You can request access to the information we hold about you, with some limited exceptions for example confidential information or trade secrets, internal drafts and memos. We will also inform you about:

• why we are processing the information.
• who we are sharing the information with and if any information is transferred to a country not deemed to have adequate safeguards in place to protect personal data.
• how long we will be keeping the information.
• the source of the information, if it was not collected directly from you; and
• if we are using the data for automated decision making or profiling.

If you make a request for a copy of the personal information that we are processing, please be as specific as possible as this will help us to identify the information more quickly.

If you feel that the information we hold about you is inaccurate, you can ask us to correct and update it. If we have shared the personal data with a third party, we will inform such third parties about the corrections.

You can also request that we erase information. Erasing might not always be possible. If doing so means we cannot perform our contract with the corporate customer, or we have a legal obligation or legitimate interest to keep the information. We will explain the consequences of erasing your information.

If you feel that we are processing the information unlawfully or with inaccurate information, you can request us to restrict the processing. Where personal data is subjected to restriction in this way, we will only process it with your consent or for the establishment, exercise or defence of legal claims unless we have your consent. If the processing is restricted, we will continue to store the information.

If you disagree with any legitimate interest, we have relied upon to process the information, you can object to the processing. We will then stop processing the information unless we can demonstrate a compelling legitimate basis that overrides your rights, or the processing is required to establish, exercise or defend a legal claim.

You have a right to object to direct marketing.

If we process your personal data based on your consent, you may withdraw your consent using the same channels as were used when consent was given.

You have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format and to transmit that data to another controller where technically feasible. The right to data portability does not apply if the information:

• is only available in paper form or as a scanned document in SEB Kort's electronic archive
• would infringe the rights of someone else
• does not come directly from individual; or
• is created for internal use through analysis or evaluation.

You have the right to complain to us as data controller regarding the processing of your personal information. Please reach out to us via the provided contact details in the last section of this notice.

You can always reach out to your local data protection authority.

Reasons for processing your personal data

We measure feature performance, diagnose crashes, and understand general usage patterns to make better design and technical decisions. Reports are aggregated/pseudonymized where possible.

Legal basis

The processing is based on our legitimate interest.

Where local law requires consent for cookies or similar technologies, analytics will only run after your consent is given, and you can change your cookie settings at any time.

Categories of personal data collected from you

Technical and digital usage information including IP address, device type, and operating system. Cookies and digital tracking information including geographic location, usage and interaction with our websites.

Essential for basic website functions (e.g. session management, load balancing). Examples include: ASP.NET_SessionId, load balancer tokens, CSRF prevention tokens, CookieConsent. If you block these cookies, parts of the website will stop working airplus.com.

Necessary cookies are stored either only for your session (“Session Cookies”) or persist across visits (“Persistent Cookies”).

Enable personalization and enhanced features, such as showing relevant content based on your activity or saving form progress.

Help us gather anonymized analytical data to understand usage patterns and improve the site experience. Examples include Adobe Analytics cookies like s_vi, s_fid, and c_campaign. All collected data is aggregated and anonymized before analysis.

We use Adobe Analytics to analyse user behaviour across our websites. This allows us to understand usage patterns and improve the user experience.
Data processed through Adobe Analytics may include:

• IP address (shortened/pseudonymized where possible)
• Device type, browser, and operating system
• User journey and interaction data (e.g., page views, clicks)

Our websites use HubSpot, a web analytics and marketing automation service provided by HubSpot Inc. (Cambridge, MA 02141, USA). The service enables AirPlus to analyse website usage through statistical evaluations and supports the continuous improvement of inbound marketing activities. For this purpose, HubSpot places cookies on your device.

Data processed through HubSpot may involve:

• Name and contact details
• Communication preferences
• Website interactions and form submissions
• Email engagement metrics (e.g., opens, clicks)

We may share your data with auditors, insurance companies, lawyers, and public authorities as required by law, such as audits, insurance claims, legal proceedings or regulatory compliance.

We will share personal data about you with other legal entities and affiliates within the SEB Group for purposes such as:

• To be able to provide as good service to you as possible and act as one payment service provider

Personal data will be transferred to countries outside of the European Union or the European Economic Area (“third countries”) only to the extent required for the respective purpose or mandated by law. Prior to any transfer of personal data to processors or third parties in third countries, we ensure that a transfer mechanism is in place (e.g. adequacy decision or Standard Contractual Clauses provided by the European Commission).