Privacy Notice

Kreditz AB, registration number 559148-2400, Vendevägen 87, 182 32 Danderyd, Stockholm ("Kreditz", "we", "us") is a Swedish company that provides digital services for the collection, structuring and analysis of financial information. Our services are used, among other things, for identity verification, regulatory compliance or as part of credit and other assessments. We have permission from the Financial Supervisory Authority (Sw. Finansinspektionen) to provide account information services.

You come into contact with us when you use a service in which our technology is integrated, usually through a partner that provides the relevant service. This privacy notice explains how we collect, process and protect your personal data when you visit our website, contact us through forms, use our services through a partner or otherwise interact with us. More information about how we process personal data can be found under point 2.

The privacy notice also covers the processing that takes place when Kreditz fulfills its obligations under the Act (2017:630) on measures against money laundering and financing of terrorism (the “Anti-Money Laundering Act” or “AML”).

For those of you who contact us in connection with a recruitment process (e.g. by submitting an application or expression of interest), please see our separate privacy notice for recruitment.

We use cookies and similar technologies on our website to improve functionality, analyze user behavior and, in some cases, for marketing purposes. You can choose which cookies you agree to, and you can change or withdraw your consent at any time. More information about how we use cookies and how you manage your settings can be found in our Cookie Policy.

We have appointed a data protection officer which will help us ensure that we meet these requirements. If you have any questions regarding how we fulfill our obligations, you are welcome to contact our data protection officer using the contact details in section 10 below.

Below you can read about how we collect and process personal data in different parts of our operations. We describe what we do with the data depending on how you interact with us.

For each area, we explain which categories of personal data may be processed, why and for what purpose the data is processed, and what role we have hold under Regulation (EU) 2016/679 of the European Parliament and of the Council, also known as the general data protection regulation (“GDPR”).

We share your personal data with service providers acting as our data processors. They are only permitted to process your data according to our instructions and may not use it for their own purposes. These recipients belong to the following categories:

• Cloud service providers for hosting and data storage
• Email communication services
• SMS communication platforms
• Marketing services for email distribution
• Services for optimization of our services and website
• Security and development services

In certain cases, we are obliged to share personal data with competent authorities when required by the Anti-Money Laundering Act. Such sharing is done without your prior consent and may occur without informing you.

We do not sell or share your personal data with any other third parties.

If we transfer your personal data outside the European Economic Area (EEA), we ensure appropriate safeguards, such as the use of the European Commission's Standard Contractual Clauses (SCC).

We only retain your personal data for as long as necessary for the specific purpose or to fulfill legal requirements. Personal data is anonymized or deleted no longer needed.

When processing is carried out under applicable legislation, such as AML, the Bookkeeping Act and the Annual Accounts Act, we retain personal data in accordance with legal requirements.

Kreditz, in its capacity as a data processor, has implemented the following technical and organizational security measures:

• Encryption of personal data both during at rest and in transit
• Access controls with authorization role-based permissions
• Continuous system monitoring and audit logging
• Secure development practices and regular security testing
• Internal trainings, governance documents, and policies for privacy and information security
• Measures for data minimization

You have the right to:

• Request access to your data
• Request correction of incorrect data
• Request deletion of your data (“right to be forgotten”)
• Object to certain types of processing
• Request data portability

Contact us via the contact details below if you wish to exercise any of these rights.

If you believe your personal data is being processed incorrectly, or if your rights under the GDPR have not been respected, you can file a complaint with the relevant supervisory authority:

Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten) Website: www.imy.se

If you have questions about this privacy notice or how we process your personal data, you can contact us at:

Data Protection Officer
Kreditz AB
Vendevägen 87, 182 32 Danderyd
E-mail: privacy@kreditz.com