Anessa Privacy Notice – Website and Tester Sign-up

1. General

Insurely AB, org. no. 559103-5646, a company registered in Sweden with its registered address at Kungsgatan 9, 111 43 Stockholm, Sweden ("Insurely", "we", or "us"), cares about your privacy and wants you to understand how we collect and use your personal data. This privacy notice ("Notice") explains how we process your personal data when you visit the Anessa tester website and when you express interest in becoming a tester of our open finance products and services, offered under the name Anessa ("Services"), and how you can exercise your data protection rights.

Insurely AB is the controller of your personal data, even though our Services are offered under the name Anessa. We are responsible for and committed to processing your personal data in accordance with applicable data protection laws. You can contact us using the contact details set out in section 7 below.

If you become a tester by signing the tester agreement, we will provide you with a separate privacy notice for testers that explains how we process your personal data during testing.

• What personal data we process, why and on what legal basis
• How long we store your personal data
• Recipients of personal data and transfers of personal data
• Your rights
• Informing you of changes to this Notice
• Contact information and complaints

2. What personal data we process, why and on what legal basis

2.1 Personal data we process

Personal data is any information that identifies you or can reasonably lead to your identification. When you visit our tester website or express interest in becoming a tester, we process the following categories of personal data:

• Contact data, which includes your first and last name and your email address.
• Wealth data (limited), which is limited to the name of your pension provider (for example, your Riester provider).
• Technical and usage data, which includes information about your device, your (pseudonymised) IP address and how you interact with our tester website, collected through cookies and similar technologies if you have given your consent (see section 2.3).

We collect this personal data directly from you, except for Technical and usage data, which is collected automatically from your device when you use our tester website, as described in section 2.3.

2.2 Why we process your data, on what legal basis and for how long

The GDPR requires a legal basis for each purpose for which we process your personal data.

Handling your interest in becoming a tester

• Personal data: Contact data; limited Wealth data
• Legal basis: Steps at your request prior to entering into an agreement (Art. 6(1)(b) GDPR)
• Storage: Deleted 2 months after your application if it does not proceed or does not match the scope of the testing

Analytics and advertising on our tester website

• Personal data: Technical and usage data
• Legal basis: Your consent (Art. 6(1)(a) GDPR; § 25(1) TDDDG)
• Storage: See section 2.3

Establishing, exercising or defending legal claims

• Personal data: Contact data; limited Wealth data
• Legal basis: Our legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f))
• Storage: As long as needed in the specific case; contact privacy@anessa.co for details

If your application is successful, we will email you with further information.

2.3 Cookies and similar technologies

Our tester website uses cookies and similar technologies, including analytics tools and advertising and measurement tools, to understand how the website is used, to improve it, and to measure and personalise our advertising. We use these technologies only if you consent via the consent banner on the website. You can change or withdraw your consent at any time via the cookie banner available in the website footer, without affecting the lawfulness of processing carried out before withdrawal.

We use Cookiebot, a consent management tool, to ask for and record your consent choices on our tester website.

Meta Pixel. If you consent to marketing cookies, we use the Meta Pixel, a tool provided by Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland ("Meta"). Tools such as the Meta Pixel collect or receive information from our tester website, and Meta uses this information to provide measurement services and to target and deliver ads. The Meta Pixel collects information about your visit and the actions you take on our website (for example, submitting the sign-up form), together with technical information such as your IP address, browser and device information and online identifiers (such as cookie IDs), and transmits it to Meta. We have not activated Meta's Automatic Advanced Matching, so the information you enter in the sign-up form is not sent to Meta.

Purposes. We use the Meta Pixel (a) to measure the effectiveness of our advertising, receive reports from Meta and exclude certain people from our ads; and (b) to show our advertisements to people who have visited our website. In addition, Meta uses the data for its own purposes, such as improving ad delivery, personalising features and content (including ads) on and off Meta's products, and safety, security, and research and development.

Our roles. For (a), Meta acts as our processor under its Data Processing Terms. For the collection of the data through the Meta Pixel and its transmission to Meta, and for (b) and Meta's own purposes, we and Meta are joint controllers under Art. 26 GDPR. We have entered into a Controller Addendum with Meta, under which we are responsible for informing you about the joint processing (through this Notice) and for the legal basis of our own processing (your consent). Meta is responsible for the legal basis of its own processing and for enabling your rights under Art. 15–20 GDPR regarding the data Meta stores after the transmission. Once the data has been transmitted to Meta, Meta is an independent controller.

Your rights against Meta. Information about Meta's processing, including its legal basis, Meta's contact details and how to exercise your rights against Meta, is available in Meta's Privacy Policy.

Our legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). The personal data processed for this purpose is Technical and usage data.

Personal data processed through these tools may be transferred to countries outside the EU/EEA. We ensure that such transfers are protected by an appropriate transfer mechanism, as described in section 4.

3. How long we store your personal data

We retain the personal data we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with information you have requested, or to establish, exercise or defend legal claims). See section 2.2 for the retention periods that apply to each purpose. Retention periods for cookies and similar technologies are set out in section 2.3. If you become a tester, the personal data you provided when expressing interest is subsequently processed in accordance with the privacy notice for testers.

When we have no ongoing legitimate business need or legal reason to process your personal data, we will either delete or anonymise it or, if this is not possible (for example, because your personal data has been stored in backup archives), we will securely store your personal data and isolate it from any further processing until deletion is possible.

4. Recipients of personal data and transfers of personal data

We will disclose the personal data described above to the following categories of recipients:

• Courts and similar judicial entities and/or authorities, if required to do so by law.
• Service providers on which we rely for our core operational activities.
• Providers of analytics and advertising and measurement tools (PostHog and Meta), as described in section 2.3.
• An actual or potential buyer (and its agents and advisers) in connection with any actual or proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer that it must use your personal data only for the purposes disclosed in this Notice.

We primarily store and process your personal data within the EU/EEA. However, some of our service providers, including the providers mentioned in section 2.3, may transfer or process personal data in countries outside the EU/EEA, such as the United States. In such cases, we ensure that the transfer is protected by an appropriate transfer mechanism, namely:

• where the recipient country, or the recipient, is covered by an adequacy decision of the European Commission (including, for the United States, the EU-U.S. Data Privacy Framework for certified recipients), by relying on that decision; or
• by implementing standard contractual clauses approved by the European Commission for the transfer of personal data to third countries.

If a transfer mechanism is deemed insufficient due to the national law of the recipient country, Insurely will take additional measures to ensure an adequate level of protection.

You can find out more about the transfers of your personal data and the safeguards we implement to protect your data by contacting us at privacy@anessa.co.

5. Your rights

You have certain data protection rights in relation to how we process your personal data. You can contact us at privacy@anessa.co at any time to exercise your rights as set out below. We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

5.1 Right to access

You have the right to access and receive a copy of your personal data that we process, as well as other supplementary information.

5.2 Right to rectification

You have the right to have inaccurate personal data rectified and, depending on the purpose of the processing, to have incomplete personal data completed.

5.3 Right to erasure

In certain cases, you have the right to request the erasure of your personal data, such as where the personal data is no longer needed for the purpose for which it was collected, or if we no longer have a legal basis to continue processing it.

5.4 Right to restriction of processing

In certain cases, such as when you have contested the accuracy of your personal data, you have the right to request that we restrict the processing of your personal data. In such a case, we will only store your personal data or further process it if permitted to do so by law.

5.5 Right to data portability

You have the right to data portability, which means that in certain cases you can receive the personal data you have shared with us in a structured, commonly used and machine-readable format, and that you have the right to request that we transfer this data to other data controllers where technically possible.

5.6 Right to object

You have the right to object to the processing of personal data based on our legitimate interest. You also have the right to opt out at any time from receiving any marketing communications we send you. Despite that, we will not send you any direct marketing communications (such as emails or messages) while you are a prospective tester. Please note that the use of cookies and similar technologies for analytics and advertising is governed by your consent choices as described in section 2.3.

5.7 Right to withdraw consent

If we process your personal data based on your consent, you have the right to withdraw such consent at any time. Note that withdrawal of your consent will not affect the lawfulness of the processing we carried out prior to such withdrawal, nor will it affect processing of your personal data conducted in reliance on lawful processing grounds other than consent.

6. Informing you of changes to this Notice

If we make changes to this Notice, we will take appropriate measures to inform you. For significant changes in how we collect or process your personal data, we will ask for your consent, if this is required by applicable law.

You can see when this Notice was last updated by checking the "last updated" date displayed at the top of this Notice.

7. Contact information and complaints

If you have any questions, comments or complaints about how we process your personal data, we encourage you to contact us first at privacy@anessa.co, so that we can try to resolve the matter quickly. This does not limit your right to lodge a complaint with a supervisory authority at any time.

You have the right to lodge a complaint with the data protection authority in the EU/EEA country where you live, where you work, or where the alleged infringement took place. If you live in Germany, this is generally the data protection authority of your federal state (Bundesland). A list of the German data protection authorities is available here. You can find the contact details of other EU/EEA supervisory authorities here.

You can also contact the Swedish Authority for Privacy Protection (IMY), which is the lead supervisory authority for the processing of personal data since Insurely has its main establishment in Sweden. IMY can be reached at:

Integritetsskyddsmyndigheten
Box 8114, 104 20 Stockholm, Sweden

Email: imy@imy.se
Phone: +46 (0)8 657 61 00
Website: www.imy.se