Privacy Policy.

Introduction

This Privacy Policy ("Policy") is an informative document about the processing of personal data that takes place within the framework of Findity's (hereinafter "we", "us") account information service and the software Findity. The policy is divided into different sections depending on whether we act as a controller or processor.

Regardless of the role we play or the product we use when processing your personal data, your privacy is important to us. If your personal data is processed by us, you should be able to trust that we treat it in a secure manner and with a high level of protection. You should also be able to feel confident that we have done our utmost to ensure that no third parties can access your data and that you know what data we process. We ensure that personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Swedish Data Protection Act (2018:218) with supplementary provisions to the EU Data Protection Regulation and the Swedish Data Protection Authority's regulations and general advice as well as other applicable legislation relating to the products ("Applicable Data Protection Legislation").

When we process your personal data, we always have a legitimate purpose based on a legal basis for why we process your personal data. We ensure that we only process personal data that is justified in relation to the purposes for which we process the personal data. Our ambition is that the personal data we process about you should be correct, which means that we may need to delete the data if it turns out to be incorrect. Your personal data is not stored for longer than necessary, which means that we delete it if we no longer have a legal basis and a legitimate purpose for processing it.

What is personal data?

Personal data is information about an identified or identifiable natural person. "Identifiable natural person" means a person who can be identified directly or indirectly by reference to an identifier, such as name, identification number, location information, online identifiers, or other factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity.

What does personal data processing mean?

The processing of personal data refers to a measure or combination of measures related to personal data whether automatic or not - such as collection, registration, organisation, structuring, storage, processing or alteration, production, reading, use, delivery, delivery by transfer, dissemination or other provision, adjustment or merger, limitation, deletion, or destruction.

Processing of personal data in the role of data controller

Findity AB, corporate registration number 556838-8200, Box 108, 771 23 Ludvika, Sweden, ("Findity") is the controller for the personal data processed for users of the account information service and for the processing of personal data as set out below for contact persons for customers/partners using the software Findity.

In the context of the Card Linking Programme, Findity is the controller for Transactional Data processed for its own purposes. In these contexts, Findity and its payment card scheme partners each act as independent controllers for their respective purposes and responsibilities. Neither party acts as a processor on behalf of the other, nor does the arrangement constitute joint controllership. Findity is the controller when determining the purpose and manner in which personal data is to be processed. However, Findity generally acts as a processor in relation to the users of the Findity Platform when processing personal data on behalf of its customers.

The account information service and Findity Platform, is hereinafter referred to as (the "products").

Why do we process personal data and what kind of personal data is processed?

Customer agreement

In order for us to be able to manage customer relationships in connection with the products, we must process personal data about our customers' and partners' contact persons as well as personal data about users of our product where we are the controller. The personal data collected primarily includes name, telephone number, company name, title, and e-mail address. The processing is based on the fact that the processing is necessary for the performance of a contract to which the customer is party and for compliance with a legal obligation or for the purposes of the legitimate interests pursued by the controller in processing the personal data. A detailed description of what personal data we process within the framework of our products can be found in the appendices to this policy.

Personal data is primarily processed with the purpose to:

• Manage sales and contract processes with customers.
• At the customer's request provide offers for products.
• Market the products.
• Fulfill our contractual obligations in relation to users where we are controllers.
• Provide support to users of the products.
• Improve the functionality and ease of use of products.
• To manage customer agreements by, for example, invoice.
• To be able to reach contact persons and users.
• To participate in the Card Linking Programme.

Potential customers

We collect personal data related to potential customers in order to carry out marketing measures. Primarily, the personal data collected comprises name, telephone number, company name, title, email address. Personal data is collected, for example, at trade fairs, from public registers and company websites, as well as from our own contact form on our website. The personal data is then used to book meetings with potential customers, send out newsletters, and send invitations to our events or webinars.

The legal basis for our processing personal data related to potential customers is our commercially legitimate interest in processing the personal data. Similarly, in our opinion, processing does not have a negative impact on the data subject's privacy, especially when considering that persons whose data we process may opt out of our marketing mailings, and that the data processed is not of a sensitive nature.

For visitors to our website, IP addresses are stored in access logs, however, this information is anonymized.

