Privacy notice – GDPR.

At Vivster Financial Solutions AB (below ”Vivster Financial Solutions AB”, ”us”, ”we”) we care about your personal privacy and are committed to complying with the General Data Protection Regulation (EU 2016/679), (below the ”GDPR”) and other applicable data protection legislation. In this privacy notice, Vivster Financial Solutions AB explains how we collect and process your personal data. The notice also explains what rights you have under the GDPR.

The data controller is:

Vivster Financial Solutions AB, reg. no. 556766-0518

Address: Johanneslundsvägen 12, SE-194 61 Upplands Väsby, Sweden

Phone: +46 8 41 00 72 22

Email: info@vivster.ai

We have appointed a data protection officer whom you can contact in all matters concerning our processing of your personal data and your rights.

Email: dataskyddsombud@vivster.ai

Vivster Financial Solutions AB may process the following personal data about you in your capacity as:

1. Debtor (person subject to debt collection/credit management)

• Name
• Personal identity number or coordination number
• Contact details (address, email, phone number)
• Claim details (amount of the debt, origin, payment history, agreements)
• Payment details (bank details, payment plans, transaction history)
• Communication (letters, email, call logs, digital self-service services)
• Legal documents (summons applications, judgments, decisions from the Swedish Enforcement Authority)
• Information about financial circumstances (income, employer, assets)
• Information about any powers of attorney or representatives

2. Customer/client (business contact at a bank, credit institution, fintech company, investor)

• Name
• Position/role
• Contact details (email, phone number, address)
• Correspondence and agreement history

3. Supplier/business partner (contact person at a supplier or partner)

• Name
• Position/role
• Contact details (email, phone number, address)
• Correspondence and agreement history

4. Visitor to the website/digital services

• IP address
• Device information and technical logs
• Cookies and usage behaviour (where consent is given)

5. Job applicant

• Name
• Contact details (address, email, phone number)
• Personal identity number
• CV, cover letter and references
• Information from interviews and the selection process

Below we describe the various purposes for which Vivster Financial Solutions AB may process your personal data, the types of personal data that may be processed and the legal bases on which we rely. Where the legal basis is a balancing of interests, our legitimate interest is also stated.

1. Handling of debt collection and credit management cases (debtors)

Purpose: To administer and collect claims, set up and follow up payment plans, handle legal measures, and communicate with you as a debtor.

Personal data: Identity and contact details, claim details, payment details, communication, legal documents, financial information.

Legal basis:

• Primarily public interest (GDPR Article 6.1 e). Under Swedish law, debt collection is a task in the public interest. The processing is necessary for the flow of payments in society and for the efficient collection of claims.
• Legal obligation (GDPR Article 6.1 c) under the Swedish Debt Collection Act, the Swedish Data Protection Act (2018:218), the Swedish Bookkeeping Act (1999:1078) and other applicable legislation.
• Legitimate interest (GDPR Article 6.1 f): Our legitimate interest consists in safeguarding our own or our clients' financial interests by collecting claims, which is considered to outweigh your interest in keeping your personal data protected.
• Contract (GDPR Article 6.1 b) if you are a party to the contract yourself.

2. Customer and supplier administration

Purpose: To handle agreements, invoicing, contact and follow-up with customers and suppliers.

Personal data: Name, contact details, position, correspondence, agreement history.

Legal basis:

• Contract (GDPR Article 6.1 b) when you are a party to the contract.
• Legitimate interest (GDPR Article 6.1 f): Our legitimate interest consists in maintaining business relationships and fulfilling our commitments to customers and suppliers, which is considered to outweigh your interest in keeping your personal data protected.
• Legal obligation (GDPR Article 6.1 c) for bookkeeping purposes.

3. Fulfilment of legal obligations (e.g. KYC/AML, sanctions and PEP screening)

Purpose: To comply with legal requirements on customer due diligence, money laundering, sanctions controls and reporting to authorities.

Personal data: Identity details, contact details, financial information, any PEP or sanctions lists.

Legal basis:

• Legal obligation (GDPR Article 6.1 c) under the Swedish Money Laundering Act, sanctions legislation and the Swedish Data Protection Act (2018:218).

4. Communication and support

Purpose: To answer questions, handle complaints and provide support via phone, email or digital channels.

Personal data: Name, contact details, case history, communication.

Legal basis:

• Legitimate interest (GDPR Article 6.1 f): Our legitimate interest consists in being able to provide good service and handle incoming matters, which is considered to outweigh your interest in keeping your personal data protected.

5. Recruitment

Purpose: To administer applications, carry out selection and interviews and communicate with applicants.

Personal data: Name, contact details, personal identity number, CV, cover letter, references, interview data.

Legal basis:

• Legitimate interest (GDPR Article 6.1 f): Our legitimate interest consists in being able to recruit and employ the right competence, which is considered to outweigh your interest in keeping your personal data protected.

6. IT operations, security and development

Purpose: To ensure the operation, security and development of our systems and digital services.

Personal data: Technical logs, IP address, usage behaviour.

Legal basis:

• Legitimate interest (GDPR Article 6.1 f): Our legitimate interest consists in maintaining the security and functionality of our services, which is considered to outweigh your interest in keeping your personal data protected.

7. Marketing (to business customers)

Purpose: To inform existing and potential business customers about our services and news.

Personal data: Name, contact details, company information.

Legal basis:

• Legitimate interest (GDPR Article 6.1 f): Our legitimate interest consists in marketing our services to relevant business contacts, which is considered to outweigh your interest in keeping your personal data protected.

We may share your personal data with the following categories of recipients:

• IT and system suppliers: For the operation, development and support of our technology platform, digital self-service services, communication systems and security solutions. Data processing agreements are entered into where required under the GDPR.
• Legal advisers and auditors: To safeguard legal interests, handle disputes, audits and compliance with legal requirements.
• Authorities (e.g. the Swedish Financial Supervisory Authority, the Swedish Authority for Privacy Protection (IMY), the Swedish Enforcement Authority, the Swedish Tax Agency): When we are required by law to disclose information, for example in connection with supervision, reporting or legal measures.
• Customers/clients: Where we act as a service provider to lenders or investors, personal data may be shared in accordance with agreements and legal requirements.
• Payment intermediaries and banks: To handle incoming and outgoing payments related to debt collection cases.
• Providers of KYC/AML and sanctions screening: To meet customer due diligence requirements and counter money laundering.

The GDPR does not apply in countries outside the EU/EEA, which may entail an increased privacy risk, including the possibility for authorities in third countries to gain access to your personal data and the possibilities to exercise control over the data.

As a general rule, your personal data is processed within the EU/EEA. However, as some of Vivster Financial Solutions AB's suppliers operate internationally, your personal data may be transferred to countries outside the EU/EEA. In such cases, Vivster Financial Solutions AB is obliged to ensure that the transfer takes place in accordance with applicable legislation, for example by ensuring that the country to which the personal data is transferred meets the requirements for an adequate level of protection according to a European Commission decision, or by ensuring that the transfer is covered by appropriate safeguards in the form of, for example, standard contractual clauses decided by the European Commission, under which it is ensured that appropriate measures are taken to safeguard your rights and freedoms.

For more information about the safeguards implemented, please contact us using the contact details at the bottom of this privacy notice. You can find more information about which countries are considered to have an ”adequate level of protection” on the European Commission's website, and you can read more about standard clauses on the Swedish Authority for Privacy Protection's website.

On 10 July 2023, the European Commission adopted a so-called adequacy decision for transfers of personal data to the USA, the EU-US Data Privacy Framework. When transferring personal data to the USA, we ensure that all recipients are certified under this framework.

• European Commission: adequacy decisions
• Swedish Authority for Privacy Protection (IMY): standard contractual clauses

Vivster Financial Solutions AB takes technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration and destruction.

Vivster Financial Solutions AB will only retain your personal data for as long as necessary for the purposes for which it was collected.

• Debtors: Personal data is retained while the case is active and thereafter for up to 3 years after the case is closed, in order to handle any legal claims, complaints or authority requirements. To the extent the personal data constitutes bookkeeping material, it is retained for 7 years after the calendar year in which the financial year ended, in accordance with the Swedish Bookkeeping Act (1999:1078).
• Customer and supplier contacts: Personal data is retained during the contract period and for up to 5 years after the end of the contract, in order to handle any legal claims and bookkeeping requirements. To the extent the personal data constitutes bookkeeping material, it is retained for 7 years after the calendar year in which the financial year ended, in accordance with the Swedish Bookkeeping Act (1999:1078).
• Job applicants: Personal data is retained during the recruitment process and thereafter for up to 2 years after the process has ended, in order to handle any discrimination matters.
• Website visitors and users of digital services: Technical logs and cookies are normally retained for up to 12 months, unless longer retention is required for security purposes or legal obligations.
• Customer due diligence/KYC/AML: Data processed to comply with anti-money laundering legislation is retained for 5 years after the customer relationship has ended, in accordance with the Swedish Money Laundering Act.

Personal data may be retained longer if required to establish, exercise or defend legal claims, or if legislation requires longer retention.

As a data subject you have several rights, listed below. If you wish to exercise any of your rights, you can contact us using the contact details in the final section of this privacy notice. You can read more about your rights on the website of the Swedish Authority for Privacy Protection (IMY), www.imy.se.

Right to information and access: You have the right to obtain information about whether we process personal data about you. You have the right to receive a copy of your personal data free of charge, a so-called register extract.

Right to erasure: Under certain conditions you have the right to have your personal data erased. This applies, for example, if the personal data is no longer necessary for us to process for the purpose for which it was collected. It also applies if you have objected to the data being processed based on our legitimate interest and it turns out that there are no legitimate grounds that outweigh your interest in keeping your personal data protected. You also have the right to have the data erased if it has been processed unlawfully. If we have a legal obligation to process the data, it will not be erased even if any of the above situations apply. Nor will the data be erased if we need it to establish, exercise or defend legal claims.

Right to rectification: The personal data we process about you must be accurate and complete. You therefore have the right to request that we correct or supplement data about you that you consider to be inaccurate, incomplete or misleading.

Right to restriction: In certain cases you have the right to request that the processing of your personal data be restricted, for example if you believe that data about you is inaccurate and you have requested rectification. While the matter is being investigated, you can also request that the processing of the data be restricted. You can also request restriction where the processing of the data is unlawful but you oppose the data being erased. The processing of the data can also be restricted where we no longer need the data but you need it to establish, exercise or defend legal claims. Finally, you can request restriction of our processing where you have objected to processing based on the legal basis of legitimate interest, while we work to verify whether our interest outweighs your interest in keeping your personal data protected. Where processing has been restricted according to any of the situations above, we may only, in addition to storage itself, process the data to establish, exercise or defend legal claims, to protect someone else's rights or because you have given your consent without withdrawing it.

Right to data portability: Under certain circumstances you have the right to have your personal data transferred to another data controller (so-called data portability). Data portability applies if you have consented to providing your personal data or if we process your personal data based on the legal basis of contract. Data is only transferred where technically feasible.

Right to object: You have the right to object to our processing of personal data about you where we do so based on the legal basis of legitimate interest. If we cannot demonstrate compelling legitimate grounds to continue processing the data, we will cease the processing. However, we may always continue to process the data to establish, exercise or defend legal claims.

We only obtain consent for the processing of personal data in exceptional cases. Where you have given consent, you have the right to withdraw it at any time. You can withdraw your consent by contacting dataskyddsombud@vivster.ai. Once you have withdrawn your consent, we will not continue to process your personal data for the purpose in question.

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) if you believe that we process your personal data in breach of applicable data protection legislation. You can also read more about your rights on the Authority's website: www.imy.se.

In the event of updates that are of significant importance to our processing of personal data (for example changes to the stated purposes or categories of personal data), or that can be expected to be of great importance to you, you will be informed of this before the updates take effect. Such information will also explain the meaning of the updates and how they may affect you.

If you have any questions about this privacy notice or our processing of personal data, please contact us at:

Vivster Financial Solutions AB

Phone: +46 8 41 00 72 22

Email: info@vivster.ai

Data protection officer: dataskyddsombud@vivster.ai