The responsible handling of your personal data is important to us. The protection of your privacy is a major concern for us. We handle the data that we process in the course of our activities with care. We strive to ensure the greatest possible data security when dealing with the information technologies used and, as a matter of principle, only collect the data that is absolutely necessary.

We take appropriate technical and organizational security precautions (e.g., encryption and/or pseudonymization of your personal data, instructions, confidentiality declarations, and controls) to protect your personal data against manipulation, loss, destruction, or access by unauthorized persons. These measures are based on international standards and are regularly reviewed and adapted as necessary.

Our employees are regularly trained in data protection and are obliged to comply with special confidentiality obligations. In addition, compliance with data protection is continuously monitored. This also applies to the data processors commissioned by us.

In this privacy policy, we explain how we collect and process personal data, for what purpose this is done, who has access to your personal data, how long we process your data, what rights you have in this regard, and how you can contact us.

This privacy policy contains the essential statements on data protection and thus serves to inform about data protection and the right to informational self-determination. These privacy provisions are not part of the contract and may be amended by us at any time within the framework of the statutory provisions. The version published on our website shall apply in each case. The German version is authoritative and also forms the basis for all language versions of our privacy provisions.

Information on Data Protection

Personal data (hereinafter also "data") shall be understood below as all information relating to an identified or identifiable natural person (e.g., name, date of birth, email address, identification documents, authentication data, tax data, IP address). In addition, we process special categories of personal data (e.g., your health data). Information that is anonymized or aggregated and can no longer be used to identify a specific person is not considered data.

The processing of data includes any handling of personal data, e.g., the acquisition, storage, use, disclosure, modification, archiving, or deletion of data. The legal basis and purpose for the processing of your data is primarily the initiation and/or fulfillment of a contract.

In addition, we base the processing of the data on the existence of a legal obligation and/or consent as well as on the overriding legitimate interest of Prosperity Solutions AG (i.e., in particular to pursue the purposes described and related objectives and to be able to carry out corresponding measures).

The processing of your personal data is based on the principles of accuracy, lawfulness, transparency, data minimization, proportionality, accountability, and data security.

Prosperity Solutions AG, as the processor of your personal data, is subject to the legal provisions applicable in Liechtenstein. Liechtenstein is a member of the European Economic Area (EEA), and the EU General Data Protection Regulation (GDPR) applies in full, together with the respective applicable national laws, such as the Data Protection Act (DSG-LI) Liechtenstein, the Data Protection Act (DSG-CH) Switzerland, or the Federal Data Protection Act in Germany. The processing of your personal data is carried out on the basis of the General Data Protection Regulation (GDPR), the Liechtenstein Data Protection Act (DSG-LI), the Swiss Data Protection Act (DSG-CH), the German Federal Data Protection Act, and other national laws applicable to the case.

These privacy provisions do not contain an exhaustive description of our data processing. Individual circumstances are regulated in whole or in part by specific information (with or without reference to this privacy policy).

There are exceptions to the data protection information obligation: This does not apply if the information is not possible or requires disproportionate effort, if you have already been informed about the data processing, if the processing is provided for by law, or if we are legally obliged to maintain confidentiality.

If you wish to enter into a contract with us, you must provide us with all data that is necessary for the establishment and execution of the business relationship and for the fulfillment of the associated contractual obligations. Without this data, we are not in a position to enter into a contract with you or to fulfill it or to provide services.

In certain cases, we collect your data from third parties or receive your data from third parties. We collect personal data without your involvement only if the direct collection would be unreasonable or disproportionate or would violate the business secret pursuant to Art. 20 of the Liechtenstein Insurance Distribution Act.

Controller of Data Processing

The controller within the meaning of the GDPR is:

Prosperity Solutions AG
Feldkircher Strasse 31
9494 Schaan
Principality of Liechtenstein

Email address: privacy@tpc.li

Prosperity Solutions AG is a company of the prosperity Group. Other companies of the prosperity Group are

• The Prosperity Company AG, Liechtenstein Life Assurance AG, stable solutions AG, each with headquarters in Schaan/Liechtenstein, as well as
• prosperity solutions GmbH with headquarters in Berlin/Germany and
• prosperity solutions (Switzerland) AG with headquarters in Zurich/Switzerland.

Purpose of Data Processing

We process personal data that you provide to us or that we lawfully receive from companies of the prosperity Group for the purposes listed below or agreed with you and the underlying objectives.

• Initiation and execution of contractual relationships
• Internal administration (e.g., IT security, audit, controlling)
• Communication with you, e.g., by post, email, or telephone
• Legal Services and Compliance: We process your data to comply with regulatory and legal obligations and to ensure that laws, guidelines, requirements, and internal instructions are observed. In particular, we process your data for the purpose of combating money laundering, terrorist financing, as well as bribery and corruption. We also process your data to fulfill legally prescribed reporting obligations that serve to prevent, detect, or clarify criminal offenses or other violations. These include, among others, the obligation to provide information, information, or reporting obligations in connection with supervisory and tax law obligations.
• Customer surveys, partner surveys, and marketing: We process your data for customer surveys, partner surveys, and for marketing purposes in order to inform you about our products and services. Marketing purposes are understood to mean all activities of the prosperity Group with which customers can be acquired or existing customer relationships can be expanded. As part of partner surveys, we may collect and process the name and email address of the participating partners.
• Statistics and science: We process your data for general and insurance-specific statistical surveys, for risk management purposes, and for market research purposes.