For visitors to our website, we use cookies. How we use cookies is described in our Cookie policy, see https://findity.com/legal/.

How do we collect personal data?

The personal data that we process is primarily collected directly from you. However, in the case of our customers, we may also collect personal data from any other person who is also employed by your employer.

We may also collect personal data from public registers, websites or when you register as a service user. We may also collect personal data from partners.

Find more information in the section with the header Card Linking Programme.

We may also process personal data in the form of images that you upload in the products, such as images of receipts. The amount of personal data we collect in connection with these images varies depending on the document that has been photographed.

How do we share your personal data?

We may share your personal data with third parties, for example, in the following situations:

Partners

We will share your personal data with partners and suppliers. These may be partners that we work with in the delivery of our products.²

Authorities

In certain situations, authorities may request that personal data be disclosed to an authority. In such a situation, we will only disclose personal data if there is a decision from the authority that requires the personal data to be disclosed.

Transactions

In connection with an acquisition, merger with another company, or division of any of the companies in the Group, the acquiring company and/or its hired consultants may demand access to certain personal data that we process about you. In the event of such disclosure, we will ensure that the person who receives the personal data is covered by a confidentiality agreement.

Your rights

You can choose not to receive marketing from us by either:

1. follow the instructions to opt out of our communication, or
2. contact us via the contact forms on the website

Fundamental rights

You have the right to access your personal data that we process and to review it. You also have the right to request data portability of the personal data processed. If the personal data we process about you is incorrect, you can request that we correct it.

In certain circumstances, you have the right to request that the personal data we process about you be deleted. If you request deletion, we must delete the personal data if i) the personal data is no longer needed for the purpose for which it was collected, ii) you withdraw consent, iii) the personal data is processed illegally, or iv) the personal data must be deleted for legal reasons. You also have the right to request that our processing of your personal data be restricted and the right to object to our processing of your personal data.

If you have any questions or would like to exercise your rights, you can contact our Data Protection Officer at privacy@findity.com

If you have objections or comments about our processing of personal data, you can also contact the Swedish Privacy Protection Authority at the following address:

² Refer to exemptions relating to the Card Linking Programme.

How we process and store your personal data

When we process your personal data, everyone in our business is obliged to comply with applicable data protection legislation and as set out in this document in order to maintain a high level of protection of your privacy. When we process your personal data, we must:

• prevent unauthorized access to your personal data,
• prevent the dissemination of your personal data, and
• prevent other deviations when we process your personal data.

We ensure that your personal data is treated confidentially, that your privacy is not compromised by our processing of personal data and that we guarantee access to personal data in accordance with applicable data protection legislation. In order to achieve an appropriate level of protection when processing your personal data, we use reasonable technical and organizational measures. The reasonableness is assessed based on the category of personal data that we process in relation to the risk that may arise in the event of a breach of our systems or operations and the costs of putting in place safeguards.

Organizational measures

• We have appointed a data protection officer.
• We have established processes for how we should act in the event of a data breach.
• We hold regular training sessions for our employees on issues related to personal data processing.
• We have a Data Processing Agreement in place with all our suppliers and other interested parties who process personal data on our behalf.
• We have established instructions for IT management within the organization.

Technical measures

• We use 256-bit encryption (128-bit for some older phones with hardware restrictions) and 2048-bit keys.
• All communication to and from users is encrypted using TLS. Data stored in server environments is encrypted with ZFS encryption.
• Checks for detecting and preventing malware are run regularly using rootkit detection and removal tools.
• IDS/IDP monitors check and delete malware continuously.
• Our Products are in operation on servers in data centers that are monitored and staffed around the clock.
• All data is stored in two different locations in Sweden.
• Data is backed up every hour.
• The data centers are climate-controlled and fire-protected.
• The data centers are equipped with secondary power supplies and diesel generators to ensure the power supply to the servers.
• Our server environment and networks are protected by firewalls.

For how long do we process your personal data?

We will process your personal data for as long as necessary for the purpose for which we have collected the personal data and as long as we have a legal basis for the processing of the personal data. This means that we may process your personal data for some time after a contractual relationship has ended. As soon som we no longer need the personal data or do not have a legal basis for processing it, we will delete it.

