Privacy notice

For Website Visitors of AirPlus.com & Customers of our Secure Digital Online Account Portals

At airplus.com, your privacy is our priority. Which is why the processes on our website are designed to ensure the protection of your personal data. Any Business Activity conducted by AirPlus Intl. GmbH, SEB Kort AB or its subsidiaries serves a specific purpose. No Data is collected or stored longer than necessary and as explained in this notice. Please feel free to contact us should you require any specific information about data processing activities that we have missed out here. We are committed to protecting your personal data and being transparent about how and why we collect and process it.

This website is jointly controlled by SEB Kort Bank AB (“SEB Kort”) and AirPlus International GmbH (“AirPlus”) (collectively referred to as “we”, “us”, or “our”).

1. Who We Are – Joint Controllers of AirPlus.com’s Data Processing Activities

Both SEB Kort AB and AirPlus International GmbH jointly determine the purposes and means of processing your personal data when you use airplus.com. For all processing activities described in this notice, both companies are considered joint controllers under Article 26 of the General Data Protection Regulation (GDPR).

For more information or to exercise your rights, you can contact either of us:

SEB Kort Bank AB in Stockholm, Sweden
Secure Contact Form via log in for cardholders on airplus.com or the AirPlus App.
Customer Service: +468146737; dataskyddsombud@seb.se,

AirPlus International GmbH in Neu-Isenburg, Germany
Email: dataprotection@airplus.com

AirPlus Intl. GmbH & SEB Kort AB are jointly responsible for:

• Technical operation of AirPlus.com and the collection of personal data through related digital infrastructure such as Analytics or Direct Marketing.
• Handling of website contact forms and customer service requests.
• Aggregated analytics for product and service improvement

SEB Kort & AirPlus are not jointly responsible for

• any links or directions towards customer account portals. An online customer account portal is a secure online digital platform where customers can log in to manage their accounts with each party.
• any direction towards App usage, and while briefly explained in this notice their purposes remain independent to each party.
• any other data collection & processing activities conducted by the parties that are not part of hosting airplus.com

2. What Personal Data We Collect

When you interact with us via our website, app, or online contact forms, we may collect:

a) Communication Data

• Emails and messages exchanged with our customer service teams. Those are collected through our secured channels via the website forms when you submit a request to us for the purpose to serve your request and provide a transparent and helpful customer service.

b) Technical and Digital Usage Data

• Identification Data: IP address, device type, and operating system.
• Digital Tracking Information: Your geographic location and how you interact with our services.
• Data on your use of our website, logged-in environments, and apps to allow for aggregated analysis.

c) Cookie Data

• Our websites use cookies to enhance your user experience. Cookies are small text files stored on your device. See our Cookie Policy for more details and how to manage your preferences.

3. Why We Process Your Data (Legal Basis and Purposes)

We process your personal data for the following purposes:

Keep the service secure and prevent fraud — Legitimate interests
We monitor for suspicious activity, protect accounts, prevent misuse, and investigate incidents. This can include log files, IP/device signals, rate-limiting, and security alerts. We may share minimal data with payment/security partners or authorities when legally required.

Analyze aggregated usage to improve the product (cookies & analytics tools) — Legitimate interest/Consent where applicable.
We measure feature performance, diagnose crashes, and understand general usage patterns to make better design and technical decisions. Reports are aggregated/pseudonymized where possible.
Note: Where local law requires consent for cookies or similar technologies, analytics will only run after you consent, and you can change your cookie settings at any time.

Communicate with you about your account (customer service & contact forms) — Consent
We process your contact details and message history to respond to inquiries, resolve issues, send service notifications (e.g., outages, security alerts, changes to terms), and document support interactions.

Provide and improve our digital services (online accounts & app) — Contract necessity
We use your data to create and manage your account, authenticate you, maintain sessions, deliver core features, fix bugs, and roll out updates that keep the service reliable and usable.

Send app notifications (you can opt out any time) — Consent
With your permission, we send non-essential push notifications (e.g., tips, reminders, offers). You can withdraw consent via your device or in-app settings at any time. We use your app installation ID and push token to deliver messages.

4. Data Sharing and Transfers

Your data may be shared with the following Service providers and technical support partners:

Within the SEB Group

Your personal data may also be shared within the SEB Group for legitimate internal purposes, such as business strategy development, internal reporting, service optimization, compliance, and risk management. Any such sharing is carried out under strict access controls and confidentiality obligations to ensure that your information is only used where necessary and in line with applicable data protection requirements.

HubSpot (CRM/Marketing) & Newsletters

This website uses HubSpot, a web analytics and marketing automation service provided by HubSpot Inc. (Cambridge, MA 02141, USA). HubSpot enables AirPlus International to analyze website usage through statistical evaluations and supports the continuous improvement of inbound marketing activities. For this purpose, HubSpot places cookies on your device. You can prevent the use of cookies by adjusting your browser settings accordingly. Further information is available in HubSpot’s Terms of Service and Privacy Policy. Data Transfers to HubSpot in the US fall under the adequacy decision of the EU commission.

We use HubSpot to manage customer relationships, marketing campaigns, and contact forms. This may involve the processing of your:

• Name and contact details
• Communication preferences
• Website interactions and form submissions
• Email engagement metrics (e.g., opens, clicks)

Legal Basis of data processing activities through HubSpot

• Consent (Article 6(1)(a) GDPR) for signing up to Newsletters.
• Legitimate interest (Article 6(1)(f) GDPR) in maintaining customer relationships and improving communications

HubSpot Inc. is based in the U.S. Data is transferred under the adequacy decision with the US or within servers in the EU.

