KLARNA VIRTUAL SHOPPING IN STORE APP PRIVACY POLICY

Background

Klarna Bank AB UK Branch (We, us) provides virtual shopping solutions (Virtual Shopping) to retailers (Merchants) which allow customers browsing the Merchant’s online store or who connect to Virtual Shopping via third party channels such as Facebook or Google (Customers) to communicate with the Merchant’s sales associates in physical stores (Sales Associates).

In order to use Virtual Shopping in the course of their employment with the Merchant, Sales Associates must download the Virtual Shopping app (VS App). This privacy policy sets out the terms on which we process Sales Associates’ personal data when providing Virtual Shopping to Merchants. Sales Associates are referred to as “you” or Sales Associates in this privacy policy. This policy applies to your use of the VS App once you have downloaded a copy of the VS App onto your mobile device.

Privacy Policy

We are committed to protecting and respecting your privacy. This policy sets out the basis on which any personal data we collect from you, or that you provide to us when you use the VS App, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. By downloading and using the VS App, you are accepting and consenting to the practices described in this policy. Once you provide consent to us processing your personal data, you may change your mind and withdraw consent at any time by contacting us at the email address set out below but that will not affect the lawfulness of any processing carried out before you withdraw your consent. However, you will no longer be able to use the VS App.

We are the processor of the personal data which you submit when using the VS App on behalf of the Merchant for the purposes of all relevant laws relating to the processing of personal data, including the Data Protection Act 2018, GDPR, (EU General Data Protection Regulation 2016/679), and UK GDPR as defined in section 3(10) (as supplemented by section 205(4)) of the UK Data Protection Act 2018 (Data Protection Legislation). The Merchant is the controller of the personal data for the purposes of the Data Protection Legislation. We have appointed a data protection officer (DPO). If you have any questions about this privacy policy, please contact them using the details set out below.

Contact details

Our full details are:

• Full name of legal entity: Klarna Bank AB UK Branch
• Title of DPO: Data protection officer
• Email address: virtualshopping.dataprivacysupport@klarna.com
• Postal address: Aviation House, 125 Kingsway, London, WC2B 6NH

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues.

Information we collect from you

We will collect and process the following data about you:

• Information you give us. This is information about you that you give us by filling in any details on the VS App such as your name, contact telephone number, the location of the store that you work at and your email address as part of using the VS App in the course of your employment with the Merchant.

The legal basis for this processing is your consent and our legitimate interests namely monitoring and improving the VS App and enabling us to provide Virtual Shopping services and process your personal data on behalf of the Merchant in accordance with our contract with the Merchant.

Aggregated Data

• Information we collect about you via app analytics. We will collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data may be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.
• Regarding your usage of the VS app we will automatically collect the following aggregated data:
  • We use mobile analytics software to record information such as how often you use the VS App, events and interactions that occur within the VS App and aggregated usage and performance data.
  • Additionally, in the event that Virtual Shopping might crash on your mobile device we will receive information about your mobile device model and OS version.

Uses made of the information

We will only use your personal data when the law allows us to do so and in accordance with the Merchant’s instructions. Most commonly we will use your personal data in the following circumstances:

• Where you have consented before the processing.
• Where we need to perform the contract we have entered into with the Merchant to provide Virtual Shopping.
• Where it is necessary for our legitimate interests (or those of a third party, including the Merchant) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.

We use information held about you in the following ways:

• Information you give to us. We will use this information:
  • for internal use and to administer the VS App, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
  • to communicate with you including to notify you about changes to the VS App;
  • in performance of the contract to provide Virtual Shopping between us and the Merchant.
• Aggregated data. We will use aggregated data:
  • to allow us to better understand the functionality of Virtual Shopping on your mobile device.
  • to allow us to identify and fix bugs and otherwise improve the performance of Virtual Shopping.

Disclosure of your information

You agree that we have the right to share your personal information with the Merchant as well as:

• Selected third parties including:
  • business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or the Merchant;
  • analytics providers that assist us in the improvement and optimisation of the VS App;

We will disclose your personal information to third parties:

• If we sell or buy any business or assets, in which case we will disclose your personal data to the prospective seller or buyer of such business or assets.
• If we are under a duty to disclose or share your personal data to comply with any legal obligation.

Where we store your personal data

The data that we collect from you will generally be transferred to, and stored at, a destination inside the European Economic Area (“EEA”) however, may also be processed by our staff, and staff employed by our US affiliate company, Klarna Inc., working in the US and subcontractors that supply services to us in the US in connection with the VS App. We can confirm that we have the appropriate safeguards in place to ensure the safe transfer and storage between countries. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

Security

All information you provide to us is stored on our secure servers. Once we have received your information, we will use strict procedures and security features to try to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way.

We have put in place procedures to deal with any suspected personal data breach and will notify you, the Merchant and any applicable regulator when we are legally required to do so.

Retaining and deleting your personal data

Your personal data shall not be kept for longer than is necessary to allow us to provide Virtual Shopping to the Merchant and comply with the terms of our contract with the Merchant. Where your personal data is kept in back up archives and therefore cannot be deleted, we will store it securely and not carry out any processing until it is deleted.

Notwithstanding the above, we may retain your personal data if it is necessary for our compliance with certain legal obligations.

Your rights

You have the right to:

• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

1. if you want us to establish the data's accuracy;
2. where our use of the data is unlawful but you do not want us to erase it;
3. where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
4. you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we will not be able to provide access to the VS App to you.

Changes to our privacy policy and your duty to inform us of changes

Any changes we make to our privacy policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our privacy policy. We keep our privacy policy under regular review.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.

Klarna Bank AB (UK Branch)

March 2022