Legal Basis

Insofar as the GDPR applies, we rely on the following legal bases:

• Art. 6 Abs. 1 lit. b GDPR (execution of pre-contractual measures, contract fulfillment. Insofar as special categories of personal data are required for this, we obtain your consent pursuant to Article 9 (2) (a) in conjunction with Article 7 GDPR)
• Art. 6 Abs. 1 lit. c GDPR (legal obligation)
• Art. 6 Abs. 1 lit. f GDPR (legitimate interest)
• Art. 6 Abs. 1 lit. a GDPR (consent, e.g., for advertising or health data)
• Art. 9 Abs. 2 lit. a GDPR (special categories of personal data)

Collection of Data

Direct Data Collection

Personal data is primarily collected directly from you (e.g., in online and application forms).

Data from/via Third Parties or Public Authorities

In certain cases, we collect your data from third parties or receive your data from third parties or public authorities and process it within the legally permissible framework. For example, we process data that we have received from offices or authorities, financing companies, banks, insurers, distribution partners, employers, credit agencies, press, or media.

Data from Publicly Accessible Sources

Insofar as this is permitted, we also obtain certain data from publicly accessible sources (e.g., debt enforcement register, land register, commercial register, media, internet) or receive such data from other companies within the prosperity Group, from authorities, cooperation partners, or other third parties.

In particular, we collect and process personal data of authorized representatives and contact persons of companies from publicly accessible sources in order to identify potential business customers in the B2B sector (customer acquisition).

Profiling

We want our communication to be useful and relevant to you. Therefore, we use profiling for marketing purposes in order to better understand our customers and target content accordingly.

What does profiling mean in this context? Profiling is an automated processing of your data in order to analyze certain personal aspects and assign you to a customer group (segment). For this purpose, we use exclusively data that you have provided to us, such as your specified language or your country of residence.

Purpose and effect of profiling: The sole purpose of this profiling is the personalization of our marketing communication. For example, if you have chosen German as your language, you will receive our newsletters in German. This procedure has no other effects on you and in particular does not affect the contracts, conditions, or services available to you that exist with you.

Legal basis: If you have given us your consent to receive marketing information (Art. 6 Abs. 1 lit. a GDPR), this also includes the associated profiling described here.

Automated decision-making in individual cases that has legal effects on you or similarly significantly affects you (pursuant to Art. 22 GDPR) does not take place.

Disclosure of Data

Principles

We protect your data and do not sell it to third parties. Your data may be disclosed to data processors and third parties under certain circumstances (e.g., if required for the conclusion of the contract or the execution of the contract or for other purposes mentioned in this privacy policy). If legally required, these recipients will be contractually obliged to comply with the currently applicable data protection legislation as well as confidentiality and, if necessary, secrecy.

Within Prosperity Solutions AG, those departments receive your data that need it to fulfill contractual and legal obligations. Data processors (Article 28 GDPR) employed by us may also receive data for the purposes mentioned. These are companies in the categories of IT services, software development, logistics, printing services, communication, payment service providers, financing, debt collection, consulting and consulting, sales and marketing, as well as information and address determination. We may only disclose information about you if statutory provisions permit or require this, you have consented, or we are authorized to provide information. Under these conditions, recipients of personal data may be, for example:

Companies of the prosperity Group

We are part of the prosperity Group and therefore process certain business processes partly in central service units and data processing systems of the prosperity Group. This data processing takes place only within the European Economic Area (EEA) or Switzerland. For these processing operations, there are data processing agreements at group level that meet the requirements of Art. 28 GDPR.

External Service Providers

We use external service providers in part to fulfill our contractual and legal obligations.

Conclusion of Electronic Business Transactions

We offer conclusions in electronic business transactions. In this area, we have a cooperation with service providers that guarantee an electronic and legally binding signature (digital signature).

Other Recipients

In addition, we may transmit your personal data to other recipients, such as authorities to fulfill legal notification and control obligations (e.g., social security institutions, tax authorities, law enforcement agencies, supervisory authorities (e.g., BaFin, FMA, FINMA, EIOPA, customs, Financial Intelligence Unit). Furthermore, we transmit your personal data to credit institutions for the processing of payment transactions. Further data recipients may be those bodies for which you have given us your consent to data transmission or for which you have released us from the duty of confidentiality (e.g., health insurance companies, doctors, hospitals).

A list of service providers of the recipients mentioned above, with which there are not only temporary business relationships, can be requested directly from us in the current version. For any further information, please contact the controller at the address given above.

Disclosure of Data to Data Processors

In order to fulfill contractual or legal obligations, we work in part with data processors such as suppliers, IT and other service providers. These are contractually obliged to process the data only for the purposes predetermined by Prosperity Solutions AG.

Data Transfer to Third Countries

If we transmit personal data to service providers in countries outside the European Economic Area (EU and EEA), this is done exclusively on the condition that either the European Commission has certified an adequate level of data protection for the third country in question or that other appropriate data protection guarantees exist - such as binding internal company data protection regulations (Binding Corporate Rules) or the EU standard contractual clauses. An exception to this exists only if the transmission is required by law or takes place by official or court order.