Adobe Analytics (Web Analytics)

We use Adobe Analytics to analyze user behavior across our website and digital platforms. This allows us to understand usage patterns and improve the user experience.

Legal Basis for Web Analytics:

• Consent (Article 6(1)(a) GDPR) for launch of analytics cookies.
• Legitimate interest (Article 6(1)(f) GDPR) for aggregated usage reporting

Data transfer:

Adobe may process data on servers outside the EU/EEA in cases of support matter. In such cases, Adobe relies on Standard Contractual Clauses (SCCs) and other safeguards.
Information sent outside the SEB Group is encrypted end-to-end. Furthermore your personal data may be shared with any regulatory or supervisory authorities when legally required.

Data processed through Adobe Analytics may include:

• IP address (shortened/pseudonymized where possible)
• Device type, browser, and operating system
• User journey and interaction data (e.g., page views, clicks)

5. Online Account Portal

An online customer account portal is a secure online digital platform where customers can log in to manage their customer accounts with each party if they are conducting business with either party.

Any access to the online account portals remain under independent controllership of both companies. Depending on your customer relationship and the account you hold, each of the controller is independently responsible for any activity that occurs outside of the publicly available access of airplus.com

You can register on our customer portal to use additional features. We use the data you enter to do this only for authentication purposes. The required information requested during the registration process must be provided in full. Otherwise, we will reject the registration.

We will use the e-mail address provided during the registration process to communicate with you regarding important changes that concern things like the range of products and services we offer or changes that are necessary for technical reasons.

Within the scope of operation of the app, we process your personal data to provide you with various features relating to your Account after you install the app on your smartphone. The app mainly provides the same features as the portal. For example, you can use the app to manage your data and review them at any time. Further information can be found in the data protection notice that has been provided to our customers and card holders.

App Data and Push Notifications

If you download our app, we may send push notifications to your device, such as: confirmation of purchases, alerts about incorrect PIN codes, or notifications of denied transactions. You can manage these in your device settings . In order to provide push notifications within our mobile applications, we (through our appointed service provider) process certain identifiers that enable messages to be delivered to the correct device. Specifically, the personal data categories processed are the App Installation ID and the Push Token generated by the device. The processing of Push Tokens is a standard technical practice used to facilitate the delivery of notifications to app users.
The lawful basis for this processing is the user’s consent, which can be withdrawn at any time via the app or device settings.

6. Cookies

Our websites use cookies—small pieces of information stored on your device—to improve your user experience, maintain security, and enable key functionality airplus.com. You can find our cookie policy here.

Types of Cookies and Their Purposes

Necessary Cookies

• Essential for basic website functions (e.g., secure logins, session management, load balancing)
• Examples include: ASP.NET_SessionId, load balancer tokens, CSRF prevention tokens, CookieConsent
• Stored either only for your session (“Session Cookies”) or persist across visits (“Persistent Cookies”)
• If you block these cookies, parts of the website will stop working airplus.com

Functional Cookies

• Enable personalization and enhanced features, such as showing relevant content based on your activity or saving form progress
• Provided by SEB Kort or trusted partners airplus.com

Performance Cookies

• Help us gather anonymized analytical data to understand usage patterns and improve the site experience
• Examples include Adobe Analytics cookies like s_vi, s_fid, and c_campaign
• All collected data is aggregated and anonymized before analysis airplus.com

Cookie Types: Session vs. Persistent

• Session Cookies – deleted when you close your browser; used for functions like form submissions and online transactions.
• Persistent Cookies – remain on your device after closing browser; used to recognize repeat visits or save preferences airplus.com

Cookies in Card-Based E-Commerce

• During online card transactions, secure commerce systems (e.g. 3 D Secure) may set cookies from third-party sites to enhance transaction security and save your settings airplus.com

Consent & Managing Your Cookie Preferences

• You can grant or decline consent for non essential cookies via our cookie banner or settings panel. Preferences are retained for 12 months .
• Blocking cookies may limit functionality like retained settings or transaction services.
• You may also disable cookies through your browser settings—refer to your browser’s support resources for instructions.

7. How Long We Keep Your Data

We retain personal data only as long as necessary for the outlined purposes or as required by law. Retention periods vary depending on the data type and legal obligations.
Cookie informations are retained for 12 months.

8. Your Rights Under the GDPR

SEB Kort and AirPlus will support you to execute your data protection rights. You can contact either party for any questions. Nordics customers and visitors to the Nordics pages of airplus.com are advised to reach out to SEB Kort AB through the above provided contact details. For AirPlus newsletter subscribers please reach out to dataprotection@airplus.com.

You have the right to:

• Access your data - You have the right to request confirmation as to whether your personal data is being processed and obtain a copy of such data together with information about the purposes of processing, categories of data, and recipients.
• Rectify inaccuracies - You have the right to request that inaccurate or incomplete personal data concerning you be corrected without undue delay.
• Request erasure - You can request the deletion of your personal data, in particular where the data is no longer necessary for the purposes for which it was collected, or where you have withdrawn your consent.
• Restrict processing - You can request that the processing of your data be limited, for example while the accuracy of the data is being verified or when you object to processing.
• Data portability - You have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format and to transmit that data to another controller where technically feasible.
• Object to processing – You can object at any time, on grounds relating to your particular situation, to the processing of your personal data where such processing is based on legitimate interests or carried out for direct marketing purposes.
  Withdraw consent at any time - Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

9. Supervisory Authority Contact

If you're unsatisfied with our data handling, you can contact: Your local supervisory authority in your jurisdiction. Details can be found on EDPB.com or the website of your local data protection authority.

10. Updates to this Privacy Statement

We may update this privacy statement from time to time. We encourage you to review it periodically.

Review: 15.08.2025