consent.

Customer Support

For assistance with the Helvo app or questions regarding this Data Privacy Policy and data protection, customers may contact Helvo's support team:

• By email: [email protected]
• By mail: Helvo SA, Chemin de Mongevon 25, 1023 Crissier, Switzerland

Rights of the data subject

Right to Information: Upon request, Helvo will provide information regarding personal data stored about you, including recipients or categories of recipients who have received such data, and the purposes for which it is processed.

If stored personal data is inaccurate, you are encouraged to contact customer support to ensure timely correction. Users may also update personal data directly via the Helvo app.

Entry into force

This Data Privacy Policy is effective immediately. Helvo reserves the right to amend it at any time. Users will be notified of changes via email. In the absence of objections within 30 days from receipt of the notification, the amended policy shall be deemed accepted.

Helvo will explicitly inform users of their right to object, the objection period, and the consequences of not submitting an objection in the context of any amendments to the Data Privacy Policy.