We currently transmit personal data to service providers in third countries outside the EU, in particular to Switzerland and the USA. For Switzerland, the EU Commission decided on January 15, 2024, that a level of data protection comparable to that of the EU is guaranteed. For transfers to the USA, the EU Commission recognized with a decision of July 10, 2023, that there is an equivalent level of data protection in the USA for personal data that is transmitted from the EU/EEA area to EU-U.S. Data Privacy Framework-certified organizations in the USA. If a service provider should not be certified according to the Data Privacy Framework, we ensure that other appropriate guarantees are agreed upon, e.g., according to EU standard contractual clauses (SCC).

Where required by law, we will inform you separately about such data transfers.

Duration of Storage

Your personal data will be deleted as soon as it is no longer required for the purposes mentioned above. In certain cases, however, a longer retention may be necessary - for example, if potential legal claims could be asserted against us. In such cases, storage takes place for the duration of the respective applicable statutory limitation periods, which are generally three years but in individual cases can be up to thirty years.

In addition, we are legally obliged to retain certain personal data over a longer period of time. Such obligations arise in particular from personal and company law, tax law, and the law on due diligence obligations in financial transactions.

The corresponding proof and retention periods are up to ten years.

• Contract data: up to 10 years after conclusion of the contract
• Health data: until the expiry of statutory limitation periods (generally up to 10 years and in individual cases up to 30 years)
• Consents: up to 3 years after revocation

Obligation to Provide Personal Data

In the context of our business relationship, you only have to provide those personal data that are necessary for the establishment and justification, execution, and termination of a business relationship, that we need to exercise our legitimate interests, or that we are legally obliged to collect. Without this data, we will generally have to refuse to conclude the contract or execute the order or will no longer be able to carry out an existing contract and may have to terminate it.

In particular, we are obliged under the anti-money laundering regulations to identify you before establishing a business relationship, for example, using your identity document, and thereby collect your name, place of birth, date of birth, country of birth, nationality, and your residential address and electronically record the identity document. In order for us to comply with these legal obligations, you must provide us with the necessary information and documents under the Due Diligence Act and notify us immediately of any changes arising during the course of the business relationship. If you do not provide us with the necessary information and documents, we may not establish or continue the business relationship you desire.

Acknowledgment

By concluding a contract with us, you take note of this privacy policy. The current version of this document can be found on our websites under the heading "Privacy Policy."

Your Rights

As a data subject, you have the right to information about the data stored about your person. In certain cases, you can also request correction, deletion, restriction of processing, objection, or transfer of your data. A correction may be considered, for example, if the data is incorrect. Data must be deleted if the legal basis for the collection or storage no longer exists and there is no legal retention obligation.

Your rights in detail:

• Information (Art. 15 GDPR): You have the right to request information about whether and which personal data we process about you.
• Correction (Art. 16 GDPR): If your data is incorrect or incomplete, you can request its correction or completion at any time.
• Deletion (Art. 17 GDPR): Under certain conditions (e.g., if the purpose no longer exists or your consent is revoked), you have the right to request the deletion of your personal data ("right to be forgotten").
• Restriction of processing (Art. 18 GDPR): You can request that the processing of your data be restricted, e.g., if you dispute the accuracy of the data or an objection procedure is ongoing.
• Data portability (Art. 20 GDPR): You have the right to receive your provided personal data in a structured, commonly used, and machine-readable format and to transfer it to another controller.
• Objection to processing (Art. 21 GDPR): You can object to the processing of your personal data if it is based on legitimate interests or used for direct advertising. Please note that the revocation only takes effect for the future. Processing that took place before the revocation is not affected by it.
• Revocation of your consent (Art. 7 Abs. 3 GDPR): If you have given us your consent to data processing, you can revoke it at any time with effect for the future, without affecting the lawfulness of the processing carried out until then.

Please note that a revocation of consent may have an impact on your contractual relationship. If certain data processing is necessary for the execution or maintenance of the contract, a revocation may result in us not being able to provide our contractual services or only to a limited extent. In such cases, we reserve the right not to continue the contract if there is no other legal basis for data processing.

Data Protection Officer

You can reach our data protection officer at the following address with the addition "Data Protection Officer":

Prosperity Solutions AG
Feldkircher Strasse 31
9494 Schaan
Principality of Liechtenstein
Email: privacy@tpc.li

Swiss Data Protection Officer

In Switzerland, you can reach our representative appointed pursuant to Art. 14 of the CH DSG at the following address with the addition "Data Protection Officer":

prosperity solutions (Switzerland) AG
Gutenbergstrasse 10
8002 Zurich
Switzerland
Email: privacy@tpc.li

Data Protection Supervisory Authority

If you believe that Prosperity Solutions AG is not complying with applicable data protection regulations, we recommend that you first contact the responsible data protection officer mentioned above.

However, you can also file a complaint directly with the competent data protection supervisory authority:

Principality of Liechtenstein

Data Protection Authority (DSS)
Städtle 38
Postfach 684
FL-9490 Vaduz
https://www.datenschutzstelle.li

Switzerland

Federal Data Protection and Information Commissioner
Feldeggweg 1
CH-3003 Bern
https://www.edoeb.admin.ch/de

Update of this Privacy Policy

This privacy policy may be amended at a later date due to changes, e.g., in the statutory provisions. A current version of the information sheet and the service providers with which there are not only temporary business relationships can be obtained on our websites under the heading "Privacy Policy."

