1. General

We at Lowwi AB want you to feel safe when you provide us with your personal information. This privacy policy explains how we collect, use, disclose, and store your personal information, as well as how we otherwise ensure that your personal information is processed in accordance with applicable legislation. It is important to us that you read and understand this privacy policy and feel comfortable with how we handle your personal information.

2. Who is the data controller?

Lowwi AB, with org. no. 556881-9238 and postal address Morabergsvägen 8, 152 42 Södertälje (referred to as ""Lowwi"" in this policy) is the data controller for the processing of your personal data when Lowwi provides and markets products and services and in other contacts with Lowwi, such as visits to our online store or service matters via email and telephone. As the data controller, it is Lowwi's responsibility to ensure that your information is handled correctly and securely in accordance with applicable legislation.

3. What personal information do we process about you and what do we not process?

Lowwi collects and processes the following categories of personal information about you as a customer or potential customer in connection with your purchases and use of our services, and when we market and promote our products and services.

• Contact information such as name, title and authorization, email address, delivery address, invoice address, and telephone number.

• Order information such as order number, ordered products or services, order date, price, discount, and purchase history.

• Payment information such as payment method, transaction time, amount, IP address, and payment history.

• Correspondence and other information about support matters such as call recordings, notes, and email messages when contacting customer service.

• User-generated data about your interaction with Lowwi's marketing communications and websites, such as IP address, device information (technical information about computer, mobile phone, and other devices you use, for example, browser settings, time zone, operating system), location information, survey responses, and click and visit history showing which of our products or offers you have been interested in, how you interact with our newsletters, and results from customer satisfaction or market surveys.

• If you have the right to use various offers or discounts through membership in various associations or organizations that have negotiated agreements with Lowwi for their members.

• Information provided in competition entries as well as registration for or other marketing measures.

• We also save in some cases org. no. when you shop as a company. These are saved when you use our checkout specifically designed for municipalities, county councils, and companies. This is so that we can issue an invoice for your purchase.

• We do not save your personal identification number, card number, bank account number, or similar as a consumer. These are saved by our invoice partner Nets.

4. From which sources do we collect information about you as a customer?

4.1 Lowwi collects your personal information directly from you when you place an order, visit Lowwi's website, click on links in digital marketing communication that we have sent to you, are in contact with our customer service, and when you otherwise have contact with Lowwi and provide information about yourself. Information about you is collected on these occasions so that you can enter into an agreement with Lowwi and for Lowwi to provide its products and services to you.

4.2 If you are the account holder, Lowwi also collects personal information about you when registering the account and during the time you are the account holder, for example, your purchase history, your behavior on Lowwi's website, your customer settings to receive marketing communication, and which offers you have been interested in by visiting our online store and reading or clicking on links in our digital mailings.

4.3 In addition to the information Lowwi collects from you, we may also collect personal data from someone else, that is, from a third party. We obtain information from public records via third-party services for address updates, such as Ratsit, to verify that we have the correct contact information for you. We collect information about creditworthiness from credit rating agencies, information companies, or banks, such as UC.

4.4 Lowwi also collects certain personal data through cookies that log how you use our website and thus which content you prefer.

5. Why do we process personal data about you?

Lowwi collects and processes information about you for various purposes. These purposes set the outer limits for how we may use your personal data. Below, we explain the purposes of our processing and provide examples of processing activities that occur under each purpose. Please note that some of your personal data may be processed for multiple purposes.

5.1 Manage orders and purchases

Processing of personal data for this purpose includes activities to, among other things, identify you and send order confirmations, deliver orders, notify about delivery, and handle complaints and warranty matters regarding purchased products.

The collection of information we do to manage your orders and purchases is required for us to fulfill our obligations under our terms of purchase. If the information is not provided by you, our obligations cannot be fulfilled, and we may then deny your order or purchase.

5.2 Provide and manage account

Personal data we process for this purpose is to, for example, give you permission to log in to your account, verify your identity, create your personal pages, maintain correct contact information, manage your settings for marketing communication and personalized offers, facilitate your shopping in our web store through pre-filled information and saved digital shopping carts, help you manage issues and complaints, and enable you to track your order and payment history.

5.3 Provide customized information, benefits, and offers, and provide a personalized experience of our web store to you with an account

We at Lowwi want you to have the best possible experience when visiting our website and when we communicate with you. Therefore, we process personal data for this purpose so that we can improve your user experience in order to create, offer, and provide you with personalized content in communication and marketing via mail, email, SMS/MMS, and phone with individual benefits and offers, recommendations, and other information we believe is relevant to you, and remind you of abandoned digital shopping carts. To enable this, analyses are performed on the data collected by Lowwi, such as place of residence, order history, and user-generated data.

The collection of information we do for this purpose is required for us to fulfill our commitments under these terms. If the information is not provided, we may need to limit certain benefits and other advantages linked to your account.

5.4 Provide information about and market products and services

We process personal data for this purpose to inform you by mail, email, SMS/MMS, and phone about the products and offers Lowwi sells, show recommendations, remind you of abandoned digital shopping carts, as well as invite you to competitions and market and customer satisfaction surveys.

5.5 Conduct and manage participation in competitions and other marketing activities

Processing of personal data for this purpose includes actions to, for example, identify participants, communicate with participants in a competition, designate winners and distribute prizes, verify participants' age, and communicate with participants before and after an event (such as confirmations of registrations, reminders, and evaluations). Please note that information about your participation in an event falls under the category of user-generated data processed for other purposes.

5.6 Manage matters received by Lowwi's support functions

Processing of personal data for this purpose includes Lowwi's activities to, for example, communicate, verify the customer's identity, investigate complaints and support cases, answer questions received by customer service or other support functions via email, phone, or digital channels, correct incorrect information, provide technical support, and nurture customer relations.

5.7 Fulfill legal obligations required by Lowwi

Personal data is processed for this purpose so that Lowwi can meet requirements in laws, judgments, or decisions of authorities. Examples of such requirements include product liability and product safety such as developing communication and information about product alerts and product recalls (e.g., in case of a defective or hazardous product) and obligations to retain specific information according to the Accounting Act that may be related to an individual. If the data collected by Lowwi for this purpose is not provided, our legal obligation cannot be fulfilled, and we may then deny your order, purchase, or the activity that gives rise to our legal obligations.

5.8 Prevent abuse and prevent, detect, and investigate crimes within the scope of our operations

Processing of personal data for this purpose is done, among other things, to prevent account abuses and prevent and investigate suspected theft and fraud. When you want to pay for goods by invoice, we therefore conduct a fraud check where we analyze which products you want to buy, delivery address, the value of the products, etc. We flag patterns of behavior often associated with fraud and then conduct a manual review to assess the risk that there may be an attempted fraud. Suspected crimes and attempts at crimes may be reported to the police.

5.9 Evaluate, develop, and improve Lowwis services, products, and systems for our customers in general

Processing of personal data for this purpose includes activities to, among other things, make our web store and other services more user-friendly, develop or highlight digital features, improve our customer offering (for example development of services and products), gather data to improve merchandise and logistics flows (for example to forecast purchases, stocks, and deliveries), develop and improve the company's range and resource efficiency, as well as improve our IT system to enhance security, compile statistics for market and customer analysis and business monitoring, and business and method development related to orders and purchases, automatically archive behaviors that may need to be reviewed for security reasons and give customers the ability to influence the range provided by Lowwi. In order to fulfill this purpose, Lowwi conducts general analyses in aggregated form, that is, not at the individual level, regarding, among other things, click and visit behaviors, device information, order history, payment history, geographic location, and individual customer feedback.

6. What are the legal grounds for our processing of your personal data?

In order for Lowwi to have the right to collect and process your personal data, there must be a legal basis for each purpose the data is processed for. The legal grounds we base our processing on are described in this section. Please note that several legal grounds may be applicable for the same processing.

6.1 Legal obligation

This basis means that our processing is necessary to fulfill a legal obligation required by Lowwi, for example, to document payment details to comply with the requirements of accounting law.

6.2 Contractual obligations

This basis means that the processing is necessary to fulfill an agreement with you as a customer or to be able to enter into an agreement at a later stage. For you as the account holder, you have entered into an agreement with Lowwi that sets the framework for the processing of your personal data in order to provide, manage, and administer our account-related services, such as analysis of your personal characteristics to provide you with personalized benefits and offers. When ordering or making a purchase, we process your data to fulfill obligations under Lowwi's terms of purchase. For example, it may be necessary for Lowwi to record your contact information so we can fulfill our obligation to deliver the product.

6.3 Legitimate interests

This basis means that our processing is based on a so-called balance of interests of legitimate interest. This means that the processing is done because Lowwi assesses that we have legitimate interests in processing your personal data that outweigh your interest in not having your personal data processed. Under this basis, we process, among other things, your personal data to prevent misuse of the account and prevent, deter, and investigate crimes within the scope of our operations. If we assess that a crime or attempted crime has been committed and we file a police report, Lowwi will also continue to process your personal data in order to establish, defend, or assert legal claims.

