6. Profiling and automated decisions by Klarna that significantly affect you.

6.1 Profiling by Klarna on you as a customer.

"Profiling" means automated processing of personal data aimed at evaluating certain personal matters, for example by analyzing or predicting your personal preferences, such as your shopping interests. At the same time, we compare your data with what our other customers, having a similar use of our services, have preferred.  

The purpose of Klarna's profiling and the categories of personal data used on each occasion and for each profiling are described in detail in the  section 3 . Profiling for these purposes has no significant impact on you as a customer.

We use profiling for the following purposes:

• to provide our personalized services, which personalize their content according to what we believe will be of most interest to you (this applies to the Klarna mobile application, its various functions and the order in which the different modes of payment appear at the Klarna checkout), and

• to offer you personalized marketing.

If you have any questions about how the profiling process works, please contact us. Contact information is available in the  section 12 . You can object to our profiling for marketing purposes at any time by contacting us (and we will then stop profiling for marketing purposes). You can also end our profiling for our services by terminating the service.

6.2 Automated Decisions by Klarna that Significantly Affect You.

Automated decisions with legal consequences, or automated decisions that significantly affect you in a similar way, means that certain decisions in our services are completely automated, without our employees being involved. These decisions have a significant effect on you as a customer, comparable to legal consequences. By making these decisions automatically, Klarna increases its objectivity and transparency in the decision to offer you these services. At the same time, you have the right to object to these decisions at any time. Later in this section you will find a description of how to object to these decisions.

Automated decisions that significantly affect you also mean that profiling is done based on your data before the decision is made. This profiling is carried out to assess your financial situation (before the decision to grant credit) or to identify whether your use of our services involves a risk of fraud or money laundering. We build a profile of your user behavior and financial situation and compare this data with behaviors and conditions that indicate different levels of risk to us.  

We make this type of automated decision when we:

• decide to approve your request to use a credit service.

• decide not to approve your request to use a credit service.
  These automated credit decisions are based on data you provide, data from external sources such as credit reporting agencies, and internal information from Klarna. In addition to information about you, Klarna's credit model includes many other factors, such as Klarna's internal credit risk levels and our customers' general repayment rates (based, for example, on current product category).

• decide that you pose a risk of fraud, if our processing shows that your behavior indicates possible fraudulent conduct, that your behavior is not consistent with past use of our services, or that you have attempted to conceal your true identity. The automated decisions by which we assess whether you are at risk of fraud are based on information you provide yourself, data from fraud prevention agencies (see  section 7.2.3  to find out which ones we use) and Klarna internal information.

• decide that there is a risk of money laundering, if our processing shows that your behavior indicates money laundering. In relevant cases, Klarna also checks whether specific customers are on sanctions lists.  

The categories of personal data used in each decision are described in the  section 3 . See it  section 7  for more information about who we share profiling information with in automated decision-making.  

If you are not approved under the automated decisions described above, you will not have access to Klarna services, such as our payment methods. Klarna has several security mechanisms to ensure that decisions are appropriate. These mechanisms include ongoing reviews of our decision models and random sampling in individual cases. If you have any doubts about the result, you can contact us, and we will determine if the procedure was carried out correctly. You can also object by following the instructions below.

Your right to object to these automated decisions

You always have the right to object to an automated decision having legal consequences or to decisions that may significantly affect you (as well as the corresponding profiling) by sending an e-mail message to  protection-des-donnees@klarna.fr . A Klarna employee will then review the decision, taking into account the additional information and circumstances you provide to us.

7. Who do we share your personal data with?

When we share personal data about you, we ensure that the recipient treats it in accordance with this statement, for example by entering into data transfer agreements or data processing agreements with the recipients. These agreements include all reasonable contractual, legal, technical and organizational measures to ensure that your information is treated with an adequate level of protection and in accordance with applicable law.  

7.1 Categories of recipients with whom Klarna will always share your personal information, regardless of the service you use.

7.1.1 Suppliers and subcontractors.  

Description of recipient: Suppliers and processors are companies that are only entitled to process the personal data they receive from Klarna on behalf of Klarna, i.e. processors of data. Software and data storage vendors, payment service providers, and business consultants are examples of such vendors and contractors.

Purpose and legal basis: Klarna needs access to services and features of other companies when it cannot achieve them itself. Klarna has a legitimate interest in being able to access these services and functionalities (Article 6(1)(f) of the GDPR). We ensure that the processing this involves is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for that purpose. You have the right to object to this processing, for reasons relating to the circumstances of your particular case. See it  section 2  for more information on your rights.

7.1.2 Klarna Group.  

Description of recipient: Klarna Group companies.

Purpose and legal basis: This is necessary for Klarna to provide services and features to you. Klarna has a legitimate interest in being able to access these services and functionalities (Article 6(1)(f) of the GDPR). We ensure that the processing this involves is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for that purpose. You have the right to object to this processing, for reasons relating to the circumstances of your particular case. See it  section 2  for more information on your rights.  

