Privacy Policy (Norwegian and EU/EEA Residents and Citizens)

1.1 Overview: In order to provide the Pleiades Services and to reduce the risk of fraud, Pleiades, the data controller, must ask you to provide the information (as defined below) about yourself, including your phone number details and the information particularly set out in Section 2 below.

1.2 Legal Basis: We are required by the General Data Protection Regulation (the “GDPR”) to set out in this Privacy Policy the legal grounds on which we rely in order to process your information. We generally process your information because:

• (a) it is necessary for the legitimate interests of Pleiades, including our interests in fulfilling the purposes in Section 3 below and when we make the disclosures referred to in Section 5 below, necessary for providing products and services of a consistently high standard, keeping our customers satisfied, and meeting our accountability and regulatory requirements around the world, in each case provided such interests are not overridden by your privacy interests;
• (b) it is necessary for us to enter into, and perform our obligations under, our contract with you, such as when we use your data for the purposes in Section 3 below;
• (c) it is necessary for compliance with a legal obligation under Norwegian law, EU law or the laws of a Member State (e.g. any mandatory disclosures to an authority, regulator or government body);
• (d) in some cases, we have obtained your prior consent.

1.3 Information: For the purposes of this Privacy Policy, the term “information” means any information about you that we or our third party service providers collect from you or a third party, including such information set out in Section 2 below. Pleiades takes the processing of your information very seriously and will use your information only in accordance with the terms of this Privacy Policy. It is important for you to review this Privacy Policy as it applies to all of the Pleiades Services.

1.4 Notification of Changes: This Privacy Policy may be revised over time as new features are added to the Pleiades Services or as we incorporate suggestions from our customers. We may change this Privacy Policy at any time by posting a revised version of it on our website. Unless we have legal grounds to do so otherwise, we will provide you with at least 30 days' prior notice of the effective date of the revised privacy policy. We will post the notice on our website followed by a notification to you by e-mail.

1.5 Third Party Websites or Applications: Some pages on the websites of Pleiades or parts of the Pleiades Services may include links to third-party websites. These sites are governed by their own privacy statements and terms of use, and Pleiades is not responsible for their operations, including but not limited to their information handling practices. Users submitting information to or through these third-party websites should review the privacy statements and terms of use of these sites before providing them with personally identifiable information. Pleiades is not responsible for the content or information practices of such third parties.

2.1 Account Information: We will collect the following information for the purposes of opening and operating the Pleiades account.

• a) Account opening and usage – To open a Pleiades account or use the Pleiades Services, we need your:
  1. name;
  2. address;
  3. phone number;
  4. the details of your identification document(s); and
  5. email address.
• c) Know-Your-Client/Anti-Money Laundering information from third parties and other sources:

  Sometimes in order to complete our customer screening and identity verification process, including checks in relation to fraud detection and prevention, anti-money laundering, know your-client and countering of the financing of terrorism, we verify the information you provide with the Pleiades Group, payment partners, service providers and fraud agencies as well as information available through internet and publicly accessible social network data. In the course of such verification, we will collect information on your political opinions, records on past criminal jurisdictions and whether you are a politically exposed person or included in any sanction list.

• d) Confirmations and additional information
  1. If we cannot verify the information that you provide, we may ask you to upload or send us additional confirmations or to answer additional questions online to help verify your information.
  2. If you send or receive high overall payment volumes or display inconsistent transactional patterns through the Pleiades Services, or if you have a limited transactional history with us, we will conduct a background check on you by obtaining information about you and/or your business, and potentially (if legally permitted) also about your directors, shareholders and partners, from a credit reference or fraud agency. If you owe us money, we may obtain additional information about you from a fraud agency, to the extent permitted by law. Pleiades, at its sole discretion, reserves the right to periodically retrieve and review a business and/or consumer credit report supplied by such credit reference or fraud agency for any account, and reserves the right to close an account based on information obtained during this credit review process.

