English
DanskPrivacy Notice
Finance Data Business Services
1. Who is the controller?
Subaio ApS, company registration no. 37766585, Gasværksvej 26B, 1st floor, 9000 Aalborg, Denmark, is the controller for the personal data processing carried out by Subaio in connection with Finans Data Business Services.
Subaio is authorised as an Account Information Service Provider, AISP, and is supervised by the Danish Financial Supervisory Authority.
The business, adviser, credit partner, lender or other recipient shown to you before you give consent is independently responsible for its subsequent processing of the information or output it receives.
Contact: dpo@subaio.com
2. What is the service used for?
You do not need to know Subaio’s internal classification of the service. What matters is the purpose shown to you before you give consent. The service is typically used in one of the following ways:
| If the service concerns advice, budgeting or financial overview | If the service concerns a credit application |
|---|---|
| Subaio may create and share the output or data package shown to you in the consent flow. This may include a budget, categories, insights or more detailed account information, if necessary for the advice or overview you have requested. | Subaio creates an aggregated financial overview and shares only aggregated information with the recipient shown to you. Raw transactions, account statements, merchant names, payee names, exact transaction dates and transaction-level information are not shared. |
| The information must not be used for credit assessment, creditworthiness assessment, lending decisions, individual pricing, interest, fees, loan terms, collateral, maturity, investor return or other individual terms. | Subaio does not decide whether you can obtain credit. The credit decision is made by the relevant recipient, such as the credit partner or lender, as an independent controller. |
3. Where do we receive your information from?
We receive information from the payment accounts in your bank that you choose to connect. We may also receive information that you provide to us and technical information about your use of the service.
4. What information do we process?
- Account information, including name, accounts, balances, transactions, transaction details, dates, amounts, payees, categories and similar information from the accounts you select.
- Financial outputs, such as budget overviews, categories, recurring income and expenses, aggregated metrics, insights and other financial overviews.
- User and contact information, if you provide it to us in connection with the service.
- Technical information, such as browser, device, session, consent documentation, logs and security-related information.
- Information that may indirectly reveal sensitive matters, such as health, religion, political opinions or trade union membership, if such information appears in your payment account information.
If output is shared in connection with a credit application, Subaio uses aggregation, technical filters and neutral categorisation so that the recipient does not receive raw transaction information or information about individual payees.
5. Why do we process your information?
Subaio processes your information for the following purposes:
- To provide the Finans Data service you have requested.
- To retrieve account information from the payment accounts you select.
- To calculate, categorise, aggregate or enrich information so that the relevant output can be delivered.
- To share the output or data package with the recipient shown to you, if you give separate consent to sharing.
- To document your consent, secure operations, prevent misuse, troubleshoot and comply with legal obligations.
- To perform statistics, quality assurance and service improvement, including by anonymising or aggregating information.
6. Legal basis
| Purpose | Legal basis | Types of information |
|---|---|---|
| Providing the service you have requested | GDPR Article 6(1)(b). In addition, you give explicit consent under PSD2 and payment services rules for Subaio to access the selected payment accounts. | Account information, transaction data, output and technical information. |
| Information that may indirectly reveal special categories of personal data | GDPR Article 9(2)(a), where and to the extent such information is processed on the basis of your explicit consent. | Transaction data that may reveal special categories. |
| Operations, security, documentation and improvement | GDPR Article 6(1)(f), Subaio’s legitimate interest in operating, securing, documenting and improving the service. | Technical information, logs, consent documentation and anonymised or aggregated information. |
| Compliance with legal obligations | GDPR Article 6(1)(c). | Information Subaio is required to process under applicable law. |
7. Who do we share information with?
Subaio only shares the output or data package with the recipient shown to you before you give consent. This may be the business, adviser, credit partner, lender or recipient category relevant to the service you have requested.
For a credit application, Subaio only shares aggregated information. For advice, budgeting or financial overview services, Subaio may share more detailed information if this is necessary for the service you have requested and if this is shown to you before you give consent.
The recipient is independently responsible for its subsequent processing of the information or output it receives. The recipient must provide you with information about its own processing where required by data protection law.
Subaio also uses processors that assist with operations, hosting, security, support, payment, logging and delivery of the service. Processors may only process personal data on Subaio’s instructions and must be subject to a written data processing agreement.
As a starting point, your information is stored within the EU/EEA. If a transfer outside the EU/EEA becomes necessary, it will only take place on the basis of a valid transfer mechanism and appropriate safeguards.
8. Joint applications or joint use
If you use the service together with another person, for example in a joint credit application or a joint financial overview, each person must separately connect their own account information. A joint financial overview may be visible to the persons participating in the joint service if this is shown in the consent flow.
9. Cookies and similar technologies
Subaio may use necessary cookies and similar technologies to securely manage your session and deliver the service. If Subaio uses other cookies, you will receive separate information and the option to give or refuse consent where required.
10. Data security
Subaio has implemented appropriate technical and organisational security measures to protect personal data against unauthorised access, alteration, loss or deletion. The level of security is reviewed on an ongoing basis.
11. Retention period
As a starting point, Subaio deletes account information and output no later than 30 days after the service has been delivered. Technical logs, consent documentation, payment/subscription information and security-related information may be retained for longer if necessary for documentation, security or legal compliance.
The recipient receiving the output or data package is independently responsible for its own retention and deletion of the information or output it receives.
12. Automated decisions
Subaio does not use your information to make automated decisions that produce legal effects concerning you or similarly significantly affect you. If the service concerns a credit application, Subaio does not decide whether you can obtain credit.
13. Your rights
You have the right to:
- request access to your personal data
- have inaccurate information corrected
- have information deleted
- have processing restricted
- object to processing based on legitimate interests
- receive your information in a structured format, where the conditions for data portability are met
- withdraw your consent with future effect.
Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn. Requests should be sent to: dpo@subaio.com
14. If you do not give access
If you do not give access to the relevant payment accounts, or if you withdraw your consent, Subaio cannot provide the parts of the service that require account access. This may mean that the business through which you use the service cannot receive the relevant output from Subaio.
15. Changes to this notice
Subaio may change this Privacy Notice. Material changes will be notified with reasonable notice through the service or on our website. Changes will not have retroactive effect.
16. Contact and complaints
Subaio ApS
Gasværksvej 26B, 1st floor
9000 Aalborg, Denmark
E-mail: dpo@subaio.com
You may lodge a complaint with the Danish Data Protection Agency, Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk