1. Introduction

This Privacy & Cookies Policy explains how EPB AB, operating under the trade name Afenio ("Company", "we", "us") processes and protects your personal data in compliance with the General Data Protection Regulation (GDPR). It applies to users of the Afenio platform and visitors to our website (collectively, the "Platform").

EPB AB is a company registered in Sweden (Org. No. 559395-9066), with its registered address at Sveavägen 97, 113 50 Stockholm. We are the data controller responsible for processing your personal data.

2. Data We Collect

We collect personal data in the following ways:

• Data provided by users: This includes name, email, billing details, and IP registration details shared during interactions with our Platform.
• Data collected through essential technologies: limited device and session information (e.g. IP address, browser) and strictly necessary cookies (see Section 7). We do not currently use analytics or marketing cookies.
• Marketing Preferences: When users opt in, we collect data related to marketing communication preferences.

We do not collect sensitive personal data unless explicitly required for a legal or regulatory obligation.

3. How We Use Your Data

We use personal data for the following purposes:

• To process and manage IP registration requests.
• To provide customer support and service notifications.
• To improve our AI models and Platform performance (user data used for AI model improvements is anonymized or pseudonymized where applicable).
• To comply with legal and regulatory obligations.
• To facilitate secure payment transactions (including necessary Stripe cookies for fraud prevention).

4. Legal Basis for Processing

Our processing of personal data is based on:

• Contractual necessity: To provide services under user agreements.
• Legitimate interest: To improve Platform functionality and enhance security.
• Legal obligation: Compliance with tax laws, fraud prevention, and regulatory requirements.
• User consent: For marketing communications and optional cookies.

Users have the right to withdraw consent at any time where processing is based on consent.

5. Data Retention & User Rights

We retain personal data only as long as necessary to fulfill its collection purpose.

Users have the following rights under GDPR:

• Right to access: Request a copy of the personal data we hold.
• Right to rectification: Correct inaccurate or incomplete data.
• Right to deletion: Request deletion of personal data under certain conditions.
• Right to restrict processing: Request limitations on processing activities.
• Right to object: Object to processing based on legitimate interests.
• Right to data portability: Receive data in a structured format for transfer.
• Right to withdraw consent: Withdraw consent for marketing communications.

To exercise any of these rights, contact us at hello@afenio.com.

6. Data Sharing & Security

We do not sell user data. However, we may share data with trusted third-party service providers, such as:

• Stripe (payments): processes payment details and places necessary cookies (one session cookie and two device-identification cookies) for secure transactions and fraud prevention.

We do not currently share data with analytics or advertising providers.

We ensure all data transfers comply with GDPR. If personal data is transferred outside the EU, we use Standard Contractual Clauses (SCCs) to protect user rights.

We implement industry-standard security measures, including encryption and access controls, to safeguard user data.

7. Cookies & Tracking Technologies

We only use cookies that are strictly necessary for the Platform to function. These include:

• Session cookies (set by us): required to keep you logged in and maintain secure navigation.
• Stripe cookies: one session cookie and two device-identification cookies, used to process payments securely and prevent fraud.

We do not currently use analytics or marketing cookies, and there are no optional cookies to manage.

8. Third-Party Services

We may employ third-party tools for analytics and marketing. These parties may collect behavioral data across different platforms, but we do not explicitly share identifiable personal data with advertisers unless users consent.

9. Protecting Your Data

We take data security seriously and implement appropriate technical and organizational measures to prevent unauthorized access, loss, or misuse of personal data.

In case of a data breach affecting personal data, we will notify affected users and the appropriate supervisory authority in accordance with GDPR timelines.

All subcontractors handling data are contractually bound to maintain confidentiality and comply with GDPR.

10. Children's Privacy

Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal data from minors.

11. Governing Law & Disputes

This Privacy & Cookie Policy is governed by Swedish law. Any disputes shall be settled by the Stockholm District Court.

We encourage users to contact us first to resolve any issues amicably before initiating legal proceedings.

12. Contact & Complaints

For privacy-related inquiries, contact our Data Protection Officer at hello@afenio.com.

If you believe your data protection rights have been violated, you may file a complaint with the Swedish Authority for Privacy Protection (IMY):

IMY - Integritetsskyddsmyndigheten
Box 8114, 104 20 Stockholm, Sweden
www.imy.se

13. Changes to This Policy

We may update this Privacy & Cookie Policy periodically. Users will be notified via email or an in-app notification for significant changes.