Privacy Policy

Under European data protection legislation (the "GDPR"), you have certain rights relating to your personal data, which are described below. You can find our contact details in section 11.

Your rights

· Right to have certain information about you erased ("Right to be forgotten").

In some cases, you have the right to have your personal data erased. This applies, for example, to data that (i) is no longer necessary to process or retain for the purpose for which it was originally collected, or (ii) if you withdraw your consent to a processing activity.

In some cases, however, we are unable to erase your personal data. This is because the data either still needs to be processed for the purpose for which it was collected, because our interest in continuing to process the data outweighs your interest in having it erased, or because we are legally required to retain it. You can read more about the legal requirements that oblige us to retain information, even if you ask to be forgotten, in section 5. The laws described there therefore prevent us from immediately erasing certain data. More information about the right to erasure can be found on the Swedish Authority for Privacy Protection’s (IMY) website.

· Right to be informed about how your personal data is used.

You have the right to be informed about how we process your personal data. We do this through this notice and by answering your questions. More information about the right to information can be found on the Swedish Authority for Privacy Protection’s website.

· Right of access to your personal data ("subject access request").

You have the right to find out whether Norrvidd processes your personal data and to obtain a copy of your personal data, known as a register extract. The register extract tells you what information we hold about you and how we process your personal data. More information about the right of access can be found on the Swedish Authority for Privacy Protection’s website.

· Right to access and transfer your personal data to another recipient ("data portability").

This right means that you can request a copy, in a machine-readable format, of the data Norrvidd holds about you and that we process in order to perform a contract with you, or on the basis of your consent. This is so that you can transfer your personal data to another recipient. More information about the right to data portability can be found on the Swedish Authority for Privacy Protection’s website.

· Right to rectification.

You have the right to request that we correct inaccurate or incomplete information about you, and that we complete your information. More information about the right to rectification can be found on the Swedish Authority for Privacy Protection’s website.

· Right to restriction of processing.

If you believe that the data we hold about you is inaccurate, that our processing is unlawful, or that we do not need the data for a specific purpose, you have the right to request that we restrict our processing of that data. You can also request that we do not process your data while we verify this, or while we verify whether you have the right to object to certain processing as described below. More information about the right to restriction can be found on the Swedish Authority for Privacy Protection’s website.

· Right to object to our processing of your personal data.

You may object to processing carried out on the basis of legitimate interest (Article 6(1)(f) GDPR) on grounds relating to your particular situation. You can also always object to our use of your personal data for direct marketing. When you notify us that you no longer wish to receive direct marketing from us, we will switch off the marketing and thus stop sending you marketing. More information about the right to object can be found on the Swedish Authority for Privacy Protection’s website.

· Right to object to an automated decision that significantly affects you.

You have the right to object to an automated decision made by us if the decision produces legal effects or is a decision that similarly significantly affects you.

More information about the right to object to automated decisions can be found on the Swedish Authority for Privacy Protection’s website.

· Right to withdraw your consent.

As described in section 4 below, where we process your personal data on the basis of your consent or explicit consent, you have the right to withdraw your consent at any time. When you withdraw your consent, we will stop the processing.

· Right to lodge a complaint.

If you wish to complain about our processing of personal data, you can contact the Swedish Authority for Privacy Protection (IMY), which is the Swedish supervisory authority for Norrvidd’s processing of personal data. You can reach the Swedish Authority for Privacy Protection via the following link.

Norrvidd purchases, owns and manages consumer loans. In the tables below you can read about (i) what we will use your personal data for (the purpose); (ii) which types of personal data we use for each purpose and whether we obtained the information directly from you or from another source; (iii) the legal basis we have under applicable data protection legislation, such as the GDPR, for processing data about you (our so-called "legal basis"); and (iv) how long we carry out the purpose.

· Where our processing of personal data is based on a balancing of interests we have assessed that we have a legitimate interest in being able to carry out those types of purposes, that the processing of personal data in question is necessary to achieve the purpose, and that our interest outweighs your right not to have your data processed for this purpose. If you would like more information about how the balancing of interests was carried out, or if you wish to object to this processing, you can always contact us.

