Company and legal info.

How we handle your personal data as a Business Customer of TSB X ApS, valid from 1 September 2024.

At TSBX, we protect and respect your data and privacy. When you wish to become a customer of TSB X ApS, we process your personal data as the data controller.

This Privacy Notice applies to you as a private individual affiliated with a company that has or may establish a business relationship with TSBX. You may be an authorized signatory, beneficial owner, director, employee, guarantor, surety, pledger, or a third party connected to our Business Customer.

The Privacy Notice describes various aspects of our processing of your personal data when your company enters into an agreement with us.

1. What is Personal Data?

Personal data includes any kind of information that can be linked to you. When your company enters into an agreement with us, we register contact information and identification details of the management and beneficial owners – all of which, individually or collectively, can be linked to individuals associated with the company.

2. How Do We Process Your Personal Data?

At TSBX, we handle your personal data confidentially and comply with the Data Protection Act, the EU General Data Protection Regulation (‘GDPR’), the guidelines of the Danish Data Protection Agency, and other relevant legislation.

We obtain personal data from you when you, for example, fill out our contact form or provide information in correspondence upon request. Additionally, we collect information from publicly available sources via Experian or directly from sources such as Virk.dk, the Danish Financial Supervisory Authority’s PEP list, the Central Personal Register, among others. We also conduct credit assessments to determine if any records exist about you in credit reporting agencies and warning registers.

We collect and process both general (non-sensitive) and sensitive personal data:

• Name, address, phone number, and email are general personal data that we process.
• We also process information about your potential status as a Politically Exposed Person (“PEP”) or a close associate of a PEP, as well as your financial information (which is considered personal data for sole proprietorships).
• Additionally, we may collect sensitive data if, for instance, your PEP status is due to your political affiliation. Furthermore, as part of our legally required customer due diligence procedures, we may register and process publicly available information online related to criminal matters (e.g., if a news article mentions that you have been charged with a crime).
• Lastly, we process your CPR number (and CVR number) for identification purposes (identity verification) under the Anti-Money Laundering Act and for reporting to the Danish Tax Agency under the Tax Control Act.

3. Purposes of Processing Your Personal Data and Legal Basis

We process your personal data for the following purposes:

• Customer registration at TSBX.
• Credit assessment in connection with agreements (particularly relevant for sole proprietorships).
• Ongoing administration of customer relationships.
• Marketing.
• Termination of your customer relationship.
• Compliance with applicable laws.

We do not request more information than necessary to fulfill the above purposes.

To process your personal data, we must have a legal basis (i.e., a legal justification for processing the specific data). The relevant legal bases are listed below:

• To fulfill contracts and agreements with you (GDPR, Article 6(1)(b)), we must process your personal data, such as contact details and CVR number (which is considered personal data for sole proprietorships). Without your personal data, we cannot provide our products and services.
• In certain cases, the law requires us to collect and store your data (GDPR, Article 6(1)(c)), such as identity information of management and beneficial owners under the Anti-Money Laundering Act, CPR and CVR numbers under the Tax Control Act, and engagement and transaction data under the Tax Control Act, Anti-Money Laundering Act, and Accounting Act.
• Processing of your personal data may sometimes require your consent (GDPR, Article 6(1)(a)). Therefore, we obtain your consent for specific purposes, such as marketing. You can withdraw your consent at any time, which will not affect your terms or current services at TSBX. However, without your consent, you may not receive information about relevant new products for your company.

4. Retention of Your Personal Data

If you become our customer, we will retain your personal data for as long as you remain a customer. If you terminate your customer relationship with TSBX, we will store your personal data for five years plus the current year from the termination date.

Certain data may be retained longer for statistical purposes, but such data will be anonymized.

If you do not become a customer, we will retain your personal data for six months. If you have given marketing consent, we will store your contact details for two years or until you withdraw your consent.

5. Automated Decisions

We do not use personal data for automated individual decisions.

6. Protection of Your Personal Data

We have implemented technical and organizational measures to ensure that your personal data is not accidentally or unlawfully deleted, disclosed, accessed by unauthorized persons, or misused.

7. Access to Information and Other Rights

You have the right to access the data we have collected about you and to request the deletion or correction of inaccurate data. You also have the right to request restrictions on how we process your data and, in certain cases, to object to our processing based on legitimate interests. If you object, we will assess whether the processing can continue or if your situation warrants an accommodation.

Additionally, you have the right to transfer your data to yourself or another person or company (data portability). You can find more information about your rights on the Danish Data Protection Agency’s website at datatilsynet.dk.

We retain documentation of compliance with your requests regarding your rights for two years.

To exercise your rights, contact our Data Protection Responsible (DPR) at the contact details below.

8. Disclosure of Data (Including Third-Country Transfers)

We disclose your personal data to the following recipients:

• Public authorities, such as the Danish Tax Agency, for tax and VAT reporting, as well as other authorities when legally required, e.g., anti-money laundering reports, statistics, subpoenas, court orders, or search warrants.
• Third-party data processors for data storage and processing, such as IT system providers. These processors only handle data on our behalf and cannot use it for their own purposes.

We only use processors and/or sub-processors within the EU or in countries that provide adequate data protection.

9. Right to Withdraw Consent

You can withdraw your marketing consent at any time by contacting us directly.

Withdrawing your consent does not affect the processing already carried out based on your previous consent. The withdrawal takes effect from the moment we receive your request.

10. Confidentiality

All our employees are subject to confidentiality obligations. This means that information about you, including your personal data, will not be unlawfully disclosed to third parties.

11. Contact Information

If you have any questions about our processing of your personal data or wish to exercise your rights, please contact us or our Data Protection Responsible:

TSB X ApS, Att. Data Protection
Gdanskgade 2, 2150 Nordhavn
Email: databeskyttelse@tsbx.dk

12. Complaints

If you are dissatisfied with how we process your personal data, you can always file a complaint with the Danish Data Protection Agency at datatilsynet.dk.

13. Changes

If we make changes to how we collect and process personal data that affect you, we will notify you as a TSBX customer. The effective date is stated at the beginning of this document.

Last approval date: 1. September 2025