7. How long do we save your personal data?

7.1 Lowwi will save your personal data for as long as it is necessary to fulfill the purposes for which the data is processed. The length of the storage period depends on the purpose for which the data is processed. Additionally, Lowwi may save the data longer if needed to establish, defend, or enforce legal claims, for example, if there is a dispute or if a report of a crime has been filed with the Police Authority. We regularly carry out purges and delete personal data that is no longer necessary.

7.2 Lowwi saves personal data linked to your account for as long as you are active by interacting with Lowwi in various ways. If you have been inactive for a certain period, the account will be automatically terminated, and the personal data we have collected and processed to provide the account and services related to the account ownership will be deleted.

8. OVERVIEW OF OUR DATA PROCESSING

Below we have provided a concise summary of our processing of personal data to clearly explain the categories of personal data we process for our various purposes, the legal basis for our processing, and how long we store the data.

9. Who do we share your personal data with?

9.1 Lowwi may disclose your information to other companies so that you can benefit from our offers, products, and services. The recipients of your personal data may either be data processors for Lowwi, meaning companies that process your data on our behalf and according to our instructions, or independent data controllers, meaning companies that are independently responsible for processing your data as they have a direct relationship with you as a customer, such as Nets.

9.2 Lowwi may also disclose your information to authorities if necessary to comply with a law, regulation, or official decision, or for Lowwi to establish, exercise, or defend legal claims.

9.3 Depending on your interactions with Lowwi, for example if you are an account holder or receive marketing communications, Lowwi may disclose your personal data to the following recipients:

• Other companies within Lowwi that act as data processors for Lowwi to fulfill the various purposes stated in this policy. The legal bases for the transfer to our group companies are the same as for our own processing.

• Companies that provide information from the population register or other public records to ensure that we have correct contact details for managing your orders and purchases, as well as your account and the services associated with your account. The information provided includes identification numbers and contact details based on our contractual obligations to you as the legal basis.

• Analysis and marketing companies that provide services such as automated marketing tools, analysis, communication, print, and distribution. These recipients help Lowwi analyze your data and inform about and market the products and services Lowwi sells. The information provided includes contact details, account information, customer settings, order information, and user-generated data based on legitimate interests and our contractual obligations to you as an account holder as legal bases.

• Government authorities, such as the Police Authority or the Swedish Tax Agency, to whom we are obliged to disclose your personal data according to law or official decisions or to whom we disclose personal data due to suspicion of crime or attempted crime. The information provided includes contact details, identification numbers, account information, order information, payment information, and user-generated data based on a legal obligation on Lowwi's part or to establish, exercise, or defend legal claims.

9.4 If you place an order or make a purchase from Lowwi, we may also disclose your personal data to the following recipients as part of processing your orders and purchases based on our contractual obligations to you:

• Suppliers, manufacturers, distributors, and subcontractors of products and services sold by Lowwi which provide the products and services and assist us with support services such as maintenance, repair, and disposal of returned products. The information provided includes contact details and order information.

• Logistics companies and freight forwarders that help us with transportation so we can deliver our products and services to you. We provide contact details and order information to these recipients.

• Insurers that provide insurance for some of our products and services. The information provided when you choose to take out insurance includes contact details and order information.

• Collaboration partners and payment solution providers, such as card processing companies, banks, financial institutions, and other financial actors, that ensure you can make payments and offer you various financing solutions. The information provided includes contact details and payment information.

9.5 Lowwi will not sell your personal data to third parties.

10. Where do we store your personal data?

Lowwi will primarily handle your personal data within the EU/EEA. However, we may also transfer your personal data to a country outside the EU/EEA if we need to share your data with Lowwi's suppliers or collaboration partners located outside or storing personal data in a country outside the EU/EEA. If your personal data is transferred to a country outside the EU/EEA, Lowwi will take the necessary measures to legally transfer the personal data by ensuring that your personal data is handled securely and with an adequate level of protection comparable to that offered within the EU/EEA, for example by entering into agreements with the recipient containing the EU Commission's standard contractual clauses or, if the transfer is made to the USA, by ensuring that the recipient has certified compliance with the principles of the Privacy Shield.

11. What rights do you have as a registered customer?

11.1 Lowwi is responsible for processing your personal data in accordance with applicable legislation. This section describes your rights related to our processing of your personal data. Upon your request or on our own initiative, we will correct, deidentify, delete, or supplement data found to be incorrect, incomplete, or misleading. If you have any questions about this or want to exercise any right, please contact us using the contact information provided at the bottom of this policy.

