Website Privacy Notice
Controller
TwoWay SAS ("TwoWay"), 7 RUE René Coty, 91330 Yerres, Paris, France.
Contact for privacy matters
contact@twoway.finance
Scope
This Privacy notice contains the information on how TwoWay handles your personal data when you visit the twoway.finance website or contact us about our services.
This Privacy Notice ("Notice") applies to the users of this website.
Your privacy is of our utmost importance, this is why we make sure that we are processing personal data in accordance with the relevant laws, in particular EU Regulation 2016/679 ("GDPR").
Purposes and legal bases
Operate and secure the site (serve content, prevent abuse, debug): legitimate interests (GDPR art. 6(1)(f)).
Respond to your inquiries (e.g., product or support questions): contract / pre-contractual steps (art. 6(1)(b)) and legitimate interests (art. 6(1)(f)).
Legal compliance (e.g., security/record-keeping): legal obligation (art. 6(1)(c)), where applicable.
Measure how the site is used (analytics provided by HubSpot): your consent (art. 6(1)(a)), which you may withdraw at any time.
We do not sell personal data or share it for advertising purposes.
Data we collect on this website
When you access the website, TwoWay collects only the following information:
Technical logs produced by your browser/connection (e.g., IP address, date/time, URLs visited, HTTP headers, user-agent) required to serve and secure the site.
Communications you send us (e.g., emails to our contact addresses or messages submitted via a contact form, if provided).
Cookies and similar technologies
We use two categories of cookies:
- Strictly necessary: required to deliver and secure the site, including the cookie that records your cookie choice. These are always active and do not require your consent.
- Analytics: set by HubSpot to measure how visitors use the site. HubSpot sets hubspotutk (a pseudonymous visitor identifier, 6 months), __hstc (its main analytics cookie, 6 months), __hssc (session tracking, 30 minutes) and __hssrc (session restart detection, expires when you close your browser).
Analytics cookies are not set, and the HubSpot tracking script is not sent to your browser at all, unless you accept them. Declining means no analytics code is loaded and no data reaches HubSpot. Continuing to browse or scrolling is not treated as consent.
You can change or withdraw your choice at any time using the "Cookie settings" control at the bottom of any page, which also deletes any HubSpot cookies already stored on your device.
Recipients and international transfers
TwoWay do not sell personal data or share it for advertising purposes.
The following data are processed as follow:
Hosting/CDN: The site is hosted on Vercel, which processes technical logs to deliver content globally. Some infrastructure may be outside the EEA. International transfers are protected using the EU Standard Contractual Clauses (SCCs) and Vercel's security measures.
Email: Emails you send to us are processed by our email provider (Microsoft 365). Where data is transferred outside the EEA, SCCs and appropriate safeguards apply.
Analytics: if, and only if, you accept analytics cookies, browsing data (your IP address, the pages you view, and a pseudonymous visitor identifier) is processed by HubSpot, Inc. to produce site usage statistics. Transfers outside the EEA rely on HubSpot's certification under the EU-U.S. Data Privacy Framework, supplemented by the EU Standard Contractual Clauses. If you decline, no data is sent to HubSpot.
Service providers act under contract and only process data to provide their services to us.
As a general rule, the personal data gathered through our website will not be communicated or transferred to any third-parties, unless such transfer is permitted by law or you have explicitly consented to such transfer.
For example, we may transfer personal data to external auditors, to comply with legal obligations.
Retention
TwoWay observes the following retention periods:
Web server/security logs: retained for up to 90 days (longer only to investigate security incidents).
Inquiry emails and related correspondence: retained for up to 24 months after the last interaction, or longer if needed to establish or defend legal claims.
Your rights
Under applicable law you may request access, rectification, erasure, restriction, portability, or object to processing.
Where we rely on your consent, you may withdraw it at any time (art. 7(3)) using the "Cookie settings" control at the bottom of any page. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out beforehand.
If you want to exercise any of these rights or for communication purposes, complaints or any questions regarding this privacy notice, you may contact us by email at : contact@twoway.finance
We will respond within 30 days of verifying your identity.
Supervisory authority
If you have concerns, you may contact the French data protection authority (CNIL) in addition to contacting us.
Changes to this notice
We may update this notice from time to time; the latest version will always appear on this page.
Last updated: 30 Jul 2026