Use of the Application of Prosperity Solutions AG

Below you will find additional information on the procurement and processing of personal data collected via the application/website of Prosperity Solutions AG and related services (hereinafter also "Website" or "Partner Life").

For Partner Life, the controller of data processing is:

Prosperity Solutions AG
Feldkircher Strasse 31
9494 Schaan
Principality of Liechtenstein
Email address: privacy@tpc.li

Processing of Your Personal Data in Connection with the Use of Partner Life

Information Automatically Collected When Using Partner Life

When you use Partner Life, we automatically collect certain data that is required in this context. This includes, for example, your device model, system version, and the IP address of your mobile device or computer. We process this data automatically to

• make Partner Life available to you,
• improve the functions and performance of Partner Life, and
• prevent and remedy any misuse and/or malfunctions.

Insofar as the GDPR is applicable, this processing is justified by the fact that it is necessary for the fulfillment of the contract between you and us pursuant to Art. 6 Abs. 1 lit. b GDPR.

Processing of Your Personal Data When Using Our Services in Partner Life

We offer services in Partner Life (e.g., creation of a user account, possibility to contact us, conclusion and management of contracts) and ask you to provide personal data when using them. The required information is always marked as a mandatory field. Without this information, we are not able to provide the desired service or answer your inquiries. This concerns data from you that you have directly provided, such as surname, first name, gender, telephone number, email address, details for login and password, and investment interest.

We store the data you enter for the period in which you use your user account and beyond in accordance with legal retention obligations.

You can manage and change all information in the protected customer area at any time.

The legal basis for data processing, insofar as the GDPR is applicable, is Art. 6 Abs. 1 lit. b GDPR, as it serves to ensure the efficient provision and management of the user account within the framework of the contract between you and us. Unless exceptions apply within the services mentioned below, your personal data will be stored until you either delete the data or delete your user account as a whole. Your personal data will be deleted within 90 days of deleting your account. Legal retention obligations or the need to retain your personal data for legal action due to misconduct in connection with the use of the service or payment problems may require us to store your personal data for longer.

Please note that data entered on behalf of Liechtenstein Life Assurance AG via Partner Life (e.g., documents in connection with the adjustment of an address) is forwarded to Liechtenstein Life Assurance AG. In this case, Prosperity Solutions AG acts as a data processor for Liechtenstein Life Assurance AG, and the deletion periods of Liechtenstein Life Assurance AG apply to these processing operations.

Communication

We store and process the personal data that you provide to us when you contact us via the chat function or by email. We use this data only to answer your inquiry or to contact you and for the associated technical administration.

The legal basis for the lawfulness of this data processing, insofar as the GDPR applies, is Art. 6 Abs. 1 lit. b GDPR, because it serves to fulfill the contract between you and us or corresponding pre-contractual measures, and Art. 6 Abs. 1 lit. f GDPR, because the processing of these inquiries serves both your and our legitimate interest in communication and a lively exchange with you as well as in the further development of our offers. We also understand your use of the respective interaction channel as your consent (Art. 6 Abs. 1 lit. a GDPR) to data processing for the respective (specified) purpose.

After handling your inquiry, we store your personal data for a period of three years, beginning at the end of the calendar year in which the inquiry was resolved. We will then delete your data and/or only continue to store them if the law, statute, or contract prescribes retention periods or if we must continue to store the data to assert, exercise, or defend legal claims.

Electronic Communication and Associated Data Security

You have various options via Partner Life to contact Prosperity Solutions AG.

The personal data you transmit is protected by encryption mechanisms corresponding to the current security standard. Despite extensive technical and organizational security precautions, data may possibly be lost or intercepted and/or manipulated by unauthorized persons.

We are concerned about your data security and take appropriate technical and organizational security measures to prevent this within our systems.

Your computer is located outside the security area that can be controlled by Prosperity Solutions AG. It is up to you as a user to inform yourself about the necessary security precautions and to take appropriate measures in this regard. Prosperity Solutions AG is in no way liable for damages that may arise to you from data loss or manipulation. The Internet is a globally open network. If you transmit personal data via the Internet, you do so always at your own risk. In the case of unencrypted electronic communication, data can be intercepted and manipulated by third parties or lost.

Email and Chat

If you want to send an email or a chat message with confidential content to Prosperity Solutions AG, it should be encrypted to prevent unauthorized knowledge or falsification during transmission.

With unencrypted emails sent to Prosperity Solutions AG, it is not possible to guarantee data security, which is why Prosperity Solutions AG excludes all warranties and liability. As an alternative to encrypted email communication, we therefore recommend that you contact us directly via Partner Life.

WhatsApp Business

Partner Life also uses WhatsApp Business as a channel for the direct transmission of important information to partners. For example, to remind about upcoming appointments or to communicate issues that require immediate action.

If you contact us via WhatsApp Business, we collect the following data:

• Profile information: Your profile name on WhatsApp, your profile picture (if visible), and your telephone number.
• Communication data: The contents of your messages to us, including text, images, videos, voice messages, and documents.
• Metadata: Information about the use of WhatsApp, e.g., timing of messages, status messages (e.g., read/delivered), and technical information about your device.
• Optional: Other data that you voluntarily provide to us, e.g., your address, email address, or other contact data.

