Privacy Policy

Privacy Policy for Electronic Services

General

Ensue Group and its subsidiaries ("ENSUE," "we," or "us") welcome you to the Ensue website. We appreciate your use of our mobile apps, your use of our electronic services (collectively, "Electronic Services"), and your interest in our products and services.

Ensue Global is considered the controller for most of the Electronic Services described here. In other cases, where expressly indicated, the relevant Ensue subsidiary acts as the controller.

Ensue attaches great importance to appropriate data protection. Below, we inform you about how we handle your personal data in connection with the use of our Electronic Services ("Privacy Policy").

By continuing to use ENSUE's Electronic Services, you confirm that you are at least 18 years old. Please note that we may update this Privacy Policy from time to time. The most recent version will apply, as indicated in the update notice above (last updated).

Information on the processing of personal data of former, current and potential customers by Ensue Group can be found below in the relevant «Data protection information for customers».

Purpose and scope of the data protection declaration

It is very important to us to protect your privacy and ensure the lawful handling of the personal data of all users of our Electronic Services. We are aware that you may be entrusting us with personal information ("Data") when using our Electronic Services, and we would like to assure you that we take our responsibility to protect and secure this data very seriously. Therefore, this Privacy Policy informs you about which data we process when you use our Electronic Services, for what purpose, how we process it, to whom we disclose data, and what security measures we have taken to protect your data.

This Privacy Policy applies to all data we receive as a result of your use of our Electronic Services. It does not apply to data we receive through other channels or to third-party Electronic Services ("Third-Party Electronic Services"), even if you access them via links from our Electronic Services or they are necessary for the provision of our Electronic Services. We have no control over the content and privacy policies of third-party Electronic Services and therefore cannot accept any responsibility for them.

Type of data processed

When you use our Electronic Services, our backend systems may automatically record details of your usage (e.g., your IP address, the browser type you use, the HTTP header user agent, device-specific information, the content you access on our website including the date and time, usage and user interaction, and the website from which you were referred to our Electronic Services).

We also process personal data such as your name, address, email address, telephone number, date of birth, gender, and other data provided to us when you register to use our Electronic Services or complete a registration form or message box for the newsletter, for a product demonstration, etc.

Legal basis and purpose of data processing

We process the data based on the following legal bases:

• Legitimate interest of Ensue or third parties;
• Your consent (if the processing is based on a specific request for consent, for example for sending newsletters for which you have subscribed);
• Fulfillment of contractual obligations and implementation of measures prior to the conclusion of contracts;
• Legal requirements.

We process the data for the following purposes:

• Providing electronic services, for example, to assist you with registration processes, setting user preferences and responding to your feedback and problem reports;
• Administration, research and development relating to electronic services;
• Marketing and advertising measures (e.g. sending newsletters by email, online advertising);
• Analysis and monitoring of the use of the Electronic Services, user behavior and navigation;
• Verifying the identity and suitability of customers for certain products and services;
• To create a basis for future information about the products and services offered by Ensue and to improve their quality;
• Ensuring the security and operational operation of our IT environment;
• Enabling application procedures in accordance with the data processing and privacy policy for applicants, to which you consent before starting the application process;
• Compliance and risk management, prevention and investigation of criminal offenses, assertion of legal claims and defense in legal disputes.

We process your personal data in accordance with applicable data protection laws and for as long as necessary.

Disclosure and transfer of your data

We may transfer data for the purposes described above within the Ensue Group, between group companies, to authorized representatives of Ensue or to service providers appointed by Ensue Group, business partners, or foreign courts, offices, or authorities within and outside the country in which you are currently located. All such persons and companies receiving data are obligated to comply with applicable national and international data protection laws and ENSUE's data protection standards.

Data may be transferred:

• for the purpose of providing electronic services;
• if you have given your consent (e.g. in your contracts with Ensue or as part of data protection settings); or
• on the basis of legal requirements, following an official request or in the context of comparable processes in accordance with applicable law.

In most cases, your data may be transferred to countries where Ensue Group maintains offices. We may also transfer your data to countries where Ensue Group is not represented (e.g., to provide Electronic Services). Global transfer of your data by Ensue Group is possible in order to use the services of third-party providers in other countries, including EU/EEA member states and other countries that offer a level of data protection equivalent to that required by Switzerland and the EU Commission, or in other jurisdictions worldwide. The countries in which the recipients of your data are located may vary, depending on the purpose(s) described in this Policy. The recipients of data may, under certain circumstances, forward the information to their branches or group companies, service providers, or authorities within and/or outside their country. We may also transfer data without your consent if it is necessary to establish, assert, or enforce legal claims or if the physical integrity of a data subject needs to be protected. The laws of some countries to which Ensue transfers your data may not offer a level of personal data protection comparable to that provided by Switzerland or the EU. In these cases, Ensue will generally ensure adequate data protection, for example, by entering into data transfer agreements with the recipients of your data located in those countries. These include agreements approved by the European Commission and the Federal Data Protection and Information Commissioner (FDPIC), also known as standard contractual clauses. You can request a model data transfer agreement, as commonly used by Ensue Group, from the Data Protection Officer ("DPO"; contact details below). In exceptional cases, your data may also be transferred to countries without adequate data protection, e.g., based on your consent, in connection with legal proceedings abroad, or if the transfer is necessary to conclude or fulfill a contract.