2.2 Provision of the Pleiades Services: We also will collect the following information to provide you with the Pleiades Services:

• a) Using your Device: When you use the Pleiades Services using any device (whether connected to Pleiades wirelessly or by a fixed line or otherwise), we will additionally collect and store device sign-on data (including but not limited to device ID) and geolocation data in order to provide the Pleiades Services.
• b) Loyalty Information: If we allow you to link your membership of an eligible loyalty scheme to your account, we need your loyalty scheme membership details to enable us to track your membership and calculate applicable fees, discounts or other loyalty benefits.
• c) Website Traffic Information: Because of the way Internet communication standards work, when you arrive at or leave the Pleiades website, we automatically receive the web address of the site that you came from or are going to. We also collect information on the pages of our website which you visit, IP addresses, the type of browser you use and the times you access our website.
• d) Cookies, Web Beacons, Local Storage and Similar Technologies: When you access our website or use the Pleiades Services, we (including companies we work with) may place small data files on your computer or other device. These data files include cookies, pixel tags, Flash cookies, or other local storage provided by your browser or associated applications (collectively "Cookies"). We use Cookies to recognize you as a customer, customize the Pleiades Services, content and advertising, measure promotional effectiveness, help ensure that your account security is not compromised, mitigate risk and prevent fraud, and to promote trust and safety across our sites and the Pleiades Services. You are free to decline our Cookies if your browser or browser add-on permits, unless our Cookies are required to prevent fraud or ensure the security of websites we control. However, declining our Cookies may interfere with your use of our website and the Pleiades Services.
• e) Communications: When you communicate with us for customer service or other purposes (e.g., by emails, phone calls, tweets, etc.), or provide any feedback, we retain such information and our responses to you in the records of your account.
• f) Questionnaires, Surveys, Sweepstakes: From time to time, we offer optional questionnaires, surveys and sweepstakes to our users for such purposes as collecting demographic information or assessing users' interests and needs. If we collect personally identifiable information from our users in these questionnaires, surveys, and sweepstakes, the users will be given notice of how the information will be used prior to their participation.
• g) Profile Data: We may also collect public information about your business and your behavior on social media platforms (such as your e-mail address and the number of “likes” and “followers”), to the extent relevant to confirm an assessment of your transactions and/or your business, including its size and the size of its customer base.

2.3 We set out in Section 3 below greater detail (in addition to what is set out in the foregoing of this Section 2) on how we use the information we collect.

We will use your Account Information to provide the Pleiades Services. In particular, we will use your information for the following purposes:

3.1 Internal Uses: Our primary purpose in collecting your information is to provide you with a safe, smooth, efficient, and customized experience in your use of the Pleiades Services. We do this by processing your information to:

• (a) process transactions and provide the Pleiades Services;
• (b) complete our customer screening and identity verification process including checks in relation to fraud detection and prevention, anti-money laundering, know-your-client and the countering of the financing of terrorism;
• (c) resolve disputes, collect fees, and troubleshoot problems;
• (d) manage risks and carry out investigations, in relation to any illegal activity or potential illegal activity or transactions for breach or potential breach of our terms and conditions;
• (e) provide you with customer support services;
• (f) improve the Pleiades Services by customising your user experience;
• (g) measure the performance of the Pleiades Services and improve their content and layout;
• (h) manage and protect our information technology infrastructure;
• (i) provide targeted marketing and advertising, service updates, and deliver promotional offers based on the communication preferences you have defined for your Pleiades account (please refer to the section "Our Contact with Pleiades Customers" below) and your activities when using the Pleiades Services; and
• (j) perform creditworthiness and solvency checks, compare information for accuracy, and verify it with third parties.

3.2 Questionnaires, Sweepstakes, Surveys and Profile Data: If you choose to answer our optional questionnaires or surveys, we may use such information to improve the Pleiades Services, send you marketing or advertising information, manage the sweepstakes, or as otherwise explained in detail in the survey itself.

3.3 Our Contact with Pleiades Customers: We communicate with our users on a regular basis via email and chats to provide requested services. We may also communicate with our users by phone to:

• (a) resolve customer complaints or claims made by users;
• (b) respond to requests for customer service;
• (c) inform users if we believe their accounts or any of their transactions have been used for an illegitimate purpose;
• (d) confirm information concerning a user's identity, business or account activity;
• (e) carry out collection activities;
• (f) conduct customer surveys; and
• (g) investigate suspicious transactions.

