GDPR identity and consent service for EU businesses

What YUNIT provides

Consumer registration and wallet setup

• A customer scans a merchant poster or QR entry point and registers once with YUNIT.
• The customer completes a self-declared profile with billing identity data such as name, billing address, and tax number or NRT.
• The customer adds a YUNIT card to Apple Wallet for faster in-store identification and approval.
• The wallet card presents a rotating QR lookup token, not a readable block of personal data for the merchant.

How in-store consent works

When a merchant needs customer data, the POS creates a scoped request with the exact fields and business purpose, such as preparing an invoice or validating billing details.

The clerk scans the customer's YUNIT wallet QR. YUNIT resolves that lookup token, starts the approval flow, and asks the customer to authenticate with a one-time code before any data is shared.

• The customer sees the merchant name, requested fields, and purpose before deciding.
• The customer can allow or deny the request on their own phone.
• If approved, the merchant receives only the requested fields that were authorised for that single request.
• If denied or expired, the merchant receives no personal data and must start a new request.

Revocation and control in v1

• Consent is one-time per request. There is no standing merchant permission that stays active after the response is delivered.
• A customer can deny any future request and can disable or replace their wallet card if the device or token should no longer be trusted.
• If the wallet profile is revoked or reissued, future scans stop working until the new wallet credential is active.
• Merchants must request access again whenever they need customer data for a new business purpose.

Trust and audit posture

• Customer profile attributes are self-declared in v1 and can later be upgraded with stronger verification flows if needed.
• YUNIT records what the merchant requested, what the customer approved, the stated purpose, and when the release happened.
• Merchants see only the scoped fields needed for the approved request, which supports data minimisation under LQPD.
• The service gives merchants a reusable operating model for consent, auditability, and customer-controlled data release.

Who this fits

This service is aimed at EU merchants that need a practical way to collect customer identity data for invoices, loyalty, hospitality, retail, or regulated service interactions without maintaining a separate PII store for every location.

It also fits teams that want a credible architecture story for auditors, procurement reviews, and customer-data governance conversations while keeping the customer in control of each release.