Ensue may be required to disclose data to supervisory authorities, judicial authorities, or other competent persons within the framework of applicable law and regulatory obligations.

Security measures by Ensue Group

Ensue takes appropriate technical and organizational security measures to ensure that your data processed in the IT environment controlled by Ensue is protected against unauthorized access, misuse, loss, and/or destruction.

Ensue implements physical, electronic, and procedural security measures. These include, for example, the use of firewalls, personalized passwords, and encryption and authentication technologies. We oblige our employees and authorized service providers to maintain confidentiality and comply with data protection regulations.

Furthermore, access to personal data is strictly limited to those employees and third parties (e.g. service providers) who need to have access to it ("need to know" principle).

Data storage

Ensue will retain your data for the period necessary to fulfil the purposes set out in this policy, unless longer retention is required or permitted by applicable law or required by regulatory requirements.

Transmission of data over an open network

In the event that you use our Electronic Services over an open network, Ensue draws your attention to the fact that third parties (for example, app stores, network providers, or the manufacturer of your device) may access and process your data regardless of their location. Open networks are not under the control of Ensue and therefore cannot be considered a secure environment. No guarantee can be given that data transmitted over such an open network will be secure or error-free, as it may be intercepted, altered, damaged, destroyed, lost, delayed or incomplete, contain viruses, or be monitored. In particular, data transmitted over an open network – even if the sender and recipient are located in the same country – may leave that country and be transferred to and processed in a third country that has less stringent data protection regulations than the country in which you are currently located. If data is transmitted over an open network, we cannot be held liable for its protection. Accordingly, we assume no responsibility or liability for the security of your data during such transmission. We therefore recommend that you do not transmit strictly confidential information over open networks. Where appropriate, you may communicate with Ensue by other means.

Cookies

ENSUE's Electronic Services use cookies for statistical purposes, to assist our web developers, and to improve the user experience. Cookies are small files stored on your electronic device to track your use of the Electronic Services and your preference settings when navigating between pages, and to store settings between visits where appropriate. Cookies assist the Electronic Services in collecting statistical information about the frequency of visits to certain areas of the website and help make the Electronic Services even more useful and user-friendly. Please note that most internet browsers automatically accept cookies. You can configure your browser to refuse the storage of cookies, to restrict the storage of certain cookies, or to always display a warning before you receive a new cookie. However, disabling cookies may prevent you from using all the features of our Electronic Services.

We use the following three types of cookies:

• Functional cookies: These cookies are required for the basic functions of this website. They make it easier for you to access content on this website. We use these cookies, among other things, to save your home address and language settings. Functional cookies cannot be deactivated.
• Analytics cookies: These help us analyze the preferences and behavior of users on our website and optimize the website accordingly. This allows us to offer you a user experience tailored to your needs.
• Marketing cookies: We use marketing cookies to place advertisements tailored to your interests on and off our website.

Web analysis tools and social media plug-ins

We use third-party analytics tools such as Google Analytics to monitor Electronic Services. This includes the use of cookies to analyze how users use our Electronic Services. In doing so, we collect, among other things, the following usage data:

• Hostname of the electronic device used to access the website (masked IP address);
• Type/version of the browser used;
• Referrer URL (website from which users are redirected to ENSUE's Electronic Services by clicking on a link);
• Date and time of the server request;
• Device-specific information.

We may also use so-called social plug-ins. Plug-ins can be identified by the logos of the social networks to which they belong.

Final

ENSUE's Electronic Services may contain links to third-party Electronic Services that we neither operate nor monitor. Please note that such third-party Electronic Services are not subject to this Privacy Policy, and we are neither responsible for their content nor for the data practices of these providers. Therefore, we recommend that you read and review the privacy policies or terms of use for the relevant third-party Electronic Services.

Rights of those affected

Under applicable data protection laws and regulations, you may have the following rights:

• You can request information about the personal data we hold about you;
• You can request that the data be transmitted in a generally usable, machine-readable and standardized format (data portability);
• You can request that inaccurate personal data be corrected;
• You can request that your data be deleted if the bank is not authorized or legally obliged to store it;
• You can request that the processing of your data be restricted;
• You can object to the processing of your personal data.