· Where our processing of personal data is based on consent you can withdraw it at any time by contacting us.

1.

Purpose of the processing

Administer the ongoing customer relationship, credit relationship, credit monitoring and risk monitoring for borrowers.

Types of personal data

• Identification and contact details

• Usage information

• Technical information

• Customer service information

• Device information

• Financial information

Sources: From the customer, the acquired credit, the borrower, the borrower’s device, Norrvidd’s services or credit reference agencies.

Legal basis

The processing is necessary for us to be able to perform the contract (Article 6(1)(b) GDPR).

When the purpose ends

When the contractual relationship ends.

2.

Purpose of the processing

Risk and credit analysis of new borrowers. This involves profiling, which you can read more about in section 7.

Types of personal data

• Identification and contact details

• Financial information

Sources: From the acquired credit, the borrower, the borrower’s device, Norrvidd’s services or credit reference agencies.

Legal basis

The processing is necessary for us to be able to perform the contract (Article 6(1)(b) GDPR).

When the purpose ends

When the contractual relationship is either entered into or declined.

3.

Purpose of the processing

Prevent Norrvidd’s business from being used for money laundering or terrorist financing, by verifying your identity, and monitoring and reviewing transactions and the use of our services. This involves profiling, which you can read more about in section 7.

Types of personal data

• Identification and contact details

• Technical information

• Customer service information

• Financial information

• Information from external sanctions lists and PEP lists

• Sensitive personal data (from sanctions lists, or biometric data from passports or ID cards)

Sources: From the customer, the acquired credit, the borrower, the borrower’s device, Norrvidd’s services, sanctions lists or credit reference agencies.

Legal basis

Compliance with law (Article 6(1)(c) GDPR). (Swedish Act (2017:630) on Measures against Money Laundering and Terrorist Financing) For sensitive personal data, the basis is that the processing is necessary for reasons of public interest (Article 9(2)(g) GDPR)

When the purpose ends

Up to five years from the termination of the contract or the end of the credit relationship (where law enforcement authorities request it, up to ten years).

4.

Purpose of the processing

Ensure IT security in networks and in the services.

Types of personal data

• Identification and contact details

• Usage information

• Technical information

• Customer service information

• Device information

Sources: From the customer, the acquired credit, the borrower, the borrower’s device or Norrvidd’s services.

Legal basis

Balancing of interests (Article 6(1)(f) GDPR).

When the purpose ends

For as long as a service or feature is used.

5.

Purpose of the processing

Handle the matters received by Norrvidd’s customer service.

Types of personal data

• Identification and contact details

• Usage information

• Customer service information

Sources: From the customer, the acquired credit, the borrower, the borrower’s device or Norrvidd’s services.

Legal basis

The processing is necessary for us to be able to perform the contract (Article 6(1)(b) GDPR).

When the purpose ends

When the contractual relationship ends.

6.

Purpose of the processing

Anonymise your data in order to improve our services and analyse the use of the services.

Types of personal data

• Identification and contact details

• Usage information

• Technical information

• Customer service information

• Device information

• Financial information

Sources: From the customer, the acquired credit, the borrower, the borrower’s device, Norrvidd’s services or credit reference agencies.

Legal basis

Balancing of interests (Article 6(1)(f) GDPR).

When the purpose ends

For as long as we have the data stored. You can read more about how long we retain your data in section 5.

7.

Purpose of the processing

Carry out data analyses for product development, marketing and testing. This is to improve our services and our risk, fraud and credit models (where possible, we first anonymise the data, which means that no processing of personal data takes place thereafter).

Types of personal data

• Identification and contact details

• Usage information

• Technical information

• Customer service information

• Device information

• Financial information

Sources: From the customer, the acquired credit, the borrower, the borrower’s device, Norrvidd’s services or credit reference agencies.

Legal basis

Balancing of interests (Article 6(1)(f) GDPR).

When the purpose ends

For as long as we have the data stored. You can read more about how long we retain your data in section 5.

8.

