01·Who we are
Float Lending AB, org. no. 559100-4907 ("we", "us", "our") provides business account services and are developing data insight services. We also operate the website www.floatfinance.com. We are part of the same corporate group as Float Finance AB.
A note on the Business Accounts: To provide our business account, we partner with Airwallex that provides the underlying financial services. When you activate and use the Wallet, you enter into a separate agreement directly with Airwallex, who acts as an independent data controller for the personal data they process to deliver that service - including data required for customer due diligence under the Anti-Money Laundering Act. As part of delivering the business account service, Airwallex shares Account Data with us as an independent data controller, including account balance, transaction history and payor/payee information relating to your business account. We use this data to display your account information and provide the business account through the Platform. We strongly recommend reading Airwallex's Privacy Policy: https://www.airwallex.com/global/terms/privacy-policy.
02·What we collect and why
The table below sets out the personal data we process, the purpose for which we process it, and the legal basis we rely on under the GDPR.
| Purpose | Data collected | Examples | Legal basis |
|---|---|---|---|
| Platform access - freemium tier Providing access to the Platform |
Identity & contact Name, email, company name, org. no., role/title of company representative Login credentials Name, email and password, Google single sign-on, or Bank-ID or equivalent verification Financial & operational data Accounting records, transaction data, and billing subscription data Usage data Login history, access logs |
Sign-up form data Bank-ID verification to access the Platform Representative details Connected accounting system data Bank transaction feeds |
Performance of a contract - Art. 6(1)(b) GDPR. |
| Provision of the website Operating and securing www.floatfinance.com |
Technical connection data IP address, request method, date and time, page and file requested, referring URL, browser and operating system, HTTP status and response size |
Server logs Content delivery |
Legitimate interests - Art. 6(1)(f) GDPR (reliable and secure operation of the website) |
| Website & Platform analytics Understanding how our website and Platform are used, and measuring the effectiveness of our campaigns |
Usage behaviour Navigation patterns, session recordings - all personal data masked - pages visited, click paths, session duration, entry and exit pages Device & browser data IP address, device type, browser, language Campaign data Referral source, campaign identifier, conversions |
Click maps Session replays Page-view statistics Conversion tracking Remarketing audiences |
Consent - Art. 6(1)(a) GDPR, collected via our cookie banner. You may withdraw consent at any time. |
| Customer support Handling your support requests |
Communication data Content of support queries via chat or email |
Chat transcripts Email correspondence |
Legitimate interests - Art. 6(1)(f) GDPR (providing efficient, accessible support) |
| Business account administration & security Managing your account, authentication, fraud prevention |
Login credentials Name, email, encrypted password, Google single sign-on or Bank-ID verification Account Data account balance, transaction history, payor/payee information and other financial information relating to the business account Device & security data IP address, browser type, OS, login history, usage patterns |
2FA logs Transaction view, balance displays, account statements Anomaly detection Session tokens |
Performance of a contract - Art. 6(1)(b). Legitimate interests - Art. 6(1)(f) (fraud prevention). |
| Sales & lead management Managing relationships with prospective and existing business customers |
Business contact details Name, business email, phone, role/title Company data Company name, industry, size Interaction data Enquiries, meetings, event and webinar attendance, content downloads, email responses Enrichment data Additional company and professional information obtained from public sources and B2B data providers, and internal prioritisation scoring derived from it |
CRM records Meeting notes Lead prioritisation |
Performance of a contract or pre-contractual steps - Art. 6(1)(b) GDPR where a (pre-)contractual relationship exists. Legitimate interests - Art. 6(1)(f) GDPR (efficient B2B sales and business development). You may object to this processing at any time under Art. 21 GDPR. |
| Information on product updates Informing existing customers about changes to services they use |
Contact details Email address, name |
Product updates New features |
Legitimate interests - Art. 6(1)(f) GDPR |
| Marketing communications Sending marketing communications and our newsletter, The Float Street Journal |
Contact details Email address, name, phone number Engagement data Opens, clicks |
Website loan calculator usage Newsletter sign-up form Delivery statistics |
Consent - Art. 6(1)(a) GDPR. You may withdraw consent at any time via the unsubscribe link in every email. |
| Anonymisation for data insight and AI development Converting personal data into anonymised form for benchmarking and product development |
Financial & operational data Accounting records, transaction data and subscription billing data, prior to anonymisation |
Generating anonymised benchmark data sets | Legitimate interests - Art. 6(1)(f) GDPR (developing and improving our data insight services). Once anonymised, the data is no longer personal data and falls outside this policy. |
03·Where we get your data
Most personal data comes directly from you, when you sign up for a business account or use the Platform.
