Finance Data Personal Privacy Notice

1. Who is the controller?

Subaio ApS, company registration no. 37766585, Gasværksvej 26B, 1st floor, 9000 Aalborg, Denmark, is the controller for the personal data processing that Subaio carries out in connection with Finans Data Personal Tier.

Subaio is authorised as an Account Information Service Provider, AISP, and is supervised by the Danish Financial Supervisory Authority.

Contact: dpo@subaio.com

2. Where do we receive your information from?

We receive information from the payment accounts in your bank that you choose to connect. We may also receive information that you provide to us when you create or use the service, and technical information generated when you use the service.

3. What information do we process?

Account information, including name, accounts, balances, transactions, transaction details, dates, amounts, payees, categories and similar information from the accounts you choose to connect.
Financial outputs, including budget overviews, categories, recurring income and expenses, basic insights and other overviews shown to you in the service.
User and subscription information, including name, contact details, user ID, subscription status and payment status, if relevant.
Technical information, including browser, device, session, logs, consent documentation and security-related information.

Transaction data may indirectly reveal special categories of personal data, such as health, religion, trade union membership or political matters. Subaio does not use this information to make decisions about you and does not seek to infer such matters about you.

4. Why do we process your information?

We process your information to provide Finans Data Personal Tier to you. This includes retrieving account information from the accounts you choose, showing you your own transactions, budgets, categories, recurring income and expenses and financial insights, administering your profile and subscription, documenting your consent, securing operations, preventing misuse, troubleshooting, complying with legal obligations and improving the service through statistics, quality assurance and anonymisation.

5. Legal basis

Purpose	Legal basis	Main data types
Providing Personal Tier	GDPR Article 6(1)(b). The processing is necessary to provide the service you have requested.	Account information, transaction data, financial outputs and user information.
Access to payment accounts	Your separate explicit consent under PSD2 and payment services rules when you connect the accounts you choose.	Account information from the accounts you choose.
Indirectly sensitive information	GDPR Article 9(2)(a), if and to the extent transaction data indirectly reveals special categories of personal data and is processed based on your explicit consent.	Transaction data that may indirectly reveal sensitive matters.
Operations, security and documentation	GDPR Article 6(1)(f). Subaio’s legitimate interests in operating, securing and documenting the service.	Technical information, logs and consent documentation.
Legal obligations	GDPR Article 6(1)(c).	Information Subaio is required to process under applicable law.
Statistics, quality assurance and service improvement	GDPR Article 6(1)(f), where personal data is processed. When information has been anonymised, it is no longer personal data.	Aggregated or anonymised information.

6. Who do we share information with?

We do not sell your data.

We do not share your account information or outputs with credit partners, lenders, advisers, investors or other business customers as part of Personal Tier.

We may use processors that help us with operations, hosting, security, support, payment, logging and delivery of the service. Processors may only process information on Subaio’s instructions and must be subject to a written data processing agreement.

As a starting point, your information is stored within the EU/EEA. If a transfer outside the EU/EEA becomes necessary, it will only take place on a valid transfer basis and with appropriate safeguards.

7. Cookies and similar technologies

Subaio may use necessary cookies and similar technologies to securely manage your session and deliver the service. If Subaio uses other cookies, you will receive separate information and the option to give or refuse consent where required.

8. Retention period

We keep your information for as long as necessary to provide Finans Data Personal Tier to you.

If you disconnect account access, cancel Personal Tier or ask us to delete your information, we will as a starting point delete account information and financial outputs no later than 30 days after the service has ended, unless longer retention is necessary.

Technical logs, consent documentation, payment and subscription information and security-related information may be kept for longer if necessary for documentation, security or compliance with legal obligations.

9. Automated decisions

Subaio does not use your information in Personal Tier to make automated decisions that produce legal effects concerning you or similarly significantly affect you.

The financial insights in Personal Tier are for your own overview only.

10. Your rights

You have the right to:

request access to your personal data
have inaccurate information corrected
have information deleted
have processing restricted
object to processing based on legitimate interests
receive your information in a structured format, where the conditions for data portability are met
withdraw your consent with future effect.

Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn. You can exercise your rights by contacting dpo@subaio.com.

11. If you do not give access

If you do not give access to your payment accounts, or if you withdraw your consent, Subaio cannot provide the parts of Personal Tier that require account access.

12. Changes

Subaio may change this Privacy Notice. Material changes will be notified with reasonable notice through the service or on our website. Changes do not apply retroactively.

13. Contact and complaints

Subaio ApS
Gasværksvej 26B, 1st floor
9000 Aalborg
Denmark
E-mail: dpo@subaio.com

You may lodge a complaint with the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk