This Privacy Policy describes how we collect and use personal data ("data"). In order to make our offers, cashbacks and interactions with users more relevant, we collect certain data about our users. By looking at the historical usage and behavior patterns, we can deliver a more personalized experience to you as a user.

Rabble Communications AB, reg. no. 556807-2424, ("Rabble") is the data controller for the processing of your personal data described below. This means that for the purposes of applicable data protection legislation, Rabble is responsible for your personal data and determines how and why your personal data is to be processed. If you have any questions regarding Rabble's processing of personal data, please do not hesitate to contact us at info@rabble.se.

HOW WE COLLECT DATA

We collect your personal data:

• When you create a user account with us.
• Via our website, app, or browser extension, including through cookies and similar technologies.
• Through e-mail correspondence.
• When you provide us with data through meetings, social media, events, or otherwise in the course of our business relationship with you.

WHAT DATA WE COLLECT

Personal data that we process:

• Basic information such as name, age and gender
• Contact information such as email address and telephone number
• Information about how you use our website and app.
• Technical data, which may include your URL, IP address, unique device ID, network and computer performance, browser type, language and identifying information, geographic location, device type, and operating system.
• E-mail correspondence.
• If you create your user account through Facebook or Apple: name, age and gender and profile picture (if you agree to the collection of this data)
• Where applicable, bank account information and transaction details (including receipts or other proof of purchase).
• When you use our browser extension: information about which of our partner stores you visit, in order to show you relevant offers. To ensure that your cashback is registered correctly, the extension also reads technical information on the partner store's own pages (e.g. cookies, referring page, and URL). This information is processed exclusively locally in your browser and is never transferred to Rabble or any third party.

HOW WE HANDLE DATA ABOUT YOU AS A USER OF OUR SERVICE

Below is a description of the purpose, the legal basis and the storage period for the processing of your data for you who have created a user account with us.

Purpose. To administer your user account and provide the service. Legal basis. Performance of a contract. The processing is necessary for the performance of the membership agreement between you and Rabble. Retention period. As long as you have a user account with us.

Purpose. To market our, and our advertisers', products and services through, for example, newsletters and push notifications and to provide relevant content for you. Legal basis. Legitimate interest. Rabble's legitimate interest in promoting its, and its advertisers', products and services. Retention period. As long as we have a business relationship with you or until you opt out.

Purpose. To comply with legal obligations. Legal basis. Comply with a legal obligation. Rabble's legal obligations, for example, due to applicable accounting and tax legislation. Retention period. As long as stipulated in the applicable law.

Purpose. To prevent misuse of the service. Legal basis. Legitimate interest. Rabble's legitimate interest in preventing misuse of the service. Retention period. As long as you have an account with us.

Purpose. To establish, defend or assert legal claims, such as to demand performance or enforcement from public authorities or courts. Legal basis. Legitimate interest. Rabble's legitimate interest in establishing, defending or asserting legal claims. Retention period. Information relevant to legal claims is retained for as long as such claim can be asserted in accordance with applicable law.

Purpose. To ensure the technical functionality of our website and app; and to analyze your usage so that we can develop and improve the website and app. Legal basis. Performance of a contract. Processing such as the collection of data necessary to provide you with the benefits you wish to utilize is necessary to fulfil the membership agreement between you and Rabble. Legitimate interest. Rabble's legitimate interest in ensuring the technical functionality of the website and app. Consent. Processing that is not necessary to provide the website and app will only take place if you have given your consent to this. Retention period. Cookies are stored until they are deleted. Please refer to your browser's help function for information on how to avoid and delete cookies.

HOW WE HANDLE DATA ABOUT YOU AS A COMPANY REPRESENTATIVE

Below is a description of the purpose, legal basis and storage period for the processing of your data for you as a representative of a company, e.g. an advertiser or partner.

Purpose. To market our products and services through, for example, newsletters and push notifications and to provide relevant content for you. Legal basis. Legitimate interest. Rabble's legitimate interest in promoting its products and services. Retention period. As long as we have a business relationship with you or until you opt out.

Purpose. To manage our business relationship with you. Legal basis. Performance of a contract. If there is a contract between you and Rabble. Legitimate interest. Rabble's legitimate interest in maintaining and managing its business relationships. Retention period. As long as we have a business relationship with you or the company you represent.

Purpose. To comply with legal obligations. Legal basis. Comply with a legal obligation. Rabble's legal obligations, for example, due to applicable accounting and tax legislation. Retention period. As long as stipulated in the applicable law.

Purpose. To establish, defend or exercise legal claims, such as to demand performance or enforcement from public authorities or courts. Legal basis. Legitimate interest. Rabble's legitimate interest in establishing, defending or exercising legal claims. Retention period. Information relevant to legal claims is retained for as long as such claim can be asserted in accordance with applicable law.

Purpose. To ensure the technical functionality of our website and app; and to analyze your usage so that we can develop and improve the website and app. Legal basis. Legitimate interest. Rabble's legitimate interest in ensuring the technical functionality of the website and app. Consent. Processing that is not necessary to provide the website and app will only take place if you have given your consent to this. Retention period. Cookies are stored until they are deleted. Please refer to your browser's help function for information on how to avoid and delete cookies.

HOW WE SHARE YOUR DATA

We may disclose or share your information with:

• Social media such as Instagram, TikTok, Facebook, LinkedIn or X (Twitter) to promote our services. If you use these services, we refer to the privacy policy of the respective service for information on how they handle personal data about you as a user.
• Collaboration partners (companies that provide the products or shops which are covered by cashback or other offers through our services).
• Auditors and other professional advisors.
• Service companies and suppliers, for example, Rabble uses OpenAI's services for automated scanning of receipts, as well as other external IT services for data storage.
• Other third parties when it is necessary to comply with a legal obligation or to establish, assert or defend legal claims.

We strive to keep all of your data within the EU/EEA. However, some of Rabble's IT providers operate in the United States. When personal data is shared with these providers, Rabble has ensured that the level of protection corresponds to that applicable within the EU/EEA through the suppliers' accession to the EU-U.S. Data Privacy Framework ("DPF"). More information about DPF is available on https://www.dataprivacyframework.gov/s/. For any entities which have not acceded the DPF, the European Commission's standard contractual clauses are applied for the transfer.

If we transfer your personal data outside the EU/EEA, such transfer will be subject to appropriate safeguards in accordance with applicable data protection legislation.

HOW WE PROTECT YOUR DATA

We use a range of technical and organizational measures to protect your data from unauthorized access, use, loss, alteration or deletion in accordance with applicable data protection legislation. Such measures include, but are not limited to, physical controls, encryption, permission restrictions, and internal policies.

YOUR RIGHTS

In its capacity as data controller, Rabble is responsible for ensuring that your personal data is processed in accordance with applicable legislation.

Rectification. Rabble will, at your request or on its own initiative, correct, de-identify, delete or supplement information that is found to be incorrect, incomplete or misleading. You are always entitled to request that we correct or update your personal data.

Deletion. You have the right to request erasure of your personal data (e.g. if your data has been stored longer than necessary). Rabble will notify each recipient to whom the personal data has been disclosed of any deletion of data that takes place under this section. You can delete your account by clicking on this link and following the instructions: https://www.rabble.com/account-deletion.

Restriction. You have the right to request restriction of further processing of your personal data (e.g. if you question the accuracy of the personal data). Rabble will notify each recipient to whom the personal data has been disclosed of any restriction of processing of data that takes place under this section.

Objections. You have the right to object to processing of your data that takes place on the legal basis that we have a legitimate interest. Unless there are compelling legitimate reasons that justify continued processing despite your objection, Rabble will cease the processing.

Data portability. You have the right to data portability, i.e. the right, under certain conditions, to receive and transfer your personal data in a structured, commonly used and machine-readable format to another data controller.

Direct marketing. If you do not want Rabble to process your personal data for direct marketing purposes, you have the right to notify Rabble of this in writing at any time. Once Rabble has received your notification, Rabble will cease to process the personal data for this marketing purpose.

Access. You have the right to receive an extract from Rabble free of charge with information about how we process your data. The extract contains, among other things, information about the purposes for which we use your personal data, to which recipients the data has been disclosed and for how long the data will be stored or the criteria used to determine this period. You also have the right to receive a copy of your personal data. In the event that the data has not been collected directly from you, you also have the right to receive information about where it has been obtained from.

Consent. If you have given your consent for a particular processing of personal data, you have the right to withdraw your consent at any time. If you choose to withdraw your consent, Rabble will stop the processing covered by the withdrawal and delete your data, unless there is another lawful purpose or legal basis that justifies further processing. Please note that withdrawing your consent does not affect the lawfulness of any processing carried out before the withdrawal.

Right to lodge a complaint with a supervisory authority. You are welcome to contact us if you have any complaints regarding our processing of your personal data, so that we can correct our processing if necessary. You also have the right to submit any complaints regarding Rabble's processing of your personal data to the Swedish Authority for Privacy Protection (IMY), or another competent supervisory authority within the EU/EEA.

COOKIES

A cookie is a text file that the web server you visit places on your computer. We use cookies for a variety of purposes. Some cookies are necessary to provide our services, other cookies are used for statistical or marketing purposes.

Rabble's website uses both so-called session cookies and persistent cookies. Session cookies are only stored during the time you visit the website, while persistent cookies are stored even after you leave the website (but for a maximum of 2 years).

If you do not wish to receive cookies, you can find information on how to prevent your browser from accepting new cookies in the "Help" section of most browsers. Depending on the browser you use, you may also be able to set your browser to notify you when you receive a new cookie. Furthermore, you can disable or delete similar data used by browser add-ons, such as Flash cookies, by changing the add-on's settings or visiting the manufacturer's website.

CHANGES TO THIS PRIVACY POLICY

Rabble reserves the right to make changes to this Privacy Policy from time to time. If material changes to the Privacy Policy are made, Rabble will notify you of such changes by email, provided that Rabble has your email address, or by other means if possible.

HOW TO CONTACT US

Please do not hesitate to contact us if you have any questions regarding this Privacy Policy or the handling of your data, or if you wish to exercise any of your rights under applicable data protection legislation. You can contact us here: info@rabble.se.

This policy is also available in other languages:

• English: https://www.rabble.se/privacy-policy-english
• Svenska: https://www.rabble.se/privacy-policy
• Dansk: https://www.rabble.dk/privatlivspolitik
• Norsk: https://www.rabble.no/personvernerklaering
• Suomi: https://www.rabble.fi/tietosuojakaytanto