11.1.1 Right to access your personal data

We at Lowwi want to be transparent about how we process your personal data. If you want to know how we process your data, you have the right to request information about the processing, including a copy of your personal data being processed, a so-called record extract. This includes information about purposes, categories of personal data, categories of recipients of personal data, storage periods or criteria for determining storage periods, information on where data was obtained from, and the existence of automated decision-making including information on the logic behind and significance of the processing. Please note that in a request for access, we may ask for additional information about you to ensure that we provide the data to the correct person and which data you want to access. The record extract is free of charge, but for repeated requests, Lowwi has the right to charge an administrative fee of 100 SEK.

11.1.2 Right to rectify your personal information

Lowwi is keen to have correct and updated personal information. If the information we have about you is incorrect, you have the right to request that it be corrected. You also have the right to supplement any incomplete personal information, for example if we have the correct street address but lack the street number. Upon your request, we will promptly correct the incorrect or incomplete information we process about you.

11.1.3 Right to erasure of your personal information

We respect that the personal information we process about you is borrowed from you. Therefore, you have the right to request that Lowwi deletes your personal information when the information has been processed unlawfully, must be deleted to comply with a legal obligation Lowwi is subject to, is no longer necessary for the purposes for which it was processed, or when you object to a legitimate interest balancing that Lowwi has made, and there is no legitimate interest for Lowwi or a third party that outweighs (see section 11.1.6 below for information on the right to object). However, we may not always comply with your request as there may be reasons that give us the right to continue processing, for example if the personal data are processed to fulfill a legal obligation as legal basis (such as according to requirements in the Accounting Act) or if the data are necessary for Lowwi to establish, assert or defend legal claims.

11.1.4 Right to data portability

You have the right to receive a copy of the personal data concerning you in a structured format and in some cases have the data transferred to another data controller. However, this right only applies to data that you have provided to Lowwi yourself and that we process with your consent or a contractual obligation towards you as legal basis.

11.1.5 Right to restriction of processing

You have the right to request that our processing of your personal data be restricted in certain situations, which means that the data may only be processed for certain purposes. For example, you can request restriction of incorrect data when you have requested rectification. While Lowwi investigates the accuracy of the data, their processing will be restricted.

11.1.6 Right to object to certain types of processing

When Lowwi processes your personal data based on a legitimate interest balancing as legal basis or for direct marketing, you have the right to object to our processing. Objection to Lowwi's legitimate interest balancing can be made when you have personal reasons related to the situation. Upon such objection, Lowwi assesses if we have compelling reasons for processing that outweigh your interest in protecting your privacy. If this is the case, Lowwi may continue to process your personal data despite your objection. Objection to direct marketing and analyses carried out for direct marketing purposes can be made without providing any reasons. Additionally, you are given the opportunity to object to marketing with each individual digital dispatch. If you object to direct marketing, we will cease processing your personal data for that purpose and all types of direct marketing actions such as sending newsletters and offers. If you only object to personalized offers, the marketing communication to you will be generic, as we have difficulty assessing which marketing is relevant to you if we do not analyze your personal characteristics.

11.2 If you believe that we are processing your personal data incorrectly, you are welcome to contact us. Contact information is available at the bottom of this policy. You also have the right to lodge any complaints regarding the processing of your personal data with Datainspektionen, which is the responsible supervisory authority for the processing of personal data in Sweden.

12. How do we protect your personal information?

You should always feel confident when providing your personal information to us. Lowwi has therefore taken appropriate technical and organizational security measures to protect your personal information from improper or accidental disclosures, use, unauthorized access, deletion, alteration, or damage to your personal information. For example, all customer information is stored in a database protected by a firewall and access control so that only Lowwi employees who need access to your information to perform specific tasks have such access.

13. Application and modification of the privacy policy

13.1 The most recently updated version of Lowwi's privacy policy is always available on our website. Our privacy policy applies at all times in the form and content that is published on the website.

13.2 Lowwi has the right to update the privacy policy at any time. If the privacy policy is changed, the updated policy will be published on Lowwi's websites. We may also inform you via email if there are major changes to the privacy policy. If you do not wish to accept the changed policy, you can close your account by contacting customer service, see the contact details at the bottom of this policy.

14. Contact Information

Do not hesitate to contact us if you have any questions about this privacy policy or if you would like more information about our processing of your personal data or if any information is incorrect and you would like us to correct it.

• Please contact customer service by sending an email to [email protected]