1. Introduction

This privacy policy ("policy) explains how we process your personal data ("your data"), incl. what we use it for and how we store and protect it.

Why? Because we care about your privacy.

In short, we only process data which you have provided to us by submitting it, with some exceptions as described in this policy.

2. Who are we

We are the company responsible for the processing of your data in accordance with this policy. Here's our information:

Adway AB Andra Långgatan 46 413 27 Gothenburg Sweden

Company Number 559126-9286

E-mail: privacy@adway.ai

To make the policy more user friendly, we use "we", "us", "our" etc. to describe our company.

When we talk about our "website" we mean www.adway.ai, and the other sites and apps we own and operate.

When we refer to "you" we mean you as a user of our website, customer of our online services or products.

3. Why we process your data and what data is processed

We have divided the processes in four different segments. Please find the segment you belong to:

• You who visit our website, please see sec. 3.1.
• You who are a representative of an Adway customer and/or partner, please see sec. 3.2.
• You who contact our customer service or otherwise interact with us, please see sec. 3.3.
• You who applies for a job, please see sec. 3.4.

3.1. You who visit our website

Whenever you visit our website, we collect information that you choose to submit to us, e.g. name, e-mail address and phone number. We may also collect personal data through cookies. Adway's use of cookies is described in our cookie policy.

3.1.1. Categories of personal data

Naturally, we do not collect the same data every time. Depending on the circumstances, we may process the following types of personal data about you:

• Contact information:
  • name, phone number and email address.
• Surfing habits and visiting history:
  • which pages you have visited on our (and others) website, and for how long.
• Demographic information:
  • age, gender, civil status, address and education.
• Login credentials:
  • e-mail address and password.
• Profiling- and movement patterns:
  • choices made, number of clicks, location data, preferences, custom audience and profile.
• Technical data:
  • technical equipment used, timestamps, metadata, cookie-ID and IP-address.

3.1.2. Purpose

• To maintain, provide, test and improve our website.
• To offer you support when facing a problem on our website.
• To send marketing to you, inter alia, through email. You can opt-out from further marketing by clicking on a link in each message sent through email, or by contacting us via the contact information set out in this policy.
• To create reports, review the effect of marketing campaigns and create anonymized statistics regarding the usage of our website.
• For management, development and testing of our IT systems in order to secure that our website uphold high quality as well as identifying and preventing security attacks such as viruses.
• To provide relevant and tailored offerings and advertisements to you.

3.1.3. Legal basis

• Legitimate interest:
  • we have a legitimate and compelling interest for processing your personal data, e.g. to provide you with marketing, to obtain anonymized statistics, and to and manage, develop, test and improve our IT system and services. In the processing we take into account and weigh up your interest in privacy in relation to our interest and purposes in performing the processing. We then balance these interests, taking into account both positive and negative effects and draw the conclusion that our interest is legitimate.

3.2. You who are a representative of an Adway customer and/or partner

If you are a representative of a customer and/or partner of Adway, we will process your personal data in connection with the onboarding of the customer and/or partner and to administer our relationship with and fulfil our agreement with the company that you are representing.

3.2.2. Categories of personal data

Naturally, we do not collect the same data every time. Depending on the circumstances, we may process the following types of personal data about you:

• Contact information:
  • name, phone number and email address.
• Title/Position

3.2.3. Purpose

• To provide services and support, and to administer the agreement with the company that you are representing.
• To set-up user accounts and user roles.
• To send marketing to you, inter alia, through email. You can opt-out from further marketing by clicking on a link in each message sent through e-mail, or by contacting us via the contact information set out in this policy.
• To fulfil legal obligations (e.g. accounting requirements) and to report criminal activity.

3.2.4. Legal basis

• Legal obligation:
  • To fulfil our legal obligations, e.g. accounting and tax legislation.
• Legitimate interest:
  • To fulfil an agreement with our customers, to set up user accounts and roles and to communicate with you. In the processing we take into account and weigh up your interest in privacy in relation to our interest and purposes in performing the processing. We then balance these interests, taking into account both positive and negative effects and draw the conclusion that our interest is legitimate.

3.3. You who fills out one of our forms, contact our customer service or otherwise interact with us

When you fill out a form, contact us, e.g. with queries to our customer service, or when you otherwise interact with us, we process the personal data that you choose to submit to us.

3.3.1. Categories of personal data

Naturally, we do not collect the same data every time. Depending on the circumstances, we may process the following types of personal data about you:

• Contact information:
  • name, phone number and email address.
• Other information submitted through the form
• Customer service requests:
  • information which you choose to submit to us, and information related to your inquiry.

3.3.2. Purpose

• To communicate with you and administer your request.
• To analyze conversations in order to improve our communication and for your and our security.
• To obtain anonymized statistics regarding the usage of Adway's communication channels.
• To maintain, develop, test and improve Adway's services and the technical platforms on which they are provided.

3.3.3. Legal basis

• Legitimate interest:
  • we have a legitimate and compelling interest for processing your personal data, e.g. to provide you with marketing, to obtain anonymized statistics, and to and manage, develop, test and improve our IT system and services. In the processing we take into account and weigh up your interest in privacy in relation to our interest and purposes in performing the processing. We then balance these interests, taking into account both positive and negative effects and draw the conclusion that our interest is legitimate.

3.4. You who applies for a job

This Privacy Policy (together with any other documents referred to herein) sets out the basis on which personal data collected from you or that you provide to us will be processed by us in connection with our recruitment processes.

If you apply for a job opening posted by us, this Privacy Policy will apply to our processing of your personal data. If you apply for a job opening through a job board or similar online service provider, you should note that the relevant job board may retain your personal data. Any use by a job board or similar service provider of your personal data will be in accordance their privacy policy.

3.4.1. Categories of personal data we collect from you

Naturally, we do not collect the same data every time. Depending on the circumstances, we may process the following types of personal data about you:

• Contact information;
  • Name, e-mail, postal address, telephone number, social media profile.
• Information that you upload;
  • CV, reference letters, qualifications, images, skills, experience, etc.
• Information linked to interviews;
  • Information you provide to us in regular interviews and/or video interviews. Results from tests performed by you in relation to a recruitment process.
• Technical data;
  • Information about your use of the Service (e.g. the URL you are accessing the career site from, your IP address, unique device ID, language and operating system etc.)
• Surveys;
  • Your input on surveys that we might use for research purposes, although you do not have to respond to them.

If you are unable to provide us with the personal data above, please note that we might not be able to process your application.

Please do not submit any sensitive personal data. We will process all the personal data that you provide us. Therefore, we request you to only provide us with necessary information and not with any sensitive personal data. Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning sex life or sexual orientation.

3.4.2. Purpose

The purpose of processing personal data is to identify and hire suitable candidates and to communicate with and assess candidates based on current and/or future recruitment needs. We must therefore collect your personal data so that you can apply for a job or connect with us. We only process personal data that is relevant to the recruitment process and the personal data will only be made available to those who need it to fulfil the purpose.

We use information that we collect about you to:

• Consider your application in respect of a role for which you have applied.
• Consider your application in respect of other roles.
• Communicate with you in respect of the recruitment process.
• Enhance any information that we receive from you with information obtained from third party data providers.
• Find appropriate candidates to fill our job openings.
• Help us improve our product and services.
• Automated decision making/profiling

The process of finding suitable candidates may be automatic, partly or in whole, however, any decision as to who we will engage to fill the job opening will be made by our staff. The process is performed based on legitimate interest in order to facilitate the recognition of candidates with higher potential of being hired. It does not evaluate key characteristics regarding an individual and is completely anonymous.

3.4.3. Legal basis

• Legitimate interest;
  • To fulfil our need to recruit candidates and new co-workers. In the processing we take into account and weigh up your interest in privacy in relation to our interest and purposes in performing the processing. We then balance these interests, taking into account both positive and negative effects and draw the conclusion that our interest is legitimate.
• Consent;
  • If we no longer have a legitimate interest in processing your personal data, we will ask for your consent to continue processing your personal data. For example, the personal data processing that occurs through cookies is based on your consent as a legal basis for processing.

3.4.4. When we collect your personal data from a third party

We may collect your personal data from a third party when you:

• Submit your job application to us directly on our career site, or through your social media profile, or through external job boards. If you apply for a job opening or connect with us through your social media profile, such as LinkedIn, we will collect your personal data from the relevant social media profile and synchronize with the Service.
• Connect with us in order to be considered for future job applications and receive updates about job openings, either directly on our career site, or through your social media profile.
• Contact any of our employees.
• Provide information to us in connection with an application process.
• Provide feedback during or after a recruitment process.
• We may also receive your personal data from a party who recommends you as a candidate and/or gives references on your behalf, for a specific job opening or for our business in general.

3.4.5. Sourcing

Where we see the potential of including you in a recruitment process for a job opening with us, our staff may source your personal data from third parties, such as LinkedIn and other social media sources, that keep public information about you. Through "sourcing" we collect your contact information and information that you have uploaded to the third party service.

4. For how long do we process your personal data?

We will only process your personal data for as long as we need to fulfil the purpose the personal data was collected for or to fulfil legal obligations, such as storing specific information in accordance to bookkeeping or tax requirements.

5. Keeping your data safe

We use reasonable organisational, technical and administrative measures to protect your data within our company. The Internet is not a 100% secure environment and that means we cannot guarantee the security of the data you transmit to us. Emails sent via the Internet might not be encrypted, so we advise you not to include any confidential or sensitive information in your emails to us.

6. Third parties and processors

We use companies (processors) to help us deliver our services to you. When we use a processor we make sure that there is a legal agreement in place regarding how they will be handling data on our behalf. We'll also make sure that they have appropriate security measures in place and if they are located outside the EU, we'll of course make sure that there is a legal agreement in place allowing us to give them access to the data. Read our cookie policy regarding the suppliers we use for those services.

We may also share your personal data with authorities to fulfil obligations under law or execute decisions.

In the event that we are involved in a bankruptcy, merger, acquisition, reorganization, your information may be transferred as part of that transaction. This policy will continue to apply to your information also after the information has been transferred to the new entity.

We also may share your data if we believe in good faith that it is reasonably necessary to respond to claims asserted against us or to comply with the legal process, to enforce or administer our policies and agreements with users, for fraud prevention, risk assessment, investigation, customer support, product development and debugging purposes, including investigation of violation of our terms or agreements with others, or to protect our rights, property or safety, its users, business partners or members of the general public.

7. Third party websites

Our website may contain links to third-party owned and/or operated websites including, without limitation, websites owned and/or operated by third parties. We are not responsible for the privacy practices or the content of such websites. These third-party websites have separate privacy and data collection practices and we have no responsibility or liability relating to them.

8. Transfer to countries outside the EU/EEA

In some cases, we'll transfer personal data to the following countries outside the EU/EEA:

• USA

The transfers will take place on the basis of the following legal basis:

• The countries have not been deemed by the Commission of the European Union to have an adequate level of protection of personal data. We will provide appropriate safeguards for the transfer through the use of "Model Contracts for the Transfer of Personal Data to Third Countries", as published by the Commission of the European Union, or any other contractual agreement approved by the competent authorities.

9. Your rights

You have the following rights:

1. Your right of access and rectification; You have the right to ask us for copies of your personal data or ask us to rectify information you think is inaccurate. There are some exemptions, which means you may not always receive all the information we process but as a main rule you can always contact us and ask for your information.
2. Your right to erasure; You can ask us to erase your information in certain circumstances.
3. You also have the right to have the processing of your data restricted.
4. Your right to withdraw your consent; If processing of your data is based on your consent, you have the right to withdraw your consent at any time. Your withdrawal will not affect the lawfulness of the processing carried out before you withdrew your consent. You may withdraw your consent by [insert] .
5. Your right to restriction of processing and object to processing; You have the right to ask us to restrict the processing of your information and a similar right to object to processing.
6. Your right to data portability; You have the right to receive your data in a structured, commonly used and machine-readable format (data portability).
7. Where your data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data about you for such marketing.

The law gives us one month to respond to you, but we will try to respond sooner.

There may be conditions or limitations on these rights. It is therefore not certain e.g. you have the right of data portability in a specific case - this depends on the specific circumstances of the processing activity. You are always welcome to contact us and ask. The same goes for some of the other rights.

10. Complaints

You can always lodge a complaint with a data protection authority, for example Swedish Authority for Privacy Protection (imy@imy.se).

11. Additional information

If you would like more information about our legal basis for processing your data, feel free to contact us. Some of the grounds for processing your data overlap, so there may be several reasons which justify us processing your data.

We may use your data in other ways than described here but we'll inform you about these purposes when we collect your data.

Please note that special circumstances or legal requirements may mean that such periods may be shorter or longer, depending on the purpose of complying with legal requirements for the erasure or keeping of information.

12. How to unsubscribe to email marketing material?

If you have subscribed to our newsletters or asked to receive marketing material from us, you can always unsubscribe. In all these emails we include an unsubscribe link and you always click the link and easily unsubscribe.

You can also unsubscribe or by contacting us via the contact information set out in this policy.

13. Children and Our Services

Our services and website are not directed to children, and you may not use our services if you are under the age of 16. You must also be old enough to consent to the processing of your information in your country.

14. Changes to this policy

Sometimes we need to make changes to this policy to reflect our current practices. We will take reasonable steps to let you know about changes via our website.

If you are a registered user, we will notify you via email if significant changes are being made to the policy using the email address you gave us when you signed up.

If you continue to use our website or services after the notification, we will regard this as your acceptance of our privacy practices.

15. Last updated and Version

The policy was last updated October, 2021.

Version 2021.2.