Processing of personal data in the capacity as a processor

As part of how we provide the Products, we will, during certain transactions, process personal data related to users and customer representatives on behalf of our customers in partner and direct customer transactions as these parties have been given the right to provide the Products in their own name. In these situations, our customers and partners decide the purposes and means of personal data processing. This means that, in these situations, we only process personal data on behalf of the customer or partner and may only process such personal data in accordance with the instructions they provide us. The relationship between us and any such partner or customer is governed by a Data Processing Agreement.

When our customers or partners are responsible for personal data, it is the customer or partner who must ensure that they have a legal basis for processing the personal data and that the data subjects are informed in accordance with the requirements set out in Applicable Data Protection Legislation.

When our customers or partners use our products, we must ensure that the products meet the requirements set out in Applicable Data Protection Legislation. We will also work with our customers and partners so that they can fulfill their obligations to those whose personal data is being processed.

Use of data processors and subprocessors

In our processing of personal data, we may in certain situations use other actors to process personal data on our behalf. When we instruct these processors or subcontractors to process personal data on our behalf, the personal data will, as a rule, not be processed outside the EU/EEA.

When we instruct these processors or sub-processors to process personal data on our behalf, we ensure that they can meet the requirements for processing personal data in accordance with applicable data protection legislation. We always enter into personal data processing agreements with such actors to ensure that they meet these requirements. If the person we are commissioning is an actor who may process your personal data outside the EU/EEA, we will ensure that we take the necessary measures required by applicable data protection legislation for a transfer to a country outside the EU/EEA to be considered legal.

Card Linking Programme

To participate in the Card Linking Programme and by registering a corporate/business payment card in connection with real time transaction monitoring, you authorise the Card Linking Programme to share your payment card information with the Payment Card Networks so it knows you enrolled in and is participating in the Card Linking Programme. You authorize the Payment Card Networks to monitor transactions on your registered card(s) in order to enable your usage of real time transactions.

This will enable automating expense creation by allowing you to link real time transactions with receipts and accounting details, however, only you will be privy to the original card transactions, while expenses created from transactions can be submitted for approval and exported to bookkeeping and payroll systems.

What personal data is processed, how and why in the Card Linking Programme

The Card Linking Program and its Third-Party Service Providers will use your Transactional Data, as described in this section and in accordance with the Terms of Use and Privacy Policy, for the purposes of:

1. To create an expense record of the Transactional Data and thereafter maintain and use the derived expense data in connection with operating the Findity Platform and to ensure a correct financial record of the expense report in the Customer's accounting system;
2. To provide information in order to respond to a request from government authority or a payment organization involved in a transaction with you or a merchant. You authorize the sharing, exchange and use of Transactional Data described above and herein by and among Card Linking Programme and Card Linking Programme's Third-Party Service Providers and applicable Payment Card Networks.

We receive card transactions (where card numbers are always masked) from the Payment Card Network and we will notify you of each transaction made by the card so that you can create an expense based on the Transactional Data. Transactional Data is processed and stored in a module separated from all other data within the Findity Platform, thus, ensuring a clear segregation and compliance with data protection principles.

Transactional Data, meaning your registered card identifier, merchant, transaction date, time and amount only, this data is not shared with customer's authorisers, administrators or support staff, since we are the controller of this data.

When a card transaction is done and processed in the Findity Platform, an expense report is created. This expense report may then be shared with customer's authorisers or administrators, however, only the data referring to the expense made by you. Partner's support staff is not privy to the original Transactional Data either. Once the expense report has been approved, the expense report will be automatically logged in the customer's accounting system and stored in accordance with legal bookkeeping requirements. The original Transactional Data is deleted after 90 days.

Links to other websites

If our website contains links to third-party websites or material posted by third parties, these links are for information purposes only. Since we have no control over the material or processing of personal data on these pages, we assume no responsibility for the processing of personal data in connection with such pages.

Changes to this Policy

In the event this Policy is changed, an updated version of the document will be made available on our website. Therefore, to keep up to date with its content, we recommend that you visit our website regularly. If we make significant changes to this document, such as changing the purpose for personal data processing, we will also send an e-mail or post a notice using our social media.

Contact

If you have any questions regarding this Policy, your personal information, or if you suspect that we are breaching your rights, please contact us in one of the following ways:

Attachment 1