Privacy Policy

Last updated: June 2026

This Privacy Policy applies to Bueno Europe Ltd and other companies within the Bueno group (collectively referred to as "Bueno", "we", "us", or "our"). It explains how we collect, use, and protect your personal data when you use our services through the Bueno application and website (getbueno.com), operated by Bueno Europe Ltd.

1. Data Controllers

Depending on the nature of the processing, one or more of the following entities act as Data Controller in relation to your personal data:

1.1 Bueno Europe Ltd (Primary Controller)

1.2 Treezor (Payment & E-Money Partner)

Our payment and e-money services are provided in partnership with Treezor SAS, a licensed e-money institution supervised by the ACPR. Treezor acts as an independent Data Controller for all processing activities related to the issuance of e-money and the execution of payment transactions.

2. Data We Collect

Depending on your use of our services, we may collect and process the following categories of personal data:

• Identity data: full name, date of birth, nationality, government-issued ID documents

• Contact data: email address, phone number, postal address

• Financial data: payment account information, transaction history, bank details

• KYC/AML data: proof of identity, proof of address, source of funds declarations

• Usage data: application activity logs, navigation history, device identifiers

• Marketing preferences: communication consent records, campaign interaction data

• Support data: correspondence and records of requests submitted to our support team

3. Purposes and Legal Bases for Processing

In accordance with Article 13 of the GDPR, the table below sets out each processing purpose alongside its applicable legal basis and the relevant Data Controller.

4. Data Recipients

Your personal data may be shared with the following categories of recipients:

• Treezor SAS, as Data Controller for payment services

• Technical service providers and sub-processors (cloud hosting, analytics, communication platforms)

• Identity verification and KYC providers

• Fraud prevention and credit risk assessment partners

• Competent regulatory and supervisory authorities

• Courts, arbitration bodies, or law enforcement where legally required

Upon request, Bueno will provide you with the detailed list of recipients of your personal data. Contact us at support@getbueno.com.

5. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), such transfers are made on the basis of: an adequacy decision by the European Commission; Standard Contractual Clauses (SCCs); or another appropriate safeguard under Chapter V of the GDPR. You may obtain a copy of the applicable mechanism by contacting support@getbueno.com.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected:

• KYC and AML records: 5 years from end of the business relationship

• Transaction records: 5 years following the transaction date

• Contractual data: duration of the contract + 5 years

• Marketing data: 3 years from the last interaction, or until consent is withdrawn

• Support correspondence: 3 years from the date of the request

7. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

• Right of access (Art. 15): obtain a copy of your personal data

• Right to rectification (Art. 16): request correction of inaccurate or incomplete data

• Right to erasure (Art. 17): request deletion of your data in certain circumstances

• Right to restriction of processing (Art. 18)

• Right to data portability (Art. 20)

• Right to object (Art. 21): including to direct marketing

• Right to withdraw consent (Art. 7(3)): without affecting prior lawful processing

To exercise your rights, contact us at support@getbueno.com. For rights relating to payment services controlled by Treezor, send your request directly to Treezor's DPO at dpo@treezor.com.

8. Right to Lodge a Complaint

Important: You have the absolute and unconditional right to lodge a complaint with a data protection supervisory authority at any time, regardless of your country of residence or the location of the alleged infringement. This right exists independently of any other legal remedy and is guaranteed by Article 77 of the GDPR.

If you reside in an EU/EEA member state, you may also lodge a complaint with the supervisory authority of your country of habitual residence or place of work.

9. Cookies

We use cookies and similar technologies for: essential functions (no consent required); analytics (subject to consent); and marketing/personalisation (subject to consent). Manage your preferences at any time via the cookie settings panel in the application.

10. Contact & Updates

We may update this policy at any time. We will notify you of material changes by email or in-app prior to changes taking effect.