Purpose of the processing

Analyse which marketing is suitable for you, or effective for us (where possible, we first anonymise the data, which means that no processing of personal data takes place thereafter). This involves profiling, which you can read more about in section 7.

Types of personal data

• Identification and contact details

• Usage information

• Technical information

• Customer service information

• Device information

• Financial information

Sources: From the customer, the acquired credit, the borrower, the borrower’s device, Norrvidd’s services or credit reference agencies.

Legal basis

Balancing of interests (Article 6(1)(f) GDPR). If you do not want us to carry out this processing of your data, you can let us know by contacting us. We will then stop using your data for marketing.

When the purpose ends

When the contractual relationship ends, or if you notify us that you are not interested in this processing.

9.

Purpose of the processing

Carry out marketing through various channels (such as email, social media, etc.).

Types of personal data

• Identification and contact details

• Usage information

• Device information

• Photos from events

Sources: From the customer, the acquired credit, the borrower, the borrower’s device, Norrvidd’s services or credit reference agencies.

Legal basis

Balancing of interests (Article 6(1)(f) GDPR). Consent (Article 6(1)(a) GDPR) insofar as it concerns marketing on social media or if you have signed up for marketing from us. If you do not want us to carry out this processing of your data, you can let us know by contacting us. We will then stop using your data for marketing.

When the purpose ends

When the contractual relationship ends, or if you notify us that you are not interested in this processing.

10.

Purpose of the processing

Check and verify that you are who you claim to be.

Types of personal data

• Identification and contact details

• Usage information

• Device information

Sources: From the customer, the acquired credit, the borrower, the borrower’s device, Norrvidd’s services or credit reference agencies.

Legal basis

The processing is necessary for us to be able to perform the contract (Article 6(1)(b) GDPR).

When the purpose ends

When the contractual relationship ends.

11.

Purpose of the processing

Share your data with the suppliers and partners mentioned in section 6.

Types of personal data

All types of data mentioned in section 3.

Sources: From the customer, the acquired credit, the borrower, the borrower’s device, Norrvidd’s services or credit reference agencies.

Legal basis

See section 6.

When the purpose ends

For as long as we have the data stored. You can read more about how long we retain your data in section 5.

12.

Purpose of the processing

Protect Norrvidd against legal claims and safeguard Norrvidd’s legal rights.

Types of personal data

All types of data mentioned in section 3. In connection with a dispute, Norrvidd may also collect other types of personal data relating to you if we need it to safeguard our rights.

Legal basis

Balancing of interests (Article 6(1)(f) GDPR).

When the purpose ends

For as long as the contractual relationship continues, and for up to 10 years thereafter.

13.

Purpose of the processing

Compile bookkeeping and other accounts or calculations in accordance with accounting laws, capital adequacy rules and reporting obligations to the Swedish Financial Supervisory Authority (Finansinspektionen) and other authorities such as the Swedish Tax Agency (Skatteverket), including retention of the material in accordance with applicable law.

Types of personal data

All types of data mentioned in section 3.

Sources: From the customer, the acquired credit, the borrower, the borrower’s device, Norrvidd’s services or credit reference agencies.

Legal basis

Compliance with law (Article 6(1)(c) GDPR). (Swedish Accounting Act (1999:1078), the Capital Requirements Regulation 575/2013, the Capital Requirements Directive 2013/36, and the regulations of the Swedish Financial Supervisory Authority). Balancing of interests (Article 6(1)(f) GDPR).

When the purpose ends

For as long as the contractual relationship continues, and for up to 10 years thereafter.

14.

Purpose of the processing

Carry out debt collection services – i.e. collecting or selling outstanding debts. This may take place either when the debt has fallen due for payment, or to secure financing.

Types of personal data

• Identification and contact details

• Usage information

• Customer service information

• Financial information

Sources: From the customer, the acquired credit, the borrower, the borrower’s device, Norrvidd’s services or credit reference agencies.

Legal basis

Balancing of interests (Article 6(1)(f) GDPR).

When the purpose ends

Until the credit has been repaid.

