1. Introduction

Avallone ApS, CVR: 41146567 (“Avallone ”, "us", "we", or "our") operates the Avallone.com website and the Avallone platform (KYC Hub, KYC Responder andKYC Collector). This Privacy Policy (the ”Policy”) applies for:

● Visitors to the Avallone website and customers and leads registered in our CRM system;

● Companies (as customers) using our KYC Platform

● Recruitment candidates

In this Policy, we provide you with information on the processing of your personal data, and to help you understand the rights you have in connection with your personal data. You will always be able to find the latest updated Policy on our website (which is this page).

2. What is Personal Data and what is processing of personal data?

Personal data is widely defined by European data privacy law and includes all types of information that directly or indirectly can identify a natural person. This means that name, address, phone number are considered personal data, but that log data, encrypted data or other types of electronic ID such as an IP-address can also be classified as personal data, if they can be connected to a natural person. Processing is similarly defined very widely by European law and includes almost every action taken in relation to personal data - for example collection, registration, organization, structuring, storage, adaption, transfer or deletion.

3. What does this Policy cover?

This Policy concerns data for which Avallone is a data controller and where we decide the purpose and means by which personal data is processed.This Policy does not cover personal data that we process on behalf of our customers - the legal agreements which relate to this processing are part of the overall legal agreements we have with each customer - including the data processing agreement.

4. Overview of the processing activities

In this overview, we explain which personal data we collect and process for which purposes. We also explain on which legal basis we do so, and we describe for how long we process the personal data.

5. Sharing of data with 3rd parties

We transfer the personal data to our data processors who host and provide support for the use of all our IT systems. We do not transfer the personal data to any recipients located in countries outside the EU/EEA.

6. Retention period

We store the personal data for as long as necessary to archive the purposes of processing described in this Policy. Please consult the above overview for details on the retention periods relevant for the different categories of personal data. We assess the necessity of storing personal data regularly.

7. Your rights

While Avallone is in control of some of your personal data, it’s important that you know that you have a range of important rights under EU law. Please note that there are exceptions to these rights, so access may be denied, e.g. where we are legally prevented from making a disclosure.

Right to be informed:

You have the right to be informed about how we process your personal data. This is done via this Policy. You are always welcome to contact us if you have any further questions.

Right of access:

You have the right to access the personal data that we hold about you and may receive a copy of the personal data that we hold about you. For any further copies, we reserve the right to charge a reasonable fee based on our administrative costs. To exercise this right, please contact us as set out below. Please note that most personal data that we process about you is visible for you on the Avallone platform. This right means that you have a right to receive a confirmation about what personal data we process about, get access to your personal data, and receive supplementary information (which corresponds to the information that is provided in this Policy). Please note that we may ask you to provide further information about yourself in order for us to be able to identify you and handle the request in an efficient and secure way. This will sometimes oblige you to send in a signed copy of a valid ID.

Right to rectification:

We ensure that inaccurate or incomplete personal data is erased or rectified. You have the right to rectification of any inaccurate or incomplete personal data that we hold about you.

Right to erasure of your personal data (”Right to be forgotten”):

You have the right to erasure if the personal data is no longer necessary for the purposes it was collected or processedf or (and no new lawful purpose exists), your particular situation gives you the right to object to processing on grounds of legitimate interest (see more below) and there is no justified reason for continuing the processing, the lawful basis for the processing is your consent, and you withdraw your consent, and no other lawful grounds exist, processing the personal data has been unlawful, or there is a legal obligation for us to erase the data.

Right to restrict the processing of your personal data:

You have the right to request us to restrict the processing of your data (meaning that the personal data may only be held by us and may only be used for limited purposes) if the personal data we have about you is inaccurate, the processing is unlawful and you ask us to restrict the use of the personal data instead of erasing it, we no longer need the personal data for the purposes of the processing, but if we still need it for the establishment, exercise or defence of legal claims, or you have objected to the processing claiming that the legal basis of legitimate interest is invalid and are waiting for the verification of this claim.

Right to object to the processing of your personal data:

Where our lawful basis for processing your data is our legitimate interests, you have the right to object to the processing of your data if you can show that your interests, rights and freedoms regarding the personal data outweigh our interest to process your personal data, or we process your personal data for direct marketing purposes, including but not limited to profiling. This means that we will cease such processing unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or require the personal data in order to establish, exercise or defend legal rights. If you choose to object to our further processing of your personal data as described in this Policy, please note that we may no longer be able to provide you with the services you have requested and may therefore terminate relevant agreements with you, see relevant terms and conditions for more information. In addition, we may continue to process your personal data for other legitimate purposes, such as to fulfil an agreement with you, to protect our interests in connection with legal proceedings and to fulfil our legal obligations. If you have received marketing from us, you may at any time object to the marketing by contacting us at privacy [at] avallone [dot] io or opt out by following the instructions in the marketing material.

Right to data portability:

You have the right to data portability for personal data that you provided to us, and if the legal basis for the processing of the personal data is the fulfilment of contract or consent. We will send a copy of your data in a commonly used and machine-readable format to you or a person/organization appointed by you, where technically feasible and where the exercise by you of this right does not adversely affect the rights and freedoms of others.

8. How to exercise your rights

Send us an email at privacy [at] avallone [dot] io or a letter to Avallone ApS, Rahbeks Allé 21, 1801 Copenhagen, Denmark. If you are unhappy with our processing of your personal data you may lodge a complaint with or contact the Danish Data Protection Authority (Datatilsynet), at dt@datatilsynet.dk or Borgergade 28, 1300 København K, Denmark, phone no. +45 33 19 32 00. You may also seek a remedy through local courts if you believe your rights have been breached.

9. Changes to this Privacy Policy

We may update this Policy from time to time. Where possible and appropriate, we will notify you directly by email. We will also notify you of any changes by posting the new Policy on this page. You are advised to review this Policy periodically for any changes. Changes to this Policy are effective when they are posted on this page.

‍

Last updated: 2026 January 02