1. About this privacy policy

This Privacy Policy applies to the processing of personal data by Spenn Group AS (hereafter referred to as "Spenn Group", "we", or "us") when you are in contact with us and in connection with your use the Spenn loyalty currency (“Spenn”), earned through our partners. This Privacy Policy does not apply when you download the Spenn App and become a Spenn User. Personal data means any information relating to an identified or identifiable natural person. This policy includes information on your data protection rights and how we process your personal data. In the Privacy Policy, we use terms from the GDPR, for example "processing", "controller" and "data processor". You can find more information about the terms on the Norwegian Data Protection Authority's website (www.datatilsynet.no).

2. Who is responsible for processing your personal data?

Spenn Group is the controller of the personal data we process. This means that we are responsible for ensuring that the processing is compliant with the data protection legislation. We would like to hear from you if you have questions or objections to how we process your personal data, or if you wish to exercise your rights. You can contact our data protection officer by: privacy@spenngroup.com

Our contact information is: • Business name and registration no.: Spenn Group AS, 932 435 888 • Address: Inkognitogata 33, 0256 OSLO, Norway • E-mail: privacy@spenngroup.com.

Please note that the providers of the loyalty programs that issue Spenn, are solely responsible for their own processing of your personal data unless otherwise specified. For information on your rights and how to exercise them, see section 8 below.

3. The Spenn loyalty currrency

By being a member of Partner you can earn and use Spenn. Note that Spenn is an addition to and does not replace the partners' loyalty programs. See our Terms & Conditions (www.spenngroup.com / terms_members) for further details about Spenn.

4. What personal data do we process and for which purposes?

When we process your data, we must have a legal basis. We are only allowed to processed personal data for specific purposes. We will process personal data as necessary for (i) the performance of Terms, (ii) any consents granted from Spenn Users, (iii) Spenn Group’s legitimate interests; and (iv) Compliance with Spenn Group’s legal obligations.

The table below is an overview of the the categories of personal data we process, our purposes and legal bases. The subsequent sections provide further explanations.

Category: User data.

The data collected and utilized varies depending on the type of Partner program you may be associated with. This may include your: • Partner ID • Member_ID • Status • First name • Last name • Email address • Phone number • JoinDate • Domicile Currency. The purpose: Set up and manage your Spenn Account (4.1) Legal bases: Contractual necessity

Category: Consent data.

Information regarding the consents and permissions you have provided, particularly related to marketing communications, data sharing, and other preferences. This may include: • Records of your consent to receive marketing from Spenn and/or our partners. The purpose: Marketing purposes (4.3) Legal bases: Consent

Category: Transactional data

Details related to your transactions. This data is vital for processing payments, delivering services, and maintaining accurate records of your activities. This may include: • Item or service purchased (e.g., flight ticket, hotel booking) • Purchase date and time • Transaction amount • Currency used in the transaction • Payment method (e.g., credit card, debit card, points redemption) • Payment status (e.g., completed, pending, refunded) • Booking or reference number • Number of Spenn points earned through the transaction • Number of Spenn points redeemed or burned. The purpose: Set up and manage your Spenn Account (4.1) Legal bases: Contractual necessity We do not take any decisions with legal or similar material effect based on fully automated processing of your personal data.

4.1 Earning and use of Spenn

We will process data received from our partners to issue Spenn to you, and information about your use of Spenn, to ensure that the correct amount of Spenn is deducted from your account when you use Spenn. The types of personal data that is processed includes: User data, transactional data The processing described in this section is necessary for the performance of our agreement with you (the Terms).

4.2 We process personal data to communicate with you

4.2.1 When you contact our Customer Service

When you contact us through email or other channels, we will process personal data about you. The personal data we typically collect will includes: User Data and any other information you provide to us, which is necessary for us in order to respond to you. Our legal ground for this processing is our legitimate interest. The legitimate interest is our need to be able to respond to you.

4.2.2 Send you important messages concerning our services

We have an obligation to keep you updated on changes and updates to our services, which includes Terms and Conditions, Privacy Policy, and other technical and security-related messages. This information can be given through different channels, such as email. These communications are essential, so you cannot opt out of receiving them. The types of personal data that is processed includes: User Data. The processing described in this section is necessary for the performance of our agreement with you (the Terms).

4.2.3 For our analytics, forecasting, and reporting purposes

We measure and analyze how our services perform, preparing internal reports that inform business decisions, marketing campaigns, and product development. We use de-identified and/or aggregated information for this purpose. The types of personal data that will be processed for this purpose includes: User Data, transactional Data. The legal basis for our processing is our legitimate interest in improving and developing Spenn services and user experience.

4.3 We process personal data for marketing purposes

The purpose of this processing is to send you news, offers or ask you to register for the Spenn Platform.

4.4 We process data to comply with legal obligations

We are required by law to process personal data in certain cases, for instance to document compliance with obligations within tax, accounting or legal processes. In this connection, it may be necessary to process personal data about you. This could, for example, be necessary if your name is listed on an invoice or contract subject to retention obligations. The legal basis for such processing is the legal obligation to which we are subject. The information will be deleted when the purpose of the processing is fulfilled, such as for example where the reporting obligation is fulfilled, or we are no longer required to retain the information.

5. What is the source for the personal data we process?

The personal data we process is collected from our partners, who offer you the various loyalty programs using Spenn, ad partners and analytics service providers.

6. Who do we share your personal data with?

6.1 Data processors

Your personal data will be accessible to those of our suppliers who process personal data on our behalf. We have entered into data processing agreements which, among other things, mean that your personal data cannot be used for other purposes. Some of our suppliers are located in countries outside the EU/EEA. This means that personal data can be transferred or is accessible from a country with a regulatory framework that does not provide the same level of protection of personal data compared to the rules in Norway. To ensure your privacy, such transfer will only take place if we through other measures can ensure that your data enjoys the same level of protection as in the EU/EEA.

6.2 Our partners

Spenn Group’s partners will receive personal data of Spenn Users to the extent it is necessary to facilitate earning and use of Spenn, or other features of Spenn that require us to disclose personal data to partners. Data sharing between us and our partners will only happen to the extent this is legally permissible and required to implement, promote and operate Spenn. In some cases, Spenn Group and our partners will act as joint-controllers, and ensure your personal data is processed in accordance with the GDPR together. When this is the case, you will receive information on how we have allocated between us the responsibilities to safeguard your personal data.

7. When do we delete your personal data?

We will keep personal data received from you or our partners only for the duration necessary to fulfil the purposes for which it was collected. Upon request from you, we will promptly delete all personal data on you, as long as the data is not subject to any legal obligation requiring us to keep the data. Where our basis for processing is your consent, we will delete the information if you withdraw your consent. You can withdraw your consent at any time through the settings in the Spenn App, by following the procedure described in marketing emails or SMS received from us, or by submitting a request as outlined in section 8.

8. Your rights

You are entitled to the data protection rights listed below. Certain conditions must be met for them to be enforced and exceptions to the rights may also apply. You can read more on the Norwegian Data Protection Authority's website www.datatilsynet.no, in the GDPR chapter III and in chapter 4 of the Norwegian Personal Data Act.

• Access: you have the right to request information about how we process your personal data and to obtain a copy of that personal data. • Rectification: you have the right to request the rectification of inaccurate personal data about you and for any incomplete personal data about you to be completed. • Objection: you have the right to object to the processing of your personal data, which is based on our legitimate interests. • Erasure: you have the right to request the erasure of your personal data (subject to certain conditions). • Automated decision-making: you have the right not to have a decision made about you that is based solely on automated processing if that decision produces legal effects about you or significantly affects you. We do not use automated individual decision-making for such purposes. • Restriction: you have the right to ask us to restrict our processing of your personal data, so that we no longer process that information until the restriction is lifted. • Portability: you have the right to receive your personal data, which you have provided to us, in a structured, commonly used and machine-readable format and to have that information transmitted to another organisation in certain circumstances. • Withdraw consent: you have the right to withdraw your consent at any time for processing requiring consent.

To exercise any of these rights, please contact privacy@spenngroup.com. You can contact our Data Protection Officer for assistance with any questions or issues related to exercising your rights. The contact details for the Data Protection Officer is found in section 2. • Complaint: you have the right to lodge a complaint with the Data Protection Authority (Datatilsynet) if you have reason to believe that processing of your personal data does not comply with data protection legislation. Visit their website (www.datatilsynet.no) for information on how to lodge a complaint.

9. Changes to this policy

We update this privacy policy if there are changes in how we process personal data. You will always find the most recently updated privacy policy on www.spenngroup.com / privacy_members. We will inform you directly via our website and the Spenn App prior to any material changes to this policy. Date of last update: 08.10.2024