Integrity

Qred understands the importance of your personal integrity and we want you to feel safe in our processing of your personal data. In order to provide our services, we need to process and use personal data as described in this privacy notice (hereinafter “Privacy Notice”). The purpose of the Privacy Notice is to describe how and why Qred collects and stores your personal data. Additionally, this Privacy Notice describes your rights in relation to our processing of your personal data, and how you can exercise them. We are responsible for ensuring that the processing of your personal data is in compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable legislation.

Qred Bank AB (“Qred”), is a Swedish limited liability company based in Stockholm. Qred is a banking corporation (Sw. bankaktiebolag) with authorization to conduct banking operations pursuant to the Swedish Banking and Financing Act (Sw. lag (2004:297) om bank- och finansieringsrörelse). Qred’s main office is located at Drottninggatan 98, 111 60 Stockholm. Qred is the data controller in relation to the personal data we process to carry out our business activities, which includes your use of our services.

1. Definitions

Customer means a company or natural person who has entered into, or is about to enter into,a contractual relationship with Qred regarding Qred’s Services.

Customer Representative means a natural person who is representing a Customer orotherwise is engaged in the Customer’s contractual relationship with Qred.

Data Controller means an entity that determines the purposes and means of its Processingof Personal Data.

Data Subject means any identifiable individual whose Personal Data is collected, held orProcessed by Qred.

EU/EEA means the European Union/European Economic Area. Guarantor means a natural person who provides or intends to provide a personal guarantee in relation to a Customer’s engagement with Qred.

PEP means “politically exposed person”, as defined in the Swedish Act on Measures against Money Laundering and Terrorist Financing.

Personal Data means any information that, directly or indirectly, can be used to identify anatural person.

Profiling means the automated Processing of Personal Data to assess certain of yourpersonal characteristics.

Process and Processing means any operation or set of operations performed with regard to Personal Data, whether or not performed by automated means, such as collection, recording,organisation, storage, adaptation, alteration, retrieval, gathering, use, combination, blocking,erasure or destruction.

Qred, Group, we, our and us means Qred Bank AB (org.nr. 559008-9800) and its holding company Qred Holding AB (publ) (org.nr. 559031-0685).

Services means any of Qred’s services such as Qred Business Loan, Qred VISA and QredSavings Account.

Webpage Visitor means any individual who visits Qred’s webpage or contacts our customersupport or sales team.

2. What personal data do we process?

Information you provide to us

This includes Personal Data you provide us with as part of our application process, such as name, address, email, phone numbers and national ID numbers. Further, information about your business, such as business plans, bank account information and payment history, might be asked of you.

Information we collect about you

As part of our assessment of your application to use our Services we need to collect certain information about you and your business in order to comply with our legal obligations. Additionally, we collect information from

third parties, such as credit rating agencies and other publicly available information sources.

Information we may collect about you include:

A. Identification and contact information
‍Name, date of birth, ID number, address, phone number, etc.

B. Financial information
‍Information collected from third parties, such as income, payment and other credit information.

C. Credit history
‍Information collected from third parties, such as financial history, negative payment remarks and previous payment and credit acceptances.

D. Information and communication
‍Information on how you use the Services, including information on outstanding and historical debts, your repayment history with Qred, technical data such as page response times, download errors and personal preferences, as well as your interactions with the Qred customer team, etc.

E. Device information
‍Information such as IP address, language settings, browser settings, operating system, platform and screen resolution.

F. Geographic information
‍Information regarding your and your business' geographical establishment.

G. Information from external sanction lists and PEP lists
‍We may screen you and your business against lists of persons subject to sanctions and against lists of persons who are PEP.

H. Special categories of Personal Data

• You can, completely voluntarily, choose to give us information that is classified as "
• special categories" of information under the GDPR. Such information includes information that reveals your
• religion, political or philosophical convictions, union membership, or information regarding health, sex life or sexual orientation. We will never ask you for such information in order to provide our Services. If you choose to provide us with such information, it shall be provided completely voluntarily and based on your
• explicit consent. If you wish to know more about consent and how to revoke it, please see Section 9 (Consent) below.
• I. Service-specific information
  • In order to provide you with some of our Services we may collect and Process additional Personal Data that is not covered by the above categories.