Connected accounting systems
Where you choose to connect an accounting system through the Platform, we obtain financial data from that system to generate key performance indicators. The data obtained may include revenue, costs, account balances, and transaction categorisation.
Connected bank accounts
Where you choose to connect a bank account through the Platform, we obtain transaction data and account balance information via a licensed account information service provider. The data obtained is used solely to generate key performance indicators within the freemium tier.
Airwallex
As part of delivering the business account service, Airwallex shares Account Data with us as an independent data controller, including account balance, transaction history, and payor/payee information relating to your business account. We use this data to display your account information and provide the business account service through the Platform.
Publicly available sources and official registers
To verify company and representative information where relevant to the business account.
Sources: Bolagsverket (Swedish Companies Registration Office), Skatteverket (Swedish Tax Agency)
Data obtained: Authorised signatories, board members, and beneficial ownership information.
B2B data providers
To keep company and contact records accurate and to prioritise sales outreach, we obtain additional business information about companies and their representatives from publicly available sources and from commercial B2B data providers.
Data obtained: Company information such as industry, size and location, and professional details such as role and function.
04·How long we keep it
We keep your personal data only for as long as necessary for the purpose it was collected, or as required by law.
Business account - contractual data
Kept for the duration of the business account relationship and thereafter for the period needed to handle complaints or legal claims; typically up to 10 years under the Limitations Act (Preskriptionslagen).
Consent-based data
Website and Platform analytics data, and marketing communications data, are kept until you withdraw your consent (Art. 7 GDPR). Withdrawal does not affect anything processed before that point.
Sales and lead management data
Kept for as long as the business relationship or prospective business relationship is active, and thereafter for up to 3 years from the last meaningful interaction, unless you object sooner.
Website server logs
Kept for up to 30 days, after which they are deleted or anonymised.
Accounting records
Data that constitutes accounting records must be retained for 7 years following the end of the calendar year in which the financial year to which the records relate was completed (Ch. 7 § 2, Swedish Bookkeeping Act, Bokföringslagen 2004:125).
05·Who we share with
We only share your personal data where necessary and lawful. We never sell your data. The categories of recipients are:
Airwallex
Float Lending AB and Airwallex each act as independent data controllers, there is no joint controllership between them. We share personal data with Airwallex in two directions:
Float Lending AB to Airwallex: We share Account Data and business account onboarding information with Airwallex for Airwallex's own purposes, including enabling the provision of Connected Account Services, AML/KYC compliance, and service administration.
Airwallex to Float Lending AB: Airwallex shares Account Data with us to enable us to operate and display the business account service through the Platform.
Both transfers are governed by Data Transfer Agreement incorporating the EU Standard Contractual Clauses (Commission Decision 2021/914). For the EEA, the applicable Airwallex entity is Airwallex (Netherlands) B.V.; for the UK, Airwallex (UK) Limited.
Float Finance AB
If you choose to apply for a business credit product through the Platform, we share the personal data relevant to your credit application with Float Finance AB. Float Finance AB acts as an independent data controller for the purposes of processing your credit application, performing customer due diligence, and managing the credit relationship. Their processing is described in the Float Finance AB Privacy Policy (available on www.floatfinance.com). The legal basis for this transfer is Art. 6(1)(b) GDPR, the transfer is necessary to take steps at your request prior to entering into a contract with Float Finance AB.
