RGPD | YouzIT

Application of the General Data Protection Regulation at YouzIT

YouzIT is committed to protecting the personal data of its users and fully complies with the Regulation (EU) 2016/679 — the General Data Protection Regulation (GDPR), in effect since May 25, 2018. This page describes how YouzIT specifically applies the obligations of the Regulation.

In the active silo (United Kingdom), supplementary national legislation also applies: UK GDPR + Data Protection Act 2018.

1. Data Controller (Art. 4(7))

YouzIT acts as data controller of the personal data collected on the platform. The Data Protection Officer (DPO) can be contacted at: dpo@youzit.me.

2. Principles of Processing (Art. 5)

YouzIT applies the fundamental principles of the GDPR:

Lawfulness, fairness and transparency: data is processed based on a legal basis (consent, contract execution, or legal obligation) and the user is informed in a transparent manner through this page and the Privacy Policy.
Purpose limitation: data is collected for determined and explicit purposes (account management, swaps, subscriptions) and is not reused for incompatible purposes.
Data minimization: YouzIT only collects the data necessary for the platform to function — it does not request superfluous data.
Accuracy: users may correct their data at any time in the Profile, ensuring it is accurate and up to date.
Storage limitation: data is retained only for the period necessary (see section 6 of the Privacy Policy). After account deletion, data is anonymized or deleted, unless there is a legal retention obligation.
Integrity and confidentiality: data is protected against unauthorized access through SSL encryption and secure infrastructure (Base44).

3. Legal Bases for Processing (Art. 6)

YouzIT bases the processing of data on the following legal grounds:

Consent (Art. 6(1)(a)): registration on the platform, acceptance of Terms and Privacy.
Performance of a contract (Art. 6(1)(b)): management of subscriptions, swaps, and YouzITs.
Legal obligation (Art. 6(1)(c)): retention of tax records and fraud prevention.
Legitimate interest (Art. 6(1)(f)): platform security, analysis of suspicious activity.

4. Rights of the Data Subject (Chapter III)

YouzIT guarantees the exercise of all rights provided for in the GDPR:

Right of access (Art. 15): the user may request a copy of their data.
Right to rectification (Art. 16): correction of inaccurate data, available in the Profile.
Right to erasure (Art. 17 — Right to be Forgotten): "Delete Account" functionality in the Profile.
Right to restriction of processing (Art. 18): restriction of processing in specific cases.
Right to data portability (Art. 20): receipt of data in a structured format.
Right to object (Art. 21): objection to processing based on legitimate interest.
Right not to be subject to automated decision-making (Art. 22): YouzIT does not make automated decisions with legal effects on the user.

To exercise these rights, the user can use the platform features (Profile → Delete Account) or contact the DPO at dpo@youzit.me. YouzIT responds to requests within 30 days (Art. 12(3)).

5. Information and Transparency (Art. 13 and 14)

At the time of registration, YouzIT informs the user about the identity of the controller, the purposes of processing, the legal basis, the recipients of the data, the storage period and the rights of the data subject. This information is permanently available in the Privacy Policy.

6. Security of Processing (Art. 32)

YouzIT implements appropriate technical and organizational measures to ensure the security of personal data:

SSL Encryption in all communications between the user and the platform.
Base Infrastructure 44 with security and data protection certification.
Restricted access to data only by authorized personnel, with authentication.
Pseudonymization of sensitive data whenever possible.
Audit logs to detect unauthorized access.

7. Notification of Personal Data Breach (Art. 33 and 34)

In the event of a personal data breach that presents a risk to the rights and freedoms of users, YouzIT will notify the competent supervisory authority within 72 hours (Art. 33) and, if the risk is high, will inform the affected users without undue delay (Art. 34).

8. International Transfers (Chapter V)

Data may be processed on servers located outside the European Union. In such situations, YouzIT ensures adequate protection through standard contractual clauses approved by the European Commission (Art. 46) or adequacy decisions (Art. 45).

9. Data Protection Impact Assessment (Art. 35)

YouzIT conducts data protection impact assessments (DPIA) whenever processing presents a high risk to the rights and freedoms of users, in accordance with Art. 35 of the Regulation.

10. Supervisory Authority and Complaints

The user has the right to lodge a complaint with the competent supervisory authority in their country of residence. In United Kingdom, The responsible entity is indicated in the platform footer. YouzIT fully cooperates with supervisory authorities in the event of an investigation.

GDPR — Regulation (EU) 2016/679