Privacy Policy

Privacy Policy — GDPR compliant version / French and European law

1. Introduction

Vista Group attaches particular importance to the protection of personal data and the respect of the privacy of its customers, partners, users and visitors to its websites and mobile applications.

The purpose of this Privacy Policy is to inform you in a clear and transparent manner about how your personal data is collected, used, stored and protected in accordance with:

  • Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”);
  • the amended Data Protection Act;
  • French and European regulations applicable to banking and financial institutions.

2. Data controller

The data controller is:

Vista Group
[Address of the registered office to be completed]
Email: holding@vistabankgroup.com

For any questions relating to the protection of personal data, you can contact our dedicated department at the following address:

Email: dpo@vistabankgroup.com (to be adapted if necessary)

3. Data collected

We may collect the following categories of data:

a) Identification data

  • Name and surname;
  • Date and place of birth;
  • Nationality;
  • Identity document;
  • Signature.

b) Contact data

  • Postal address;
  • Email address;
  • Phone number.

c) Banking and financial data

  • Account number;
  • Transaction history;
  • Payment information;
  • Data relating to the products and services subscribed to.

d) Technical data

  • IP address;
  • Login data;
  • Cookies and trackers;
  • Device type and operating system;
  • Browsing data.

e) Regulatory data

In the context of the legal and regulatory obligations applicable to financial institutions:

  • KYC information;
  • data relating to the fight against money laundering and the financing of terrorism (AML/CFT);
  • Tax and regulatory information.

4. Purposes of the processing

Your personal data is collected and processed for the following purposes:

  • management of the banking and contractual relationship;
  • opening and managing accounts;
  • execution of banking and payment operations;
  • management of digital services and mobile applications;
  • authentication and access security;
  • fraud prevention and risk management;
  • compliance with legal and regulatory obligations;
  • improvement of our internal services and statistics;
  • corporate communication and marketing, subject to your consent where required.

5. Legal bases for processing

The processing carried out is based on the following legal bases:

  • the performance of a contract;
  • compliance with legal and regulatory obligations;
  • the legitimate interest of the bank;
  • your consent where required by applicable regulations.

6. Recipients of the data

Personal data may be communicated:

  • to the companies of the Vista Group;
  • to service providers and subcontractors acting on our behalf;
  • to the authorized administrative, judicial or regulatory authorities;
  • to banking and technical partners strictly necessary for the performance of the services.

All service providers acting on behalf of the bank are subject to strict confidentiality and security obligations.

7. International Data Transfer

As part of its international activities, Vista Group may transfer certain personal data outside the European Union.

These transfers are carried out in accordance with the GDPR and are subject to appropriate safeguards, including:

  • adequacy decisions of the European Commission;
  • standard contractual clauses;
  • reinforced technical and organisational measures.

8. Retention period

Personal data is kept for a limited period of time that is proportionate to the purposes pursued, in particular:

  • for the duration of the contractual relationship;
  • and then archived in accordance with the legal and regulatory obligations applicable to banking and financial institutions.

Some data may be kept for a longer period of time in order to comply with legal obligations or in the event of litigation.

9. Data Security

Vista Group implements appropriate technical and organizational measures to ensure the security, integrity and confidentiality of personal data, including:

  • data encryption;
  • Secure authentication;
  • access control;
  • Logging operations;
  • monitoring of unauthorized access;
  • Protection against data loss, alteration and disclosure.

10. Cookies and trackers

The website and mobile applications may use cookies and similar technologies to:

  • ensure the proper functioning of the services;
  • improve the user experience;
  • measure the audience;
  • offer adapted content.

Users can manage their cookie preferences through the consent management banner or their browser settings.

11. Your Rights

In accordance with the GDPR, you have the following rights:

  • right of access;
  • right to rectification;
  • right to erasure;
  • right to restriction of processing;
  • right to object;
  • right to portability;
  • the right to withdraw your consent at any time;
  • right to set guidelines regarding the fate of your data after your death.

You can exercise your rights by contacting:

Email: dpo@vistabankgroup.com

Identification may be required to verify your identity.

12. Complaints

If you believe that the processing of your personal data does not comply with the applicable regulations, you have the right to lodge a complaint with the competent supervisory authority, including:

  • in France: CNIL

13. Policy Update

This Privacy Policy may be amended at any time to reflect:

  • regulatory changes;
  • technological developments;
  • or changes in the services offered.

The latest version is available on the official Vista Group media.

Last updated: May 2026