‍

3. What do we use the personal data for?

Qred Processes Personal Data to provide and improve our Services. Below is an overview of how we Process Personal Data and our purpose of doing so.

‍

4. Who can we share your personal data with?

Qred does not share your Personal Data with just anyone. However, in some cases we need to share your Personal Data with trusted third parties to perform our business. In such cases, we take all necessary precautions to ensure the secure transfer of your Personal Data, prioritising the protection of your privacy.

A. Suppliers and subcontractors
We may share Personal Data with the suppliers and subcontractors we use to provide our Services to you. Examples include software providers and business consultants. They only have the right to Process Personal Data on our behalf. We may also share Personal Data with other financial providers. We take all reasonable, legal, technical and organisational measures to ensure that Personal Data is Processed and shared securely.

B. Credit reference agencies
In order to provide our Services, we may perform a credit assessment. Your Personal Data may be shared with credit reference agencies and other similar service providers for the purpose of making a proper credit assessment when you apply for any of our Services.

C. Authorities
We have a legal obligation to prevent money laundering and terrorist financing and otherwise to comply with applicable legislation. Qred may share your Personal Data with authorities (such as the police or the Swedish Tax Agency (Sw. Skatteverket)) when deemed necessary to fulfil a legal obligation.

D. Debt collection agencies
Qred may also share your information when we sell, or instruct to recover, unpaid debts to a third party. We share this information based on our legitimate interest in recovering debts and selling receivables. Debt collection agencies may Process your data in accordance with their own data protection routine, or solely on behalf of Qred. Debt collection companies may also report your unpaid debts to credit reference agencies or the local Enforcement Authority, which may affect your creditworthiness and your ability to be granted future credits.

E. Divestment
In the event that Qred wishes to sell or purchase any businesses or assets, we may provide Personal Data to such potential buyer or seller.

F. Due diligence purposes
If Qred or a substantial part of Qred's assets is in the process of being acquired by a third party, your Personal Data may be shared with such third party.

G. Social medias
If you contact us via social media in any way, such as on Facebook or Instagram, your Personal Data will be subject to Processing on their platform in accordance with their respective data protection policy.

5. Where do we process personal data?

We strive to Process all Personal Data within the EU/EEA. However, in some cases, the information may be transferred to, and processed in, countries outside the EU/EEA by third parties. Qred takes all reasonable legal, technical and organisational measures to ensure that your Personal Data is handled securely and transferred with an adequate level of protection comparable to the protection offered within the EU/EEA.

6. For how long do we save your personal data?

We save your Personal Data for as long as it is necessary to fulfil our contractual obligation with you, and as long as we are required to keep the Personal Data by law. We retain the Personal Data only for as long as it is necessary for the stated purpose of the Processing.

7. Profilering och automatiserat beslutsfattande

Profiling is used to analyse or predict your financial situation or personal preferences, e.g. which Services you choose and how you interact with Qred. We use Profiling based on your Personal Data to make individual or automated decisions regarding you for the following purposes:

- predict which marketing might be of interest to you. You can always object to this and unsubscribe from the marketing and this Profiling by contacting us;
- decide which of Qred's offers might suit you; and
- decide which is the most appropriate way to contact you regarding outstanding debt.

In addition, some of our Services include Profiling in order to provide the Service in question, for example to choose which offers we will give you, in accordance with the terms of the Service.

Certain decisions in our Services are made using automation, without the involvement of our employees, and may have a significant effect on you as a Customer or Customer Representative, comparable to legal consequences. By making such decisions automatically, objectivity and transparency in decisions increase when we offer our Services. We use this type of automated decision when we: assess your application for a Service that includes the granting of a credit; decide not to approve your application for a Service that includes the granting of a credit; determine whether you pose a risk for fraud, money laundering or terrorist financing; and investigate whether specific customers are listed on sanctions or PEP lists (where relevant). You always have the right to object to an automated decision with legal consequences or a decision that similarly significantly affects you (together with the related Profiling) by contacting us at privacy@qred.com.