We use your email or physical address to confirm your opening of a Pleiades account, to send you notice of payments that you send or receive through Pleiades, to send you information about important changes to our products and services, and to send notices and other disclosures required by law. Generally, users cannot opt out of these communications, but they will be primarily informational in nature rather than promotional.

We also use your email address to send you other types of communications that you can control, including "news” and “notice of special third-party promotions”. You can choose whether to receive some, all or none of these communications when you complete the registration process, or at any time thereafter, by logging in to your account and then selecting settings and updating your preferences.

3.4 Other purposes: In some cases, we will also use your information for the purposes of, or in connection with:

• (a) independent audits of our financial statements and operations – the auditors may seek to contact a sample of our customers to confirm that our records are accurate. However, these auditors cannot use personally identifiable information for any secondary purposes;
• (b) an official request from a public or judicial authority where either compelled by law or where appropriate in all the circumstances;
• (c) applicable legal or regulatory requirements;
• (d) financial accounting and invoicing purposes;
• (e) maintaining and managing insurance and insurance claims relating to our business;
• (f) services we receive from our professional advisors, such as lawyers, accountants, insurance brokers and consultants;
• (g) the transfer to a potential buyer, transferee, merger partner or seller and their advisers in connection with an actual or potential transfer or merger of part or all of Pleiades’s business or assets, or any associated rights or interests, or to acquire a business or enter into a merger with it; and
• (h) protecting our rights and those of Pleiades.

We may combine your information with other information we collect from other companies and use it to improve and personalize the Pleiades Services and send marketing communications to you. You will only receive such marketing communications from us or may participate in our ad-customization programs if you have expressly consented to doing so. If you have consented, but no longer wish to receive marketing communications from us or participate in our ad-customization programs, simply update your preferences.

We will share your information with the following types of third parties in the circumstances described below.

• 5.1 Disclose necessary information to the police and other law enforcement and/or fraud prevention agencies: Such entities include security forces, competent governmental, inter-governmental or supranational bodies, regulatory authorities and recognised self-regulatory authorities. Disclosure to such entities will be made where (i) the law compels or permits us; or (ii) we have reason to believe it is appropriate for us to cooperate with such entities for checks in relation to fraud detection and prevention, anti-money laundering, know-your-client and countering of the financing of terrorism, or investigations in relation to any other illegal activity or potential illegal activity.
• 5.2 Disclose necessary information to other third parties such as payment processors, auditors, financial products providers, business partners, marketing and public relations agencies, shipping and courier companies, Pleiades Group companies, marketplaces, service providers and your agents or legal representatives: Such disclosure is required for purposes of our provision of the Pleiades Services, investigations into transactions on breach or potential breach of our terms and conditions, support of our business operations, checks in relation to fraud detection and prevention, anti-money laundering, know-your-client and countering of the financing of terrorism, investigations in relation to any other illegal activity or potential illegal activity, bill collection, marketing, provision of customer support services and public relations purposes.
• 5.3 Disclose necessary information to intellectual property rights owners: Such disclosure is required under the applicable national law in the event that an owner of intellectual property rights commences any action or pursues a claim against Pleiades for an out-of-court information disclosure due to an infringement of their intellectual property rights for which the Pleiades Services have been used.
• 5.4 Disclose necessary information to card networks and schemes: Such disclosure is required in response to the requirements of the card networks through which your use of the Pleiades Services may rely on (such as Visa and Mastercard).
• 5.5 Grant access to information in event of mergers or acquisitions involving Pleiades: As with any other business, it is possible that in the future Pleiades could merge with, or be acquired by, another company. If such merger or acquisition occurs, the successor company will have access to your Account Information maintained by Pleiades, and this Privacy Policy continues to apply to such successor company unless and until it is amended.
• 5.6 Disclosing information to sellers when Pleiades users purchase goods/services using the Pleiades Services: If you are buying goods or services and pay through Pleiades, we may provide the seller with the delivery address for the goods and your billing address to complete your transaction. If an attempt to pay your seller fails, or is later invalidated, we may also provide your seller with details of the unsuccessful payment. To facilitate dispute resolutions, we may provide a buyer with the seller's address so that goods can be returned to the seller.
• 5.7 Disclosing information to loyalty schemes of which Pleiades users are members: If you link your membership of an eligible loyalty scheme to your account in our mobile app, we will share your loyalty scheme membership ID with the relevant loyalty scheme when you pay using Pleiades. If you remove your loyalty scheme membership ID from your Account, we will stop sharing this information.
• 5.8 Disclosing information to third party service providers who facilitate payments from or to you: We work with third parties to enable them to accept or facilitate payments from or to you using the Pleiades Services. In doing so, a third party may share information about you with us such as your email address or phone number, when a payment is sent to you or when you are attempting to pay that third party. We use this information to confirm that you are a Pleiades customer and that Pleiades can be enabled to make a payment, or where a payment is sent to you to send you a notification that you have received a payment. Please note that third parties you receive funds or buy from may have their own privacy policies, and Pleiades is not responsible for their operations, including but not limited to their information handling practices.

