Privacy Policy

01·Who we are

Float Lending AB, org. no. 559100-4907 ("we", "us", "our") provides business account services and are developing data insight services. We also operate the website www.floatfinance.com. We are part of the same corporate group as Float Finance AB.

A note on the Business Accounts: To provide our business account, we partner with Airwallex that provides the underlying financial services. When you activate and use the Wallet, you enter into a separate agreement directly with Airwallex, who acts as an independent data controller for the personal data they process to deliver that service - including data required for customer due diligence under the Anti-Money Laundering Act. As part of delivering the business account service, Airwallex shares Account Data with us as an independent data controller, including account balance, transaction history and payor/payee information relating to your business account. We use this data to display your account information and provide the business account through the Platform. We strongly recommend reading Airwallex's Privacy Policy: https://www.airwallex.com/global/terms/privacy-policy.

02·What we collect and why

The table below sets out the personal data we process, the purpose for which we process it, and the legal basis we rely on under the GDPR.

03·Where we get your data

Most personal data comes directly from you, when you sign up for a business account or use the Platform.

Connected accounting systems

Where you choose to connect an accounting system through the Platform, we obtain financial data from that system to generate key performance indicators. The data obtained may include revenue, costs, account balances, and transaction categorisation.

Connected bank accounts

Where you choose to connect a bank account through the Platform, we obtain transaction data and account balance information via a licensed account information service provider. The data obtained is used to generate key performance indicators and financial insights within the freemium tier.

Connected subscription billing systems

Where you choose to connect a subscription billing system through the Platform, we obtain subscription and revenue data from that system. This data may include information about your own customers, such as subscriber names and contract values. You remain responsible for the data you make available to us in this way, as set out in our Terms and Conditions.

Data obtained: Subscriber names, subscription values, billing periods and contract status.

Airwallex

As part of delivering the business account service, Airwallex shares Account Data with us as an independent data controller, including account balance, transaction history, and payor/payee information relating to your business account. We use this data to display your account information and provide the business account service through the Platform.

Publicly available sources and official registers

To verify company and representative information where relevant to the business account. We access these registers through a Swedish company information provider acting as our data processor.

Sources: Bolagsverket (Swedish Companies Registration Office), Skatteverket (Swedish Tax Agency)

Data obtained: Authorised signatories, board members, beneficial ownership information, and where required to identify a representative, the national identity number.

B2B data providers

To keep company and contact records accurate and to prioritise sales outreach, we obtain additional business information about companies and their representatives from publicly available sources and from commercial B2B data providers.

Data obtained: Company information such as industry, size and location, and professional details such as role and function.

04·How long we keep it

We keep your personal data only for as long as necessary for the purpose it was collected, or as required by law.

Business account - contractual data

Kept for the duration of the business account relationship and thereafter for the period needed to handle complaints or legal claims; typically up to 10 years under the Limitations Act (Preskriptionslagen).

Consent-based data

Website and Platform analytics data, and marketing communications data, are kept until you withdraw your consent (Art. 7 GDPR). Withdrawal does not affect anything processed before that point. Session recordings are deleted after 30 days.

Sales and lead management data

Kept for as long as the business relationship or prospective business relationship is active, and thereafter for up to 3 years from the last meaningful interaction, unless you object sooner.

Website and application logs

Operational logs are kept for up to 40 days. A limited set of administrative and security audit logs is retained for up to 400 days so that we can investigate security incidents and demonstrate the integrity of our systems.

Accounting records

Data that constitutes accounting records must be retained for 7 years following the end of the calendar year in which the financial year to which the records relate was completed (Ch. 7 § 2, Swedish Bookkeeping Act, Bokföringslagen 2004:125).

05·Who we share with

We only share your personal data where necessary and lawful. We never sell your data. The categories of recipients are:

Airwallex

Float Lending AB and Airwallex each act as independent data controllers, there is no joint controllership between them. We share personal data with Airwallex in two directions:

Float Lending AB to Airwallex: We share Account Data and business account onboarding information with Airwallex for Airwallex's own purposes, including enabling the provision of Connected Account Services, AML/KYC compliance, and service administration.

Airwallex to Float Lending AB: Airwallex shares Account Data with us to enable us to operate and display the business account service through the Platform.

Both transfers are governed by Data Transfer Agreement incorporating the EU Standard Contractual Clauses (Commission Decision 2021/914). For the EEA, the applicable Airwallex entity is Airwallex (Netherlands) B.V.; for the UK, Airwallex (UK) Limited.

Float Finance AB

If you choose to apply for a business credit product through the Platform, we share the personal data relevant to your credit application with Float Finance AB. Float Finance AB acts as an independent data controller for the purposes of processing your credit application, performing customer due diligence, and managing the credit relationship. Their processing is described in the Float Finance AB Privacy Policy (available on www.floatfinance.com). The legal basis for this transfer is Art. 6(1)(b) GDPR, the transfer is necessary to take steps at your request prior to entering into a contract with Float Finance AB.

Bank connections

When you connect a bank account through the Platform, the connection is made through GoCardless, a licensed account information service provider. You accept GoCardless's own terms when you make the connection, and GoCardless acts as an independent data controller for the account information service it provides. We receive the resulting account, balance and transaction data on the basis of the consent you give in that flow.

Recipient: GoCardless Ltd, acting as an independent data controller for the account information service.

Accounting connections

When you connect an accounting system, the connection is made through an integration provider acting as our data processor. You authenticate directly with your accounting system inside the provider's interface; we never receive your accounting system credentials. We share your company name and the name and email address of the connecting user with the provider so that the connection can be established.

Recipients: Apideck B.V. (Netherlands), Zwapgrid AB (Sweden).

Service providers (data processors)

These vendors help us operate the Platform, the website and our services. They act only on our documented instructions and may not use your data for their own purposes (Art. 28 GDPR).

Infrastructure and hosting

Platform and product

Website, marketing and sales

Compliance and security

This list reflects the providers we use as at the effective date of this policy. We review it whenever we add or change a provider. If you would like the current list, including any sub-processors engaged by these providers, contact us at privacy@floatfinance.com.

Social media platforms

We maintain a company presence on LinkedIn. When you interact with that presence, LinkedIn processes your data for its own purposes and provides us with aggregated page statistics. For the processing of those statistics we and LinkedIn Ireland Unlimited Company are joint controllers under Art. 26 GDPR. LinkedIn takes primary responsibility for information obligations and for handling data subject rights, and you may exercise your rights directly against LinkedIn. The essential terms are set out in LinkedIn's Joint Controller Addendum. We have no influence over LinkedIn's independent processing.

Legal basis: Legitimate interests - Art. 6(1)(f) GDPR (communicating about our products and services).

Regulatory authorities

We may be required to share data with relevant authorities where required by law.

06·International data transfers

We prioritise EU/EEA-based service providers, and the Platform's servers, databases and file storage are located within the EU. In certain cases, a transfer to a country outside the EU/EEA is necessary, for example where a best-in-class provider operates outside the EEA. In all such cases, we ensure that adequate safeguards are in place in accordance with Chapter V GDPR before the transfer takes place. We do this through one or more of the following mechanisms:

• An adequacy decision by the European Commission recognising the destination country as providing an equivalent level of data protection.
• Standard Contractual Clauses (SCCs) in the form approved by the European Commission, entered into with the recipient (Art. 46(2)(c) GDPR).
• Another appropriate safeguard under Art. 46 GDPR, such as Binding Corporate Rules (BCRs), where applicable.

The providers established in the United States to which we transfer personal data are Webflow, Google, HubSpot, LinkedIn, Anthropic, Twilio (including SendGrid), GoDaddy and GitHub. These transfers are made under the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and are additionally covered by Standard Contractual Clauses. Where a recipient is not certified under the Data Privacy Framework, the transfer is made on the basis of Standard Contractual Clauses alone.

Some operational and security logging generated by our hosting provider is held in globally distributed infrastructure operated by Google rather than in a single region. That processing is covered by Google's Data Processing Addendum and the Standard Contractual Clauses incorporated into it.

We continuously monitor developments in EU data protection law and update our transfer mechanisms accordingly.

07·Cookies

When you use our website and Platform, we use cookies and similar tracking technologies.

Strictly necessary cookies

Required for the website and Platform to function and remain secure. No consent is needed for these (Ch. 9 § 28, Electronic Communications Act 2022:482).

Analytics and performance cookies

Used to understand how you use the website and Platform and to improve your experience. We ask for your consent before placing these (Ch. 9 § 28 LEK; Case C-673/17, Planet49). Withdraw or manage consent at any time via our cookie manager.

Marketing cookies

Used to measure the effectiveness of our campaigns and to show you relevant content on third-party platforms. We ask for your consent before placing these, and you may withdraw it at any time via our cookie manager.

Cookies we use

For the current, complete list of the cookies we use, please see our Cookie Manager.

08·Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, loss and misuse. These measures are reviewed regularly and adapted to current industry standards.

Please note that transmission of data over the internet carries inherent risk. Unencrypted communication, such as standard email, may be readable by third parties. We recommend not sending sensitive information to us by unencrypted email.

09·Your rights

Under the GDPR, you have the following rights. To exercise any of them, please contact us using the details in Section 10.

Right of access

You may request confirmation of whether we process your personal data and receive a copy of that data (Art. 15 GDPR).

Right to rectification

You may request that we correct any inaccurate personal data we hold about you (Art. 16 GDPR).

Right to erasure

In certain circumstances, you may request that we delete your personal data, for example, where it is no longer needed for the purpose it was collected, or where you withdraw your consent (Art. 17 GDPR).

Right to object

You may object to processing that is based on our legitimate interests (Art. 21 GDPR).

Right to restriction

In certain circumstances, you may request that we restrict our processing of your data (Art. 18 GDPR).

Right to data portability

You may request a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format (Art. 20 GDPR).

Right to withdraw consent

Where processing is based on your consent, you may withdraw that consent at any time. This does not affect the lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR).

Right to lodge a complaint

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

10·Contact us

This policy may be updated from time to time. We will publish any changes at www.floatfinance.com. The current version is always available on www.floatfinance.com.