Privacy Statement

Privacy is very important to SprayPay. This privacy statement describes how and why SprayPay collects and uses your personal data. It also describes what rights you have and how to exercise them. Please feel free to contact us regarding privacy and the protection of your personal data by sending an email to: consument@spraypay.nl

By using SprayPay's services, you accept this privacy statement and the processing of your personal data by SprayPay. You agree that SprayPay uses electronic communication channels to send you information.

It is important that you read and understand this privacy statement before using SprayPay's services.

In order to offer SprayPay's spread payment service, we must process personal data. We do this carefully; below we describe how we process personal data.

We process data that you provide to us. You provide this, for example, when you place an order with a webshop and use SprayPay's spread payment service, or when you contact us and leave your details. When you wish to use SprayPay's spread payment service, we also collect data from you. This concerns the following data:

• Personal and contact information: name, date of birth, gender, home and delivery address, email address, phone number, marital status, family situation.

• Information about orders placed: name of the webshop, order date, amount and order number.

• Financial information: bank account number, income level, housing costs, BKR data, EDR credit check, alimony obligations, consumer credit obligations.

• Communication: email correspondence between you and SprayPay, timing of email communication and telephone contact.

A legal basis is required for the processing of data. SprayPay relies on 3 legal bases:

1. SprayPay needs your data for the performance of a contract. When you order a product and pay for it using SprayPay's spread payment service, you enter into a contract with SprayPay. SprayPay requires your personal information for this purpose.

2. Another legal basis is the so-called legitimate interest. This includes, for example, using data to improve our services or to carry out data or risk analyses.

3. SprayPay's spread payment service operates under a licence supervised by the AFM. The licence number of SprayPay's spread payment service is 12045002. Operating under AFM supervision means that we must comply with applicable laws and regulations, for example to prevent over-indebtedness (preventing over-indebtedness means that you do not borrow more than is appropriate for your personal situation). This last legal basis is the legal obligation.

Purposes and legal bases of data processing

Below you will find an overview of the purpose of data processing and the corresponding legal basis.

• Establishing your identity and verifying personal and contact details: Performance of the contract

• Administering the customer relationship and payment details, including to provide you with information: Performance of the contract

• Determining your income/expenses position to prevent over-indebtedness: Performance of the contract, Legal obligation

• For conducting customer analysis, data analysis, research and statistical purposes: Performance of the contract, Legitimate interest

• To improve our services and to develop new services: Legitimate interest

• For carrying out risk analysis, fraud prevention and risk management: Legal obligation, Legitimate interest

• Compliance with applicable laws and regulations: Legal obligation

SprayPay (part of Webfin Holding) may share or transfer your data to other parties, both within and outside Webfin Holding. Naturally, we do not do this without good reason. In such cases, we will ensure appropriate legal, technical and organisational measures are in place so that your data is properly protected and secure. SprayPay does not sell your data to other parties without first obtaining your consent.

Becoming a business customer of SprayPay

When you wish to become a customer, we provide your data to Economic Data Resources B.V. (EDR). Based on this data, EDR will provide advice on the creditworthiness of the company and any negative findings regarding the company's board/management. EDR uses this data to investigate the creditworthiness and contact details of you and your company. If you wish to object or require information about the use of your personal data by EDR, see: https://www.edrcreditservices.nl/privacy-statement/.

Credit information agencies and other providers of such services

To assess your creditworthiness and to confirm your identity and address details, your personal data is shared with credit information agencies and providers of identification services. SprayPay uses the services of:

• Bureau Krediet Registratie

• iDIN Online Identification

• EDR: Before we enter into a contract with you, we want to form a picture of any payment risks. This helps us determine whether we will enter into a contract with you and which terms and conditions will apply. For this purpose, we will also provide your data to Economic Data Resources B.V. (EDR). EDR verifies personal data and provides credit information reports with a risk profile. EDR uses your data to investigate your creditworthiness and contact details. You can read information about the processing of personal data by EDR here, in the privacy statement https://www.edrcreditservices.nl/privacy-statement/. This also describes how you can exercise your rights, such as your right of access, objection, rectification and erasure.

Government authorities

It may occur that SprayPay is legally obligated to share information with government authorities. Examples include the police or the tax authorities.

Sale or acquisition of assets

In the event that SprayPay purchases or sells assets, or part of its assets is acquired, SprayPay is permitted to share or transfer personal data to the buyer, the seller, or the acquiring party, as applicable.

SprayPay processes your data within the EU/EEA. We make every effort to protect your data appropriately, and to this end we take all reasonably possible legal, technical and organisational measures.

SprayPay does not retain your personal data for longer than necessary to fulfill its contractual obligations and in accordance with the statutory retention period. This means that we retain your personal data for up to 5 years after the end of the contract.

If your application is discontinued or rejected and no contract is concluded, your data will be retained for up to 12 months after the date of entry.

SprayPay complies with the General Data Protection Regulation (GDPR), which means you have a number of rights, namely:

• Right of access: Upon request, we will provide you with an overview of the personal data we hold about you, free of charge.

• Right to rectification: Naturally, you may expect SprayPay to handle your data carefully and record it correctly. Should it unexpectedly be the case that we hold incorrect or incomplete information about you, you have the right to have this corrected.

• Right to erasure: You have the right to have your personal data erased, provided that this is permitted under the legal obligations SprayPay has.

• Right to human intervention in decisions: SprayPay makes decisions on whether or not to grant financing based on automatically processed data. You have the right to request a new decision in which the data has been reviewed by a human.

• Right to data portability: Also known as the "right to transfer data." This means that, upon request, your data will be transferred to you or directly to the organisation to which you wish your data to be transferred.

• Right to restriction of processing: Under certain circumstances, you may request that the processing of your personal data be restricted. This means that the data may still be stored, but may not be processed further.

• Right to object: You may object to the processing of your personal data where the processing is based on legitimate interest. In that case, we must cease the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms.

SprayPay is part of Webfin Holding B.V. and is located at the following address:

• Grote Voort 2478041 BL Zwolle

SprayPay places great value on the privacy and protection of your personal data. If you are not satisfied with how we handle your data, or if you believe your data is being processed incorrectly, you have the right to lodge a complaint with the supervisory authority. In the Netherlands, this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP).

Contact details of the Dutch Data Protection Authority

• Website: Autoriteit Persoonsgegevens

• Postal address: Postbus 93374, 2509 AJ Den Haag

• Phone number: 088 - 1805 250

• Email: info@autoriteitpersoonsgegevens.nl

The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) is responsible for supervising compliance with data protection legislation. They also provide information and advice on the rights and obligations relating to personal data. If you wish to lodge a complaint, you can visit their website for more information on the procedure.

We encourage you to contact us first if you have any questions or concerns about your personal data. Our goal is to resolve any issues quickly and effectively.