We process your data via WhatsApp for the following purposes:

• Communication with you: Answering your inquiries, processing your orders, providing customer service and support.
• Marketing (only with your consent): Sending information about our products and services, special offers, and promotions.
• Improvement of our offer: Analysis of the use of our WhatsApp Business account to optimize our communication and our service.

WhatsApp Business is only used with your explicit consent on the basis of Art. 6 Abs. 1 S. 1 lit. a GDPR.

Cookies and Similar Technologies

Information on cookies and similar technologies can be found below.

Name	Reason	Storage Period	Type
session-token	Authentication token	1 year	Technically necessary
active-session	Authentication token	1 year	Technically necessary
sessions	Authentication token	1 year	Technically necessary

Processing of Personal Data Through the Use of Service Providers

We use a number of cloud providers and tools to provide our services. These service providers process personal data on our behalf and according to our instructions. We have concluded appropriate data processing agreements (DPA) with all service providers in accordance with Art. 28 GDPR to ensure the protection of your personal data.

Amazon Web Services EMEA SARL (AWS)

We use services from Amazon Web Services EMEA SARL (AWS) as an infrastructure provider for the hosting, storage, and processing of personal data of our Partner Life application. AWS provides us with the technical infrastructure (servers, databases, storage services, etc.) on which our applications and data are operated.

In connection with the use of AWS, we may collect the following data categories:

• Identification data: e.g., name, email address, telephone number, user ID, device ID.
• Demographic data: e.g., age, gender, location
• Log data

We store the personal data in the AWS infrastructure.

We process your personal data using AWS for the following purposes:

• Provision of our online offerings,
• Hosting our application
• Storage of data
• Execution of backend processes.

Insofar as the GDPR applies, the legal basis for our processing is Art. 6 Abs. 1 lit. b GDPR (contract fulfillment) or Art. 6 Abs. 1 lit. f GDPR (legitimate interest in efficient and secure operation of our services).

Data transfer to third countries: A data transfer to the USA is not excluded by the use of AWS. If a transfer takes place, it is done on the basis of the standard contractual clauses of the EU Commission (SCCs), which AWS has assured as a binding guarantee for an adequate level of data protection. The standard contractual clauses do not apply to a data transfer if AWS has introduced binding internal data protection regulations for data processors (Binding Corporate Rules for Processors) or an alternative recognized compliance standard for lawful data transfers. AWS is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.

Google Cloud Platform (GCP)

We use services from Google Cloud Platform (GCP), offered by Google Cloud EMEA Limited as an infrastructure provider for Partner Life. GCP offers similar infrastructure services as AWS.

Similar to AWS, the processed personal data may be log data, identification data, or demographic data.

We process your personal data using GCP for the following purposes:

• Provision of backend services
• Provision of AI services
• Storage and processing of application data.

Insofar as the GDPR applies, the legal basis for our processing is Art. 6 Abs. 1 lit. b GDPR (contract fulfillment) or Art. 6 Abs. 1 lit. f GDPR (legitimate interest in efficient and scalable operation of our services).

Data transfer to third countries: A data transfer to the USA may take place. The transfer is done on the basis of the standard contractual clauses of the EU Commission (SCCs). GCP is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.

Prosperity copilot: Partner Life has an integrated chat function for communication. This chat function includes an artificial intelligence (AI) called 'prosperity copilot', which also runs on GCP. The prosperity copilot categorizes your inquiries and forwards them accordingly to the responsible department.

Vercel

Partner Life uses Vercel, Inc. for the delivery of our frontend applications and static content. Vercel offers a global Content Delivery Network (CDN) and Edge Functions to deliver content quickly and efficiently to end users worldwide.

Vercel processes IP addresses, browser information, access times, visited pages (technical access data), as well as the static content and possibly personal data that are forwarded via our serverless functions. Vercel stores our content and forwards requests to our backend systems.

We process your personal data using Vercel for the following purposes:

• Fast and efficient delivery of our web content
• Performance optimization and load distribution.

Insofar as the GDPR applies, the legal basis for processing is Art. 6 Abs. 1 lit. f GDPR (legitimate interest in providing a secure application).

Data transfer to third countries: Due to the global CDN, a data transfer to third countries outside the EU/EEA, including the USA, may take place. The transfer is done on the basis of the standard contractual clauses of the EU Commission (SCCs). Vercel is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.

Microsoft Azure

We use services from Microsoft Ireland Operations Limited as an infrastructure provider for our application.

Similar to AWS and GCP, the personal data processed in this context may be log data, application data, authentication data, or other personal data stored by us in Azure.

The purpose of processing is the provision and operation of specific applications or functions, including data storage as well as AI applications.

Insofar as the GDPR applies, the legal basis for processing is Art. 6 Abs. 1 lit. b GDPR (contract fulfillment) or Art. 6 Abs. 1 lit. f GDPR (legitimate interest in stable and efficient operation).

Data transfer to third countries: A data transfer to the USA may take place. The transfer is done on the basis of the standard contractual clauses of the EU Commission (SCCs). Microsoft is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.

Qovery

We use services from Qovery SAS as a platform for automated deployment and management of our products (e.g., Prosperity App, PS Suite, Partner Life). Qovery supports us in reliably rolling out applications, provisioning infrastructure resources, orchestrating deployments, consistently managing environments, and ensuring stable operations.

