Privacy Policy
Version of 16 October 2026 · in force since 16 October 2026
Working version, visible only on the test environment: this text has not been approved yet.
Privacy Policy
Last updated: 16 October 2026
Invexa protects the personal data you entrust to it through the Portal, in accordance with Regulation (EU) 2016/679 ("GDPR") and the amended French Data Protection Act of 6 January 1978.
1. Data controller
JAYLO SAS, operating under the Invexa brand, RCS Cherbourg 948 881 362, 12 La Rue, 50330 Carneville, France, ORIAS no. 25008593. Privacy contact: herve@invexa.fr.
2. Data we collect
| Category | Examples |
|---|---|
| Identity and contact | Surname, first name, date and place of birth, nationality, address, email, phone, ID document |
| Personal and professional situation | Marital status, occupation, employer, tax residence |
| Financial situation | Income, tax notices, bank statements, assets, existing loans, down payment, source of funds |
| Property project | Target property, price, location, financing plan |
| Co-borrowers | Same categories, provided by the User with their consent |
| Connection data | Login credentials, IP address, access logs, device type |
| Communications | Emails, messages, call notes and call recordings where you have been informed in advance |
Invexa does not collect health data through the Portal. Borrower insurance health questionnaires are sent directly to the insurer.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Performance of a contract (Terms of Service) |
| Reviewing your file, searching for and presenting mortgage offers, sharing the file with insurers and guarantee providers | Performance of the Mandate and pre-contractual steps |
| Identity verification, know-your-customer, anti-money laundering and counter-terrorist financing | Legal obligation (Art. L561-1 et seq. French Monetary and Financial Code) |
| Compliance with IOBSP obligations (duty to advise, record-keeping, ACPR supervision) | Legal obligation |
| Portal security and fraud prevention | Legitimate interest |
| Handling complaints and disputes | Legitimate interest / legal obligation |
| Information about our services | Consent, or legitimate interest for similar services (you may object at any time) |
4. Automated processing
Invexa may use automated tools, including artificial intelligence, to extract and classify information from your documents. The results are always reviewed by a staff member. No decision producing legal effects concerning you is based solely on automated processing. The decision to grant a loan rests with the lending institution.
5. Recipients
Your data is accessible only to authorised Invexa staff. To the extent necessary, it may be shared with:
- the credit institutions, financing companies, guarantee providers and insurers approached for your file, which act as independent controllers;
- notaries and other professionals involved in the purchase, at your request;
- our technical processors (hosting, email, e-signature, identity verification, CRM, document analysis tools), including Scaleway for hosting in France: [other processors];
- competent administrative or judicial authorities (ACPR, Tracfin, tax authorities) where required by law.
Invexa does not sell or rent your data.
6. Transfers outside the European Union
Given Invexa's international clientele, some data may be transferred outside the European Economic Area, in particular to partner institutions or processors located in [countries]. Such transfers rely on a European Commission adequacy decision or on the Commission's Standard Contractual Clauses. You may obtain a copy at herve@invexa.fr.
7. Retention periods
| Data | Period |
|---|---|
| Account with no active file | 3 years after last contact, then deletion |
| Financing file and supporting documents | Duration of the relationship, then 5 years (AML/CFT, Art. L561-12 French Monetary and Financial Code) |
| Accounting and invoicing records | 10 years (Art. L123-22 French Commercial Code) |
| Connection logs | 12 months |
| Marketing data | 3 years after last contact |
8. Security
Invexa implements appropriate technical and organisational measures: encryption of data in transit and of stored documents, role-based access control, authentication, logging, hosting in France with Scaleway and staff training. If a personal data breach is likely to result in a high risk to you, you will be informed as required by the GDPR.
9. Your rights
You have the right to access, rectify, erase, restrict and object to the processing of your data, the right to data portability, and the right to set instructions regarding your data after your death. You may withdraw your consent at any time.
Some rights are limited by Invexa's legal obligations: data retained for AML/CFT purposes cannot be erased before the statutory period expires, and access to certain such data is exercised through the CNIL (Art. L561-45 French Monetary and Financial Code).
To exercise your rights: herve@invexa.fr or JAYLO – Invexa, 12 La Rue, 50330 Carneville, France, enclosing proof of identity where necessary. We respond within one month, which may be extended by two months where necessary.
You may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 (www.cnil.fr), or with the supervisory authority of your country of residence within the EU.
10. Cookies
The Portal uses only cookies that are strictly necessary for its operation and session security, which do not require consent. Any analytics cookie or other non-essential tracker will only be placed with your consent, collected through a dedicated banner. [Adapt if analytics tools are used.]
11. Changes
This policy may change. You will be notified of any material change on the Portal or by email. In the event of any discrepancy between the French and English versions, the French version prevails.