Privacy
Your privacy is very important to us. We are therefore careful to make sure we abide by all privacy protection laws. So your data is safe with us and always treated with respect. This privacy statement explains what we do with the information that we receive about you. If you have any questions or want to know exactly what information we hold about you, please get in touch.
Privacy Statement
Version 25th of September 2026
Yivi B.V. and the Privacy by Design Foundation (referred to below as ‘operators’, ‘we’ or ‘us’) process personal data in order to provide attribute-based authentication and signing services by means of the Yivi system. They are responsible for that processing, and they attach great importance to your privacy.
Yivi is designed so that personal data, in the form of ‘attributes’, is stored in encrypted form exclusively on the phone or tablet where you install the Yivi app. Another feature of Yivi is that you decide who your personal data is shared with.
An attribute is a small package of data that typically states a characteristic of its owner (e.g. ‘over 18’). Examples include your bank account number, name, postal address, e-mail address, mobile number or Public Service Number (BSN). The operators cannot see the content of your attributes, nor who you share them with. What’s more, attributes can’t be viewed or shared except using the Yivi app. The whole system is designed for privacy.
Yivi’s purpose is to enable secure, confidential, data-minimised logins, service access, consent and signing involving third-party authentication via the Yivi system.
Who is responsible for your data?
Yivi B.V. and the Privacy by Design Foundation are joint controllers for the processing described in this privacy statement.
- Yivi B.V., Utrecht, registered with the Dutch Chamber of Commerce under number 94861412. Yivi B.V. operates the Yivi app and the Yivi services, and is your first point of contact for all questions about your data.
- Stichting Privacy by Design (Privacy by Design Foundation), registered with the Dutch Chamber of Commerce under number 67144128. The foundation is the publisher of the Yivi app in the app stores.
The operators have agreed that Yivi B.V. handles all requests and questions from users about their personal data. You can nevertheless exercise your rights with either of them.
Contact: for questions about this privacy statement or your data, e-mail support@yivi.app.
Data, privacy and information security officer: Martijn Kamphuis, reachable at security@yivi.app.
What do the operators do with your data?
Below we explain, for each part of Yivi, which personal data we process, why, and on what legal basis.
1. Your Yivi account
When you create a Yivi account, the operators record only a random username (app ID) and, if you choose to give one, an e-mail address. We also keep a limited log of when you used your Yivi app (for example, the date and time your PIN was checked) and of changes to your account. We cannot see where you used the app, which attributes you obtained or shared, or with whom. You can view this log yourself in My Yivi account.
We use this data to make the app work securely, to let you block your account if your phone is lost or stolen, and to let you recover your account. The legal basis is the performance of our agreement with you. If you choose to give a recovery e-mail address, you explicitly consent to us processing it for this purpose.
2. Obtaining attributes from Yivi
Yivi itself issues some attributes, such as your e-mail address, mobile number and bank account number (IBAN). For your e-mail address or mobile number, we send a verification code to that address or number. For your IBAN, we verify that the bank account is yours. We only use that data to perform the verification and issue the attribute, and do not keep it after issuing. The legal basis is your consent, which you give by requesting the attribute.
3. Adding a passport, ID card or driver’s license
When you add an identity document, the Yivi app reads the chip in your document. The data from the chip (such as your name, date of birth, nationality, document number, document validity and the photo stored in the chip) is sent to our servers to check that the document is genuine and has not been tampered with, and is then issued to you as attributes in your wallet. We do not keep this data after issuing. The legal basis is your consent.
4. Face verification
See the separate section on face verification below.
5. Contact with us
If you e-mail us, we use your e-mail address and the content of your message to answer your question. The legal basis is our legitimate interest in answering your questions and helping you.
Every time you obtain or share an attribute, the Yivi app asks for your explicit consent. Your consent is the legal basis for the processing of those attributes by the third-party issuer or recipient. Those parties are themselves responsible for that processing, under their own privacy statements.
Face verification
When you add a passport, ID card or driver’s license, the Yivi app asks you to take a short face scan. We compare this scan with the photo stored in the chip of your document, to confirm that you are the rightful owner of the document before it is added to your wallet. This prevents misuse of lost, stolen or borrowed documents.
Because this comparison involves biometric data, a special category of personal data under the GDPR, we only do this with your explicit consent (Article 9(2)(a) GDPR). The app asks for this consent before the scan. If you do not give consent, the document cannot be added to your wallet with face verification.
The comparison runs entirely within Yivi’s own infrastructure in the Netherlands. We use face verification software from the software vendor Regula, which we run on that infrastructure ourselves. Regula is not a processor: no face scans, photos or other personal data are sent to Regula, and we do not share this data with third parties.
The face scan and the chip photo are only used for this comparison and are deleted as soon as it is finished. We do not store them, and we do not use them for any other purpose, such as training software or building a database of faces.
The result of the comparison determines automatically whether the document is added to your wallet. If you believe the result is wrong, you can contact us at support@yivi.app to explain your situation and have it reviewed by a person.
Who do we share your data with?
We do not sell your data and do not share it with third parties for their own purposes.
We use service providers (processors) to run Yivi. They may only process your data on our instructions and under a processing agreement with us.
- A hosting provider for our general IT infrastructure (servers and hosting), with data centres within the EEA.
- A communications service provider for sending text messages (SMS) with verification codes and for verifying your bank account number (IBAN).
You can request an up-to-date list of the processors we use at support@yivi.app.
We do not transfer your personal data outside the European Economic Area (EEA). Face verification and the data from your identity document are processed exclusively within Yivi’s own infrastructure in the Netherlands.
Some organisations that accept Yivi do so through an intermediary (broker). In a limited number of cases, a verification session then passes temporarily through a technical connector component hosted by Yivi. Yivi only passes this data on at the instruction of the parties involved, does not store it and does not use it for its own purposes.
How long do we keep your data?
- Face scan and chip photo: not stored, deleted immediately after the comparison.
- Data from your identity document: not stored after the attributes have been issued to your wallet.
- E-mail address, mobile number or IBAN for verification: not stored after the attribute has been issued.
- App ID, recovery e-mail address and usage log: for as long as your Yivi account exists. When you delete your account, we delete this data.
- E-mails to our support: for as long as needed to handle your question.
The attributes in your wallet are stored only on your own device. You can delete them at any time in the Yivi app.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted;
- restrict the processing of your data;
- receive your data in a structured, machine-readable format (data portability);
- object to processing based on our legitimate interest;
- withdraw your consent at any time. This does not affect the lawfulness of processing before you withdrew it.
To exercise your rights, e-mail support@yivi.app. We will respond within one month. You can also view your usage log, change your e-mail address and block or delete your account yourself in My Yivi account.
If you are not satisfied with how we handle your data, please let us know. You also have the right to lodge a complaint with the competent data protection supervisory authority (in the Netherlands, the Autoriteit Persoonsgegevens).