The data processed includes in particular technical system and performance data, such as configuration and deployment settings, log data, metadata on infrastructure resources, version and build information, IP addresses (possibly pseudonymized), user agent data, technical identifiers such as service or container IDs, and error messages without personal content. We strive to minimize the transfer of directly identifiable personal data to Qovery.

The purpose of processing is the provision, automation, and monitoring of our deployments, ensuring stable operation of our applications, error diagnosis and resolution, optimization of our infrastructure, and ensuring an efficient and secure development and execution environment.

Insofar as the GDPR applies, the legal basis for this processing is Art. 6 Abs. 1 lit. f GDPR (legitimate interest in secure, stable, efficient, and scalable provision of our services).

Data transfer to third countries: A transfer to the USA may take place. The transfer is done on the basis of the standard contractual clauses of the EU Commission (SCCs). Qovery is also certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.

PostHog

Partner Life uses PostHog, Inc. to analyze user behavior in order to improve our products. We use PostHog in a privacy-friendly configuration: The analysis is based exclusively on data that is transmitted from our own servers to PostHog (so-called backend tracking). No code from PostHog is executed on your end device, and no cookies are set by PostHog.

In connection with the use of PostHog, we may process the following data categories:

Browser and device data, referrer URL, timestamp, click paths, visited pages, interactions with the application (e.g., button clicks, form interactions), possibly pseudonymous user IDs.

We have configured PostHog so that IP addresses are anonymized before they are stored and no directly identifiable data is processed without your explicit consent.

Purpose of processing: Analysis of user behavior to optimize and improve our application.

Insofar as the GDPR applies, the legal basis for this processing is our legitimate interest in analyzing and optimizing our offer pursuant to Art. 6 Abs. 1 lit. f GDPR. Since there is no direct access to your end device, your interests and fundamental freedoms do not outweigh our interest in this pseudonymized analysis.

Data transfer to third countries: A data transfer to the USA takes place. The transfer is done on the basis of the standard contractual clauses of the EU Commission (SCCs). PostHog is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.

Braze

We use the services of Braze, Inc. as a technical service provider for our customer communication via email. Braze is used by us exclusively for sending emails; there is no independent data collection by Braze on our website or in our app.

We process your email address and contents of the respective communication using Braze for the following purposes:

• Sending necessary transactional emails: This includes communications that are necessary for the fulfillment of our contract with you (e.g., confirmations, security-relevant information). The legal basis for this, insofar as the GDPR applies, is Art. 6 Abs. 1 lit. b GDPR.
• Sending marketing information: If you have given us your express consent for this, we use Braze to send information about our products and offers. Insofar as the GDPR applies, the legal basis for this is your consent pursuant to Art. 6 Abs. 1 lit. a GDPR.

Insofar as the GDPR applies, the legal basis for the processing of your data is our legitimate interest pursuant to Art. 6 Abs. 1 lit. f GDPR (e.g., to improve our services and for personalized advertising, provided that your interests do not outweigh) as well as your explicit consent pursuant to Art. 6 Abs. 1 lit. a GDPR (e.g., for receiving newsletters or push notifications).

Data transfer to third countries: A data transfer to the USA takes place. The transfer is done on the basis of the standard contractual clauses of the EU Commission (SCCs). Braze is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.

Functional Software, Inc. (Sentry)

We use Functional Software, Inc. d/b/a Sentry ("Sentry") for error monitoring of our software and applications (including Partner Life). Sentry helps us detect and fix technical problems and errors in real time to ensure the stability and user-friendliness of our services.

When errors or performance problems occur, technical data such as error messages, stack traces (error logs), device information (operating system, browser version), app version, date and time of the error can be transmitted to Sentry.

The purpose of this processing is error detection and correction, improvement of application stability, optimization of performance.

Insofar as the GDPR applies, the legal basis for the processing of your data is Art. 6 Abs. 1 lit. f GDPR (legitimate interest in ensuring the technical functionality and security of our services as well as improving the user experience).

Data transfer to third countries: A data transfer to the USA takes place. The transfer is done on the basis of the standard contractual clauses of the EU Commission (SCCs). Functional Software, Inc. (Sentry.io) is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.

Salesforce

Partner Life uses the services of SFDC Ireland Limited (Salesforce) as a Customer Relationship Management (CRM) system. Salesforce supports us in managing our customer relationships, sales processes, marketing activities, and customer service.

Salesforce processes your contact data (e.g., name, email address, telephone number, address), communication history (e.g., emails, telephone notes, chat logs), inquiries and support cases, contract data, payment data, preferences and interests, as well as marketing and sales data. This data is provided to us directly by you or arises in the course of using our services.

The purpose of this processing is the management of customer and prospect relationships, execution of sales and service processes, marketing communication, customer support and service, internal analysis for process optimization.

The legal basis, insofar as the GDPR applies, for the processing of your data is Art. 6 Abs. 1 lit. b GDPR (contract fulfillment or pre-contractual measures, e.g., for existing customers or prospects), Art. 6 Abs. 1 lit. f GDPR (legitimate interest in efficient and centralized management of our customer relationships and business processes), or Art. 6 Abs. 1 lit. a GDPR (consent, e.g., for certain marketing communication).

