Privacy Policy

1. Introduction

   In this Privacy Policy, “IUVO”, “we”, “us” or “our” means IUVO Group OÜ, and “You”, “Your” and “user” means any person who visits or uses our website, including the associated landing pages, or uses our services.

   This Privacy Policy explains and governs:

   how and when we collect Your personal data and what information we collect;
   • how and why we use Your personal data; and
   • Your rights to control Your personal data.

   Please read this Privacy Policy carefully. By accessing and using our website and services, You confirm that You have had the opportunity to read this Privacy Policy, that You understand it and that You agree to be bound by it. If You do not do so, You will not be able to fully use the services provided through the website. If You have additional questions regarding this Privacy Policy, please contact us at the contact details indicated below.

   We may amend this Privacy Policy in order to comply with applicable laws and regulations or to respond to changing business requirements. We encourage You to review this page periodically for up-to-date information about our privacy practices and any changes to this Privacy Policy.

   For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

   • “Personal data” – information by which a natural person can be identified directly or indirectly.
   • “Data subject” – living natural persons who are identified or identifiable through the processed personal data.
   • “Processing of personal data” – means any operation performed on personal data, including but not limited to its collection, recording, organisation, storage, use, disclosure, analysis and destruction.
   • “Personal data controller” – a person who determines the purposes and means of processing personal data and is responsible for their lawfulness and protection.
   • “Personal data processor” – a third party who processes personal data on behalf of and under the instructions of the controller.
   • “Personal data breach” – a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
   • “Digital assets” – the website www.iuvo-group.com, all landing pages maintained by the Company, as well as web and mobile applications and other digital platforms through which the Company provides services.
   • Group of companies within the Management Financial Group (“MFG Group”) – all companies that are directly or indirectly controlled by “Management Financial Group” AD, which are registered and operate both within the territory of the Republic of Bulgaria and abroad, and carry out financial and non-financial activities. An up-to-date list of all companies that are part of the MFG Group, as well as information about their activities, is available here.

2. Who We Are

The IUVO Portal is operated by IUVO Group OÜ, commercial registry code: 14063375, registered address: Narva mnt 7a, Tallinn 15172, Harju County, Republic of Estonia, telephone: +359 884611374, e-mail: [email protected].

3. How to Contact Us About the Processing of Your Personal Data

   To exercise Your rights under this Policy, please complete and send us this FORM by e-mail to [email protected].

   In case of additional questions or complaints regarding our data processing activities, please address them to [email protected]. You can also write to us at: Narva mnt 7a, Tallinn 15172, Harju County, Republic of Estonia.

4. What Personal Data Do We Process and How Do We Process It?

4.1 Personal data

Personal data is any information we have about a specific user that allows the user to be directly or indirectly identified. Pursuant to EU General Data Protection Regulation 2016/679 (hereinafter referred to as the GDPR) we have the obligation to inform You about the data processing activities carried out by us.

IUVO may process the following categories of personal data:

• General personal information: full names (given name, surname); date of birth; personal identification code or other identification number.
• Identification data, Know Your Customer (KYC) data and anti-money laundering (AML) data: identity document (for example, national identity card) and information contained in that document (document number; date of issue; date of expiry; country of issue; photograph); information relating to politically exposed persons (“PEPs”). We collect information that allows us to identify You in order to fulfil our regulatory obligations and provide our services. We may collect information from various reliable and independent sources, whether public or private, to verify the information You have provided to us (see more below in the item “Information collected from external sources – third parties”). In order to register on our website, we require Your first name and surname, date of birth, place of residence and/or location, a copy of Your identity document (only if necessary).
• Contact data: e-mail address; postal address; telephone number. If You use our services, we also collect information about means of communication in order to contact the user (telephone, e-mail address, etc.).
• Account-related information: login credentials, password and preferences (such as language). Since we provide our services in various jurisdictions, we may ask You to indicate Your preferred language of communication from the languages we offer for the website or for general communication in order to provide You with a better customer experience.
• Payment information: information regarding payment details in connection with the use of our services. If You purchase receivables through our portal, we need information about Your bank account. All payments to and from Your virtual account*, maintained in the Portal, may only be made to and from the bank account You have provided to us. For further information, please see the item “Virtual account and adding funds” in the terms of use.
  