Service providers (data processors)
Third-party vendors who help us operate the Platform and our services. They act on our instructions and may not use your data for their own purposes (Art. 28 GDPR). Categories include:
- Cloud infrastructure and storage providers
- IT and platform infrastructure providers
- Website hosting and content delivery providers
- Analytics and session-recording tool providers
- Consent management providers
- CRM, marketing and email delivery providers
Social media platforms
We maintain a company presence on LinkedIn. When you interact with that presence, LinkedIn processes your data for its own purposes and provides us with aggregated page statistics. For the processing of those statistics we and LinkedIn Ireland Unlimited Company are joint controllers under Art. 26 GDPR. LinkedIn takes primary responsibility for information obligations and for handling data subject rights, and you may exercise your rights directly against LinkedIn. The essential terms are set out in LinkedIn's Joint Controller Addendum. We have no influence over LinkedIn's independent processing.
Legal basis: Legitimate interests - Art. 6(1)(f) GDPR (communicating about our products and services).
Regulatory authorities
We may be required to share data with relevant authorities where required by law.
06·International data transfers
We prioritise EU/EEA-based service providers and strive to keep all processing within the EU/EEA. In certain cases, a transfer to a country outside the EU/EEA may be necessary, for example where a best-in-class provider operates outside the EEA. In all such cases, we ensure that adequate safeguards are in place in accordance with Chapter V GDPR before the transfer takes place. We do this through one or more of the following mechanisms:
- An adequacy decision by the European Commission recognising the destination country as providing an equivalent level of data protection.
- Standard Contractual Clauses (SCCs) in the form approved by the European Commission, entered into with the recipient (Art. 46(2)(c) GDPR).
- Another appropriate safeguard under Art. 46 GDPR, such as Binding Corporate Rules (BCRs), where applicable.
Our website and marketing tools involve transfers to providers established in the United States, including our website hosting, analytics, advertising and CRM providers. These transfers are made under the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and are additionally covered by Standard Contractual Clauses.
We continuously monitor developments in EU data protection law and update our transfer mechanisms accordingly.
07·Cookies
When you use our website and Platform, we use cookies and similar tracking technologies.
Strictly necessary cookies
Required for the website and Platform to function and remain secure. No consent is needed for these (Ch. 9 § 28, Electronic Communications Act 2022:482).
Analytics and performance cookies
Used to understand how you use the website and Platform and to improve your experience. We ask for your consent before placing these (Ch. 9 § 28 LEK; Case C-673/17, Planet49). Withdraw or manage consent at any time via our cookie manager.
Marketing cookies
Used to measure the effectiveness of our campaigns and to show you relevant content on third-party platforms. We ask for your consent before placing these, and you may withdraw it at any time via our cookie manager.
Cookies we use
For the current, complete list of the cookies we use, please see our Cookie Manager.
08·Data security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, loss and misuse. These measures are reviewed regularly and adapted to current industry standards.
Please note that transmission of data over the internet carries inherent risk. Unencrypted communication, such as standard email, may be readable by third parties. We recommend not sending sensitive information to us by unencrypted email.
09·Your rights
Under the GDPR, you have the following rights. To exercise any of them, please contact us using the details in Section 10.
Right of access
You may request confirmation of whether we process your personal data and receive a copy of that data (Art. 15 GDPR).
Right to rectification
You may request that we correct any inaccurate personal data we hold about you (Art. 16 GDPR).
Right to erasure
In certain circumstances, you may request that we delete your personal data, for example, where it is no longer needed for the purpose it was collected, or where you withdraw your consent (Art. 17 GDPR).
Right to object
You may object to processing that is based on our legitimate interests (Art. 21 GDPR).
Right to restriction
In certain circumstances, you may request that we restrict our processing of your data (Art. 18 GDPR).
Right to data portability
You may request a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format (Art. 20 GDPR).
Right to withdraw consent
Where processing is based on your consent, you may withdraw that consent at any time. This does not affect the lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR).
Right to lodge a complaint
If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).
10·Contact us
|
Data Controller
Float Lending AB Nybrogatan 55 114 40, Stockholm Sweden privacy@floatfinance.com |
External Data Protection Officer
Kertos GmbH Brienner Str. 41, 80333 Munich Data Protection Officer: Dr. Kilian Schmidt +49 151 525 797 93 dsb@kertos.io |
This policy may be updated from time to time. We will publish any changes at www.floatfinance.com. The current version is always available on www.floatfinance.com.