Data transfer to third countries: A data transfer to Salesforce in the USA may take place. The transfer is done on the basis of the standard contractual clauses of the EU Commission (SCCs). Salesforce is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.

Salesforce Pardot

Partner Life uses the services of the analysis tool Pardot to send newsletters. The provider is Salesforce.com, Inc.

Pardot enables Partner Life to analyze its newsletter campaigns. When you open an email sent by Pardot, a file contained in the email, so-called web beacons or tracking pixels, is loaded. These are one-pixel image files that are stored on the website. For evaluation purposes, the access data and the web beacons are linked to your email address and an individual ID. This makes it possible to determine whether a newsletter message has been opened and which links may have been clicked. The results of the analyses can be used to better tailor future newsletters to the interests of the recipients.

If you do not want analysis by Pardot, you can object to this tracking at any time by clicking the separate link in each email or by informing us by email at privacy@partner.life.li. The data is stored as long as you are subscribed to the newsletter. After unsubscribing, we store the data purely for statistical purposes and in an anonymized form.

YouSign

We use YouSign SAS for providing solutions for the electronic signature of documents. This enables us and our contractual partners to digitally sign contracts and other documents.

For a signature process, your name, email address, IP address, date and time of signature, information on the signature process (e.g., authentication methods), metadata of the signed document, as well as the personal data of the signatories contained in the document itself are processed.

The purpose of processing is to enable and execute legally secure electronic signatures of contracts and documents, proof of validity of signatures, archiving of signed documents.

Insofar as the GDPR applies, the legal basis for this processing is Art. 6 Abs. 1 lit. b GDPR (contract fulfillment, as the electronic signature is necessary for the execution of contracts), Art. 6 Abs. 1 lit. c GDPR (fulfillment of legal obligations, e.g., proof obligations), or Art. 6 Abs. 1 lit. a GDPR (your consent to the digital conclusion).

Yousign is a French company with servers within the EU. A data transfer to third countries outside the EU/EEA does not take place.

Heyflow

We use the services of heyflow GmbH for the collection and processing of your contact request via the web form.

For this purpose, we process your data collected in the contact form (name, email, telephone number), answers to questions asked, entries in free text fields, as well as technical data such as IP address (possibly shortened), time of access, and device data.

The purpose of processing is the collection of user information for contact, provision of information or offers, and conduct of surveys.

The legal basis, insofar as the GDPR applies, for this processing is Art. 6 Abs. 1 lit. a GDPR (consent, which is given by your active entry in the form and submission).

Heyflow is a German company. A data transfer to third countries generally does not take place.

Tally BV

We use the services of Tally BV for the creation and operation of online surveys, in particular for conducting partner surveys. Tally BV provides us with a platform through which we can create and evaluate forms and surveys.

In connection with the use of Tally BV we may process the following data categories: name and email address of the participating partners as well as the answers to the questions asked.

The purpose of processing is the conduct and evaluation of partner surveys to improve our services and products as well as to maintain partner relationships.

Insofar as the GDPR applies, the legal basis for this processing is your consent pursuant to Art. 6 Abs. 1 lit. a GDPR. Participation in partner surveys is voluntary. You can revoke your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out until the revocation.

We have concluded a data processing agreement (DPA) with Tally BV pursuant to Art. 28 GDPR.

Tally BV is a Belgian company based in Belgium (EU). A data transfer to third countries outside the EU/EEA does not take place.

Calendly

We use services from Calendly LLC to enable you to book and coordinate appointments easily. Calendly manages our availability and facilitates the booking process.

When you book an appointment via Calendly, the following data may be processed: your name, email address, telephone number (if provided), details of the booked appointment (date, time, topic of the appointment), and any other information you voluntarily provide in the booking form. Calendly also collects technical data such as IP address and device information to provide the service.

The purpose of processing is to enable and manage online appointment booking, efficient coordination of meetings, and communication regarding booked appointments.

Insofar as the GDPR applies, the legal basis for processing is Art. 6 Abs. 1 lit. b GDPR (contract fulfillment or pre-contractual measures, as the appointment booking directly serves the initiation or fulfillment of a service/contract) or Art. 6 Abs. 1 lit. a GDPR (consent, if the appointment booking takes place purely voluntarily and there is no direct contractual reference).

Data transfer to third countries: A data transfer to the USA takes place. The transfer is done on the basis of the standard contractual clauses of the EU Commission (SCCs). Calendly LLC is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.

New Relic

We use services from New Relic, Inc. as a monitoring provider for infrastructure. New Relic helps us analyze the performance of our systems, detect and fix errors, and improve the overall user-friendliness of our services.

Data processed in this way includes technical performance data such as CPU utilization, memory usage, network traffic, application response times, database queries, error messages (without personal content), log data, IP addresses (possibly pseudonymized), session IDs, user agent information. We try to minimize the transmission of directly identifiable personal data to New Relic.

The purpose of processing is monitoring the technical performance and availability of our systems, error diagnosis and correction, capacity planning, optimization of application performance.

Insofar as the GDPR applies, the legal basis for this processing is Art. 6 Abs. 1 lit. f GDPR (legitimate interest in ensuring the technical stability, security, and efficiency of our services).

Data transfer to third countries: A data transfer to the USA takes place. The transfer is done on the basis of the standard contractual clauses of the EU Commission (SCCs). New Relic is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.

