Data Privacy & Compliance

GDPR compliance, data residency, and retention policies for payment data processed through Yuno.

Overview

Yuno is committed to protecting the privacy and security of personal and financial data. This page outlines how Yuno handles data privacy, complies with major regulations (including GDPR and LGPD), and provides tools for you to manage your customers’ data rights.

Regulatory Compliance

Regulation	Region	Status
GDPR	European Union / EEA	Compliant
LGPD	Brazil	Compliant
PCI DSS	Global	Level 1 Certified
SOC 2 Type II	Global	Certified

Yuno acts as a data processor under GDPR and LGPD. You, the merchant, are the data controller. This means you determine the purposes and means of processing personal data, while Yuno processes it on your behalf according to your instructions and applicable regulations.

Data Processing

What Data Yuno Processes

Data Category	Examples	Purpose	Retention
Payment data	Card tokens, transaction amounts	Payment processing	Per retention policy
Customer identifiers	Email, name, document number	Transaction association	Per retention policy
Device data	IP address, browser info, device ID	Fraud prevention, 3DS	90 days
Transaction records	Payment IDs, status, timestamps	Reconciliation, compliance	7 years (regulatory)

What Yuno Does NOT Store

• Raw card numbers (PANs) are encrypted in the PCI-compliant vault
• CVV/CVC codes are never stored (used only for real-time authorization)
• Passwords or authentication credentials

Data Residency

Yuno processes and stores data in secure data centers with regional presence:

Region	Data Center Location	Applicable Data
Americas	US, Brazil	LATAM merchant data
Europe	EU (Frankfurt)	EU merchant data

If your business is subject to data residency requirements (e.g., EU data must stay within the EU), contact Yuno support to confirm your data processing region before going live.

Data Retention Policies

Data Type	Default Retention	Configurable	Regulatory Minimum
Transaction records	7 years	No	Required by financial regulations
Customer PII	3 years after last transaction	Yes	Varies by jurisdiction
Device/session data	90 days	No	N/A
Audit logs	5 years	No	Required for compliance
Vaulted card tokens	Until customer deletion	Yes	N/A

Customer Data Rights

Yuno provides API endpoints to help you fulfill customer data rights under GDPR and LGPD:

Right to Access (Data Export)

curl --request GET \
  --url https://api.y.uno/v1/customers/{customer_id}/data-export \
  --header 'X-Api-Key: YOUR_API_KEY'

Right to Deletion (Data Erasure)

curl --request DELETE \
  --url https://api.y.uno/v1/customers/{customer_id} \
  --header 'X-Api-Key: YOUR_API_KEY'

Customer deletion removes personal data but retains anonymized transaction records as required by financial regulations. Vaulted payment methods are permanently deleted and cannot be recovered.

Right to Rectification

curl --request PATCH \
  --url https://api.y.uno/v1/customers/{customer_id} \
  --header 'Content-Type: application/json' \
  --header 'X-Api-Key: YOUR_API_KEY' \
  --data '{
    "email": "[e-mail]",
    "name": "Updated Name"
  }'

Data Processing Agreement (DPA)

A Data Processing Agreement is required under GDPR when Yuno processes personal data on your behalf. Yuno provides a standard DPA that covers:

• Scope and purpose of data processing
• Data security measures
• Sub-processor management
• Breach notification procedures
• Data subject rights assistance

Request a copy of Yuno’s Data Processing Agreement through your account manager or via the Yuno Dashboard under Settings > Legal > Data Processing Agreement.

Best Practices

• Minimize data collection: Only send personal data to Yuno that is necessary for payment processing.
• Implement data deletion workflows: Build customer-facing tools to handle deletion requests promptly.
• Review sub-processors: Regularly review Yuno’s sub-processor list (available in the DPA) for compliance.
• Use tokenization: Leverage Yuno’s tokenization to avoid storing sensitive data on your servers.
• Document your data flows: Maintain a record of processing activities (ROPA) that includes Yuno as a data processor.