6.1 Please note that some of the recipients of your information referred to above will be based in countries outside of the European Economic Area whose laws may not provide the same level of data protection. Pleiades is committed to adequately protecting your information regardless of where the data resides and to providing appropriate protection for your information where such data is transferred outside of Norway and the EEA.

6.2 The appropriate safeguard we use to secure your information in the context of such transfers are the EU Model Clauses. You can find a sample of such EU Model Clauses under http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm or contact our data protection officer (see Section 10 below).

6.3 Further details of the transfers of your information outside of Norway and the European Union and the adequate safeguards used by us in respect of such transfers (including copies of relevant agreements) are also available from us by contacting us at ouch@juicebox.ooo.

7.1 You have a number of rights in relation to your information. Where you contact us to exercise your rights, we will honour your privacy request as required under the GDPR but your rights are not absolute as they do not always apply and exemptions may be applicable. You may also contact us at ouch@juicebox.ooo if you wish to make a complaint to us relating to your privacy.

7.2 Under the GDPR, you have rights:

• (a) of access to, rectification of, and/or erasure of your information;
• (b) to object to processing of your information;
• (c) withdraw consent to our processing of your information (to the extent such processing is based on consent) or restrict our processing of your information;
• (d) where processing your information is necessary for entering into or performing our obligations under a contract with you, you may have the right to request your information be transferred to you or to another controller; and
• (e) to request not to be subject to automated decision making.

To exercise any of your rights, or if you have any other questions about our use of your information, please contact us at ouch@juicebox.ooo.

7.3 Finally, you have the right to lodge a complaint with the data protection authority in the place where you live or work, or in the place where you think an issue in relation to your data has arisen.

8.1 We will retain your information for as long as necessary to fulfil the purposes outlined in Section 3. However, we will retain your information for a longer period where required by law and for the duration of any statutory limitation period for claims.

8.2 In general, although there are limited exceptions, we will retain your information during the period when you are using the Pleiades Services and for at least six (6) years after your use of the Pleiades Services ceases.

9.1 Pleiades is committed to handling your information with high standards of information security. We use computer safeguards such as firewalls and data encryption, we enforce physical access controls to our buildings and files, and we authorise access to information only for those employees who require it to fulfil their job responsibilities.

9.2 The security of your Pleiades account also relies on the protection of the code sent to your phone number. You may not share your code with anyone. Pleiades representatives will never ask you for your code, so any email or other communication requesting your password should be treated as unauthorized and suspicious and forwarded to ouch@juicebox.ooo. If you do share your code with a third party for any reason, including because the third party has promised to provide you additional services such as account aggregation, the third party will have access to your account and your information, and you may be responsible for actions taken using your password. If you believe someone else has obtained access to your code, please change it immediately by logging in to your account and changing your Profile settings, and also contact us right away.

Our privacy office and our data protection officer are responsible for ensuring that our day-to-day procedures comply with this Privacy Policy. If you want to exercise your right to access your information or have any questions about this Privacy Policy, Pleiades's information practices, or your dealings with Pleiades in relation to your information, you can contact us at ouch@juicebox.ooo.