Twilio (Sendgrid)

Prosperity App uses the services of Twilio Ireland Limited, in particular the SendGrid service, for sending emails. This includes both transactional emails (e.g., confirmations, password resets, notifications about your account) as well as marketing emails (if you have consented to this).

This processes your email address, name (if provided), contents of emails, timing of sending, delivery status of emails, and possibly technical metadata of email communication.

The purpose of processing is technical email sending, communication with users and customers, marketing communication.

The legal basis, insofar as the GDPR applies, for processing is Art. 6 Abs. 1 lit. b GDPR (for transactional emails that are necessary for contract fulfillment), Art. 6 Abs. 1 lit. a GDPR (for marketing emails based on your consent), or Art. 6 Abs. 1 lit. f GDPR (legitimate interest in efficient and reliable communication with our users).

Data transfer to third countries: A data transfer to Twilio Inc. in the USA is not excluded. The transfer is done on the basis of the standard contractual clauses of the EU Commission (SCCs). Twilio Inc. is certified under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.

IDenfy

We use services from iDenfy, UAB for conducting online identification processes. This serves to verify your identity as part of our restoration of access to the prosperity app and for customer onboarding.

This processes your name, date of birth, address, nationality, gender, copies of identity documents (e.g., identity card, passport), photos or video recordings of your face (possibly with biometric features), information about your device and your IP address, as well as data from the identification process itself (e.g., time of identification) by iDenfy.

The purpose of processing is legally secure and reliable identity determination and verification to fulfill legal obligations (e.g., Anti-Money Laundering Act) or for contract fulfillment.

Insofar as the GDPR applies, the legal basis for this processing is Art. 6 Abs. 1 lit. c GDPR (fulfillment of legal obligations).

iDenfy is a company based in Lithuania. A data transfer to third countries generally does not take place.

IDNow

We use services from IDnow GmbH for conducting online identification processes. This serves to verify your identity as part of our restoration of access to the prosperity app and for customer onboarding.

This processes your name, date of birth, address, nationality, gender, copies of identity documents (e.g., identity card, passport), photos or video recordings of your face (possibly with biometric features), information about your device and your IP address, as well as data from the identification process itself (e.g., time of identification) by IDnow.

The purpose of processing is legally secure and reliable identity determination and verification to fulfill legal obligations (e.g., Anti-Money Laundering Act) or for contract fulfillment.

The legal basis, insofar as the GDPR applies, is Art. 6 Abs. 1 lit. c GDPR (fulfillment of legal obligations).

IDnow is a German company. A data transfer to third countries generally does not take place.

Advertising Information via Email or Chat

If you have consented to receive news about products or services we offer by email, we process your email address and possibly the information stored in your user account on the basis of your corresponding consent in order to provide you with information about our services, products, and special offers in the areas of life insurance and retirement provision.

You can unsubscribe from all emails that are not absolutely necessary at any time. We may also evaluate the data generated when sending and retrieving our emails for analysis purposes and to improve our communication.

Your personal data will not be disclosed to third parties in connection with an email subscription, with the exception of technical service providers that enable us to send communications and analyze the results of these communications.

In this regard, we process your data only on the basis of the consent you have given to select customized content and send news about products and services. The legal basis for processing, insofar as the GDPR applies, is Art. 6 Abs. 1 lit. a GDPR.

When Subscribing to the Newsletter

In addition to the purely informational use of our website, we offer the subscription to our newsletter, with which we inform you about current developments (products, funds, etc.) as well as events. If you subscribe to our newsletter, we collect, store, and further process the following data for the purpose of sending electronic mail (newsletter): the page from which the page was requested (so-called referrer URL), the date and time of the call, the description of the type of web browser used, the IP address of the requesting computer, which is shortened so that a personal reference can no longer be established (anonymized data), the email address, first name, last name, company and position, the date and time of registration and confirmation.

You can revoke your consent to the transmission of the newsletter at any time and unsubscribe from the newsletter. You can carry out the revocation by email to the address given above.

Registration for Webinars

On our website, there is also the option to register for webinars.

We use the Livestorm platform to offer webinars. Livestorm is a service of Livestorm SAS. When using Livestorm, certain personal data is processed and stored. This data includes, among other things, registration data and usage data. The purpose of data processing is the execution and provision of webinars, communication with participants, improvement of our webinar processes and services.

The processing of this data is based on your consent (insofar as the GDPR applies, Art. 6 Abs. 1 lit. a GDPR) as well as on our legitimate interest in offering webinars efficiently and effectively (insofar as the GDPR applies, Art. 6 Abs. 1 lit. f GDPR).

In the course of conducting our webinars, it may be necessary to forward personal data of participants (such as first and last name, date of birth, training name and date, education time, gut-beraten ID) to a competent certification body. This serves the purpose of proving participation in the seminar and, if necessary, issuing a corresponding certificate or certification. The forwarding of this data is based on our legitimate interest pursuant to Art. 6 Abs. 1 lit. f GDPR, as we are obliged to document proper participation and the receipt of certificates and to prove this to the certification body.

Your data will be passed on to Livestorm SAS, as they act as service providers for the technical processing of the webinars.

For more information on data protection at Livestorm, please visit the privacy policy of Livestorm. Information on this is linked during registration.