8. Marketing and communication

We may use your contact information to engage in communication with you. This could, for example, include conducting customer surveys or preparing offers related to our Services. If you do not wish to receive such communication, you can contact us at any time at privacy@qred.com.

In order to provide you with offers and benefits such as discounts, etc., we assess information about how you interact with Qred, your contact and identification information, and your use of our Services. This may involve Profiling. The information is the basis for Qred's market and customer analysis and internal statistics. We apply individual offers, for which we use your contact and identification information, and information about your payment patterns and interaction with us. We may use this information to communicate personal offers to you via physical mail, SMS, email, or other digital channels.

You can unsubscribe from personal offers either by clicking on the link in the digital communication or by contacting us as described in this Privacy Notice.

9. Samtycke

In cases where Qred Processes your Personal Data based on your

consent or explicit consent (for example, when you give us a power of attorney which allows a third party to access or upload your Personal Data into our systems) you can withdraw this consent at any time by contacting us as described in this Privacy Notice. Withdrawing your consent will not lead to any deterioration in our Services, as we do not need this information to provide the Services.

10. Dina rättigheter till åtkomst, rättelse och radering

I enlighet med GDPR har du olika rättigheter i samband med Behandlingen av dina Personuppgifter, enligt nedan. Om du vill utöva någon av dessa rättigheter är du välkommen att kontakta oss genom att skicka ett e-postmeddelande till vårt team på privacy@qred.com.

A. Rätt att bli informerad

Du har rätt att få information om hur vi Behandlar dina Personuppgifter. Vi tillhandahåller denna information genom denna information, på vår webbplats och genom att svara på frågor från dig.

B. Rätt att få tillgång till Personuppgifter

Du har rätt att begära information om vilka av dina Personuppgifter vi Behandlar. Attbegära denna information är kostnadsfritt.

C. Rätt till rättelse

Du har rätt att korrigera felaktiga eller ofullständiga uppgifter om dig själv.

D. Rätt till radering ("rätt att bli glömd")

Du har rätt att begära att dina Personuppgifter raderas, förutsatt att uppgifterna intelängre är nödvändiga för det ändamål eller rättsliga förpliktelse de Behandlas för. I det fallvi har en rättslig förpliktelse att behålla uppgifterna, Behandlas Personuppgifterna inte förnågot annat syfte än att uppfylla den rättsliga förpliktelsen.

E. Rätt att invända mot vår Behandling

Om du anser att dina Personuppgifter är felaktiga eller Behandlas i strid med gällande lag, har du rätt att be oss invända mot vår Behandling av dina Personuppgifter. Dessutom kan du alltid invända mot att vi använder din information i marknadsföringssyfte. Integritetsskyddsmyndigheten ansvarar för att övervaka tillämpningen av den relevanta lagstiftningen i enlighet med vår Behandling av Personuppgifter. Den som anser att ett företag hanterar Personuppgifter felaktigt kan lämna in ett klagomål till Integritetsskyddsmyndigheten.

11. Cookies

Vi använder cookies och liknande tekniker när du använder vår webbplats för att förbättra kundupplevelsen. Vi använder också cookies för att få statistisk information om hur vår webbplats används och hur den fungerar, så att vi kan arbeta med att förbättra den. För att ge en skräddarsydd upplevelse använder Qred cookies och liknande spårningsteknik i våra olika gränssnitt, såsom vår webbplats. Du kan hitta information om spårningstekniken som Qred använder, och information om hur du accepterar eller avvisar spårningstekniken, i respektive gränssnitt. För mer information om hur vi använder cookies, se vår informationstext.

12. Kontakta oss

Qred Bank AB är registrerat hos Bolagsverket med org. nr. 559008-9800. Vårt huvudkontor finns på Drottninggatan 98, 111 60 Stockholm. Du är alltid välkommen att kontakta Qredsdataskyddsombud med frågor angående dataskydd och Personuppgifter på privacy@qred.com. Besök gärna vår webbplats qred.se för mer information om oss.

13. Övrigt

Qred kan göra ändringar i denna information från tid till annan. Ändringar meddelas via uppdateringar på vår webbplats.