6.1 Suppliers and subcontractors

Suppliers and subcontractors are companies that are only entitled to process the personal data they receive from Norrvidd for Norrvidd’s purposes, i.e. processors. Examples of such suppliers and subcontractors are software and data storage providers, payment service providers, providers of machine learning and artificial intelligence functionality, and identity verification providers.

Legal basis: Norrvidd needs access to services and functionality from other companies that Norrvidd cannot provide itself. Norrvidd has a legitimate interest in being able to access these services and functionality (Article 6(1)(f) GDPR).

6.2 Credit reference agencies and company registers

Credit reference agencies and company registers are companies that provide us with credit reports and other information about corporate engagements and financial information, such as UC.

Legal basis: This is required to administer the credit agreement (Article 6(1)(b) GDPR).

6.3 A person holding a power of attorney from you

Norrvidd may share your personal data with a person who is entitled to access it under a power of attorney.

Legal basis: This is done to simplify customer contact, either because it is necessary to manage the contract, or on the basis of a legitimate interest (Article 6(1)(f) GDPR).

6.4 Authorities

Norrvidd may provide information to authorities such as the Swedish Financial Supervisory Authority (Finansinspektionen), the Swedish Tax Agency (Skatteverket) or other authorities and courts.

Legal basis: Personal data is shared with authorities when we are legally obliged to do so, or in certain cases where it is required to administer tax deductions or to prevent crime. One example of a legal obligation to provide information concerns measures against money laundering and terrorist financing. Depending on the authority and the purpose, the legal bases are compliance with a legal obligation (Article 6(1)(c) GDPR), performance of the contract (Article 6(1)(b) GDPR), or Norrvidd’s interest in being able to protect itself against crime (Article 6(1)(f) GDPR).

6.5 Divestment of business or assets

In the event that Norrvidd sells business operations or credits, Norrvidd may disclose your personal data to a potential buyer of such operations or assets. This includes sales both for financing Norrvidd’s business and for debt collection.

Legal basis: Norrvidd has a legitimate interest in being able to carry out these transactions (Article 6(1)(f) GDPR). You have the right to object to this processing on grounds relating to your particular situation. More information about your rights can be found in section 2.

In order to provide our services and run our business, we sometimes need to transfer your personal data outside the EU/EEA. This happens when we share your information with a supplier or subcontractor. We always ensure that the same high level of protection under the GDPR applies to your personal data, even when the data is transferred outside the EU/EEA.

If you would like more information about our safeguards, you can always contact us. You can find more information about which countries are considered to have an "adequate level of protection" on the European Commission’s website, and you can read more about standard contractual clauses on the Swedish Authority for Privacy Protection’s website here, and about binding corporate rules ("BCR") here.

Countries outside the EU/EEA may have laws under which public authorities may be entitled to request personal data stored in that country for the purpose of combating crime or safeguarding national security. Regardless of whether it is us or one of our suppliers processing your personal data, we will ensure a high level of protection when transferring it and that appropriate safeguards have been put in place in accordance with applicable data protection requirements (such as the GDPR). Such appropriate safeguards include, among other things, ensuring:

· that the European Commission has decided that the country outside the EU/EEA to which your personal data is transferred ensures an "adequate" level of protection equivalent to the level of protection provided by the GDPR. This means, for example, that the data continues to be protected against unauthorised access and that you can exercise your rights in relation to the data, or

· that the European Commission’s standard contractual clauses have been entered into between Norrvidd and the recipient of the personal data outside the EU/EEA. This means that the recipient guarantees that the protection of your personal data provided by the GDPR still applies. In these cases, we also assess whether there is legislation in the recipient country that affects the protection of your personal data. If required, we take special technical and organisational measures so that the protection of your data is maintained when it is transferred to the country in question outside the EU/EEA.

· that the transfer is covered by the EU-U.S. Data Privacy Framework. This is an opt-in certification scheme for U.S. companies, administered by the U.S. Department of Commerce. This privacy framework comprises a number of enforceable principles and requirements that must be certified by the U.S. company and are intended to ensure that your data continues to be adequately protected.

Our services are constantly being improved, which affects our use of your personal data. Where a change affects our obligations or your rights, we will inform you of the changes in advance so that you have the opportunity to consider the updated information.