  *The virtual account is solely an internal accounting register in the Portal and does not constitute a bank account, payment account or electronic wallet, nor an account opened or maintained by a payment service provider in the name of the User.
• Usage information: information about how our services are used, including feedback provided, including technical information collected during the use of the services. While You use our services, You create metadata in connection with Your activities on our website. The information collected from the portal consists of login data, the commencement and completion of the registration process in the Portal, etc. Moreover, we have information about the contracts You have concluded through the portal. We may also collect information about Your computer (including, where possible, Your IP address, operating system and type of browser), Your interaction with the marketplace and our website, and data on e-mail performance. We use this information for several reasons, including for marketing purposes, for administering the marketplace, improving the services, and for statistical purposes. These processes are described in more detail in our Cookie Policy. Where You have consented to the use of third-party cookies You should be aware that Your data will be processed, transmitted, transferred and stored in accordance with their privacy policy. Your data may be transferred to countries without an adequate level of protection based on Your explicit consent. Detailed information about the cookies used is available in the Cookie Policy: https://www.iuvo-group.com/bg/cookie-policy/. You may manage or restrict certain cookies through Your browser settings and, where available, through our cookie consent management tool.
• Information from external sources – third parties: we may obtain personal data about You from various private or publicly available sources, solely for the purpose of fulfilling the portal operator’s legal obligations under applicable laws (including through media and the internet). Above all, this means collecting information about You so that we can fulfil our requirements related to money laundering prevention. The sources of such information may be various and cannot be strictly defined. This information, which often contains personal data, includes:
  
  information and reports from credit information agencies, fraud prevention agencies, insolvency practitioners, credit consultants and tracing agents;
  • commercial databases and marketing databases; and
  • public registers and other publicly accessible sources of information.

In item 5 below, a more detailed overview of what personal data we process is presented.

4.2 Processing of personal data

Processing of personal data means any operation performed using personal data, including but not limited to collection, recording, storage, organisation, use, alteration, provision, disclosure and erasure of Your personal data by the portal operator IUVO. Whether automated or not, all of the above activities are considered processing of Your personal data.

The controller of the processing of personal data is the portal operator IUVO Group OÜ. To contact our data protection officer, please write to the e-mail address: [email protected].

4.3 Purposes and legal grounds for processing

IUVO processes personal data primarily for the purpose of providing services to our clients, i.e. to perform our contractual obligations towards our clients. The legal basis for such processing of personal data is Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. We process personal data for the purpose of facilitating the conclusion and performance of contracts and, where necessary, the establishment, exercise or defence of legal claims arising from those contracts. Some specific requirements of applicable laws may require us to carry out data processing activities from which we cannot refrain.

We collect, store and use Your personal data:

• to inform You about developments and changes in our products and services;
• to develop and improve our services, products and activities, including to analyse and improve our credit risk models and our offering of services to clients;
• for the transfer of funds;
• for carrying out mandatory or other regulatory checks;
• to comply with our legal and regulatory obligations;
• to conduct statistical analyses, market research and market testing;
• for direct marketing purposes, including through profiling, for the purpose of sending information about personalised products, services and campaigns of IUVO and other companies from the MFG Group, including those offering non-financial products and services, subject to Your prior consent. The provision of consent for receiving marketing communications is entirely voluntary and is not a condition for the use of IUVO’s services. You may withdraw Your consent at any time.
  
  For direct marketing purposes, personal data may be subject to profiling, including within the MFG Group, in order to provide more relevant and personalised offers. Such profiling does not involve solely automated decision-making that produces legal effects concerning You or similarly significantly affects You.
  
  The profiling is used solely for marketing and customer engagement purposes and does not constitute investment profiling, investment advice or an individual recommendation to Users.

The foregoing does not apply to service-related or transactional communications that we send in order to perform our obligations under the Terms of Use and the contracts concluded with You, including communications necessary to:

• create and administer user accounts in the Portal and manage and maintain these accounts;
• confirm Your identity and other information You have provided to us, including information about Your bank account;
• update Your personal data and the records we maintain about You;
• for the prevention and detection of fraud or other illegal or criminal activity – the money laundering prevention provisions oblige us to provide specific information to the Estonian Financial Intelligence Unit and, where applicable, the Estonian Police and Border Guard Board or another competent authority. In some cases, we are not permitted to inform You about such exchange of information;

IUVO may also process personal data where processing is necessary for compliance with a legal obligation applicable to IUVO. For example, in the event that a court requests personal data from IUVO under an applicable court order or judicial decision, or a law enforcement authority requests personal data under an applicable regulation. Also, if IUVO is obliged to retain personal data, for example under the Accounting Act, under the Money Laundering and Terrorist Financing Prevention Act or another applicable legal act. In case of such processing of personal data, the legal basis is Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject.

IUVO may process personal data if You have given consent for a specific purpose of data processing. The legal basis for such processing is Article 6(1)(a) GDPR. For example, when You participate in the “Refer a Friend” Programme as a Referred Person in Your capacity as a natural person, we collect and process Your personal data – first name and surname and Your e-mail address. The described personal data are provided to us by the Referring Person (Your friend) with confirmation given to us by them that You have given Your consent to receive from us an e-mail with the possibility to confirm Your consent and to take the next steps for registration on the IUVO portal as a buyer of receivables or to request that we erase Your personal data and/or terminate the processing of Your personal data. If You do not confirm Your consent and/or do not take steps to register on the IUVO portal as a buyer of receivables, we will process Your personal data (first name, surname and e-mail) for a period of 2 months from the date on which the Referring Person provided us with the personal data described above.

In certain cases, IUVO may also process personal data if this is necessary for the purposes of the legitimate interests of IUVO, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject that require the protection of personal data, in particular where the data subject is a child. In such case, the legal basis for the processing of personal data is Article 6(1)(f) GDPR. Where the processing of Your personal data is based on our legitimate interest, You have the right at any time to object to such processing (see more in item 6 below).

In item 5 below, a more detailed overview is presented of what personal data we process and for what purposes.

4.4 General principles of processing of personal data and retention periods

IUVO processes the user’s personal data lawfully, fairly and in a transparent manner and to the extent provided for by applicable legislation.

IUVO applies appropriate technical and organisational measures to protect personal data in order to prevent unauthorised access, loss, unlawful use, disclosure or destruction.

IUVO provides access to the user’s personal data only to:

– its employees for whom this is necessary for the performance of their duties, who are subject to appropriate confidentiality obligations;
– processors and other service providers that process personal data on our behalf pursuant to an appropriate data processing agreement and confidentiality obligations (see additionally item 4.5 below).

We implement appropriate measures to prevent unauthorised third parties from accessing users’ personal data and the systems in which such data are stored.

Your personal data related to the contracts concluded by You through our portal will be retained for as long as required by applicable laws. The retention periods applied by IUVO are indicated in the table provided in item 5 below.

Personal data may be erased earlier where they are no longer necessary for the relevant purposes or where a valid erasure request has been submitted by the data subject, unless continued retention is required or permitted by applicable law. If You have questions about the specific retention periods applicable to the data processed about You, You can contact IUVO at any time.

4.5. Transfer and disclosure of personal data

We may transfer Your personal data in accordance with the terms of use and applicable law to:

• Persons to whom the portal operator is obliged to transfer the user’s personal data under the law;
• Legal advisers and providers of legal services to the portal operator, as well as persons providing legal assistance in connection with contracts concluded with users.

In principle, all recipients to whom IUVO transfers Your personal data are located in the European Union and the European Economic Area. Where it is necessary to transfer Your personal data to a third country or international organisation outside the European Economic Area, IUVO will implement appropriate safeguards and will transfer the personal data (i) to countries in which the European Commission considers the level of data protection to be adequate (see HERE), (ii) under an explicit agreement with Standard Contractual Clauses adopted by the European Commission, available HERE and used by IUVO depending on the circumstances of the data transfer) or (iii) under other instruments permitted by applicable legislation, provided that applicable rights of data subjects and effective legal remedies for data subjects are available.

Where the user has provided separate consent, IUVO may disclose the user’s personal data, primarily the user’s name and e-mail address, to service providers engaged to market and promote IUVO’s products to that user.

As part of the MFG Group, we may need to share Your personal data with other companies from the MFG Group. Such processing is in accordance with applicable legislation.

• IUVO may exchange within the MFG Group data collected in the course of the customer due diligence carried out for the purpose of fulfilling the legal requirements for preventing the use of the financial system for money laundering and terrorist financing, and more specifically: establishing and verifying the source of funds; disclosure of information about unusual and suspicious transactions and their reporting to a competent state authority; taking steps to identify potential links or relationships between relevant persons and to identify third parties acting on behalf of or for the account of the client.
• Based on Your consent, the Company may exchange personal data with other companies from the MFG Group for the purpose of carrying out direct marketing, including for offering its own products and services, as well as products and services of other companies from the MFG Group through personalised offers. In these cases, personal data are provided to other companies from the MFG Group, which process the data as separate Controllers for their own purposes, as well as to external providers of marketing services (e.g. marketing agencies). Joint controllership is possible only in individual cases where the companies jointly determine the purposes and means of processing.

When You visit our website, we may transfer personal data within the European Union and the European Economic Area and/or to a third country or international organisation outside the European Union. In such case, appropriate safeguards and transfer mechanisms will be implemented, as required under the GDPR.

5. Overview of our processing activities

If You engage with us in any way, we may collect the following information about You through the contact methods You have chosen to use at the time of engagement:

6. Your Rights in Relation to the Processing of Personal Data

You have the following rights in connection with the processing of Your personal data. However, keep in mind that not all of these rights are absolute and they may be limited on the grounds provided for in the GDPR.

Right to information:

You have the right to receive confirmation as to whether the Company processes Your personal data and, if so, information about the manner of processing and access to Your personal data and the information required under Article 15 GDPR, including a copy of the personal data undergoing processing.

The copy covers only the personal data and does not include an obligation to provide the media on which they are stored. Where You request additional copies, a reasonable fee based on administrative costs may be charged.

When the request is submitted electronically, the information is provided, where possible, in a commonly used electronic format, unless You prefer otherwise.

To exercise this right, You may submit a request through Your user account, send an e-mail to: [email protected] or complete the FORM and send it to: [email protected]. Where the FORM is submitted by e-mail, it must be signed electronically or bear a handwritten signature. Please note that we will provide the information to You only if we have identified You correctly. We will provide the requested information without undue delay and in any event within one month of receipt of the request and free of charge. Taking into account the complexity and number of requests, this period may be extended by up to two further months. We will inform You of any such extension within one month of receipt of the request, together with the reasons for the delay. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, the Company may charge a reasonable fee based on the administrative costs or refuse to act on the request.

In the case of exercising rights through an authorised representative, the Company may require a document certifying the power of representation. Where necessary for the purposes of establishing identity, as well as the scope of the power of representation for rights under the GDPR, the Company may send additional instructions and/or require the provision of additional information from the applicant or their representative. When the data subject submits a request by electronic means, the information shall, where possible, be provided by electronic means, unless the data subject has requested otherwise.

Pursuant to the money laundering prevention provisions, we may be legally required to withhold certain information from You about the use of Your personal data. Insofar as this is not restricted by law, we will provide You with the requested information.

Right to rectification:

In case we process incomplete or incorrect data, You have the right at any time to obtain from us without undue delay the rectification of inaccurate personal data concerning You.

Right to object to the processing of Your personal data:

You can at any time object to the processing of Your personal data if the processing is based on our legitimate interest or that of a third party. In such case, we will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override Your interests, rights and freedoms, or unless the data are necessary for the establishment, exercise or defence of legal claims. Where personal data are processed for the purposes of direct marketing, the data subject has the right to object to the processing of their personal data for this type of marketing.

Right to restriction of processing:

You can request restriction of processing if:

• the accuracy of Your personal data is contested by You, for a period enabling us to verify the accuracy of Your personal data; or
• the processing of Your data is unlawful, and You oppose the erasure of the personal data and request the restriction of their use instead; or
• we no longer need this data (for the intended purpose), but You need it for the establishment, exercise or defence of legal claims; or
• You have objected to the processing of Your data pending verification as to whether our legitimate grounds override Your grounds.

Right to withdraw consent:

Where the processing of Your personal data is based on Your consent, You have the right to withdraw Your consent at any time by using the unsubscribe or preference-management options made available to You, or by using the contact details set out in this Privacy Policy (e.g. sending advertising messages) or by contacting IUVO at the contact details indicated in this Privacy Policy. The withdrawal of Your consent does not affect the lawfulness of the processing based on the consent given prior to its withdrawal.

Right to data portability:

You have the right to receive the personal data concerning You that You have provided to us in a structured, commonly used and machine-readable format and You have the right to transmit those data to another controller without hindrance from us, where:

• the processing of such personal data is based on Your consent or on a contract; and
• the processing is carried out by automated means.

Right to Erasure (“Right to Be Forgotten”)

You have the right to request from us the erasure of Your personal data and/or termination of the processing of Your personal data by us including where:

• Your personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• You have withdrawn Your consent on which the processing of the data is based, and there is no other legal basis for the processing;
• You consider that Your personal data have been processed unlawfully.

Please note that there may be other reasons preventing the immediate erasure of Your data, such as legal retention obligations, pending court proceedings, the establishment, exercise or defence of legal claims, etc.

You are responsible for ensuring that the personal data You provide to us are accurate, complete and up to date. Each user is obliged to inform us promptly about changes in their personal data, as well as about inaccuracy or invalidity of the personal data, by providing us with the correct and valid personal data to replace the incorrect and/or invalid ones.

7. Complaints

   If You believe that our processing of Your personal data infringes applicable data protection law or Your rights in any way, You can lodge a complaint with the Estonian Data Protection Inspectorate or with the competent supervisory authority in the EU Member State of Your habitual residence, place of work or the place of the alleged infringement.

8. Amendments

   We monitor our data processing procedures at least once a year. If we determine that the information provided in this Privacy Policy is no longer accurate or complete, we will make the corresponding amendments.

   All changes made to this policy will be available on this webpage and, if we have Your e-mail address, You may also be informed by e-mail about all material changes.

This Privacy Policy was last updated on 15 June 2026.