7.1.3 A person who holds power of attorney for your financial affairs.  

Description of recipient: Klarna may share your personal information with a person who has the right to access it under a power of attorney.  

Purpose and legal basis: This processing is carried out to facilitate your contact with us (through agents), and is carried out on the basis of your consent (Article 6(1)(a) of the GDPR).

7.1.4 Authorities.  

Description of the recipient: Klarna can provide necessary information to authorities such as the police, financial authorities, tax authorities or other authorities and courts.  

Purpose and legal basis: Personal data is shared with the authority when we are required by law to do so, or in certain cases if you have asked us to do so, or if it is necessary to manage tax deductions or the fight against crime. An example of a legal obligation to provide information is when it is necessary to take action against money laundering and terrorist financing. In France, Klarna reports identified payment incidents to the Banque de France under the conditions specified by the decree of October 26, 2010 relating to the national file of personal loan repayment incidents (FICP). Depending on the authority and purpose, the legal grounds are the obligation to comply with the law (Article 6(1)(c) GDPR), to perform the contract with you (Article 6(1) (b) GDPR), or Klarna's legitimate interest in protecting itself against crime (Article 6(1)(f) GDPR).

7.1.5 Disposal of Business or Assets.

Description of recipient: In the event that Klarna sells business or assets, Klarna may pass your personal information to a potential buyer of such business or assets. If Klarna or a significant portion of Klarna's assets are acquired by a third party, personal information about Klarna's customers may also be shared.

Purpose and legal basis: Klarna has a legitimate interest in being able to carry out these transactions (Article 6(1)(f) GDPR). We ensure that the processing this involves is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for that purpose. You have the right to object to this processing, for reasons relating to the circumstances of your particular case. See it  section 2  for more information on your rights.

7.2 Categories of recipients with whom Klarna shares your personal information when you use Klarna's payment methods, sign in with Klarna in a store, or choose to pay by debit or credit card at the Klarna checkout in a store.

7.2.1 Stores.

Description of recipient: By stores we mean the stores you visit or shop at (which may include the store's group companies if the store has notified you of this).

Purpose and legal basis: In order for the store to make and manage your purchase and your relationship with the store or its group companies, for example by confirming your identity, sending goods, dealing with questions and disputes, in order to prevent fraud and, where appropriate, to send relevant advertising messages. This Store Privacy Statement applies to the processing of personal data about you that has been shared with the Store and that the Store processes. Normally, you will find a link to the store's privacy statement on the store's website. The legal basis for sharing data with stores is partly the performance of a contract (Article 6(1)(b) GDPR), as the sharing of data takes place to perform the contract between you and the store, and partly based on the legitimate interest of Klarna and the store (Article 6(1)(f) GDPR). We ensure that the processing this involves is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for that purpose. You have the right to object to this processing, for reasons relating to the circumstances of your particular case. See it  section 2  for more information on your rights.

7.2.2. Payment service providers and financial institutions.

Recipient Description: Payment service providers and financial institutions provide services to you, stores and Klarna to implement and administer electronic payments through various payment methods, such as as credit cards and bank payment methods, such as direct debit and bank transfer.  

Purpose and legal basis: Some stores use payment service providers with whom they share your information for the management of your payment. This sharing takes place in accordance with the stores' privacy statements. The store may also allow Klarna to share your information with the payment service provider they use to process your payment. Some payment service providers also collect and use your information independently, in accordance with their own privacy statements. This is the case, for example, of providers of digital wallets. Additionally, Klarna may share your information with other financial institutions when they transact with your account, in order to complete those transactions. Sharing with payment service providers and financial institutions is done to complete a transaction initiated by you and is done to perform the contract with you (Article 6(1)(b) GDPR).  

7.2.3 Fraud prevention agencies and companies providing identity checks.

Description of recipient: Personal data about you is shared with fraud prevention agencies and companies that provide identity checks.  

Purpose and legal basis: Klarna shares your information to verify your identity, the accuracy of the data you have provided and to combat criminal and fraudulent activity. The companies we work with are listed  here . Please note that these companies may process your data in accordance with their own data privacy statements.

Klarna shares your information based on Klarna's legitimate interest in conducting its business (Article 6(1)(f) GDPR), as fraud prevention agencies and companies providing identity checks have information about fraud activity and identity confirmation that is important for Klarna to use as data to decrease its level of fraudulent transactions. We ensure that the processing this involves is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for that purpose. You have the right to object to this processing, for reasons relating to the circumstances of your particular case. See it  section 2  for more information on your rights. You can also contact the entities listed in the link above, to exercise the same rights as those set out in  section 2  also against these entities.

7.2.4 Google.

Description of the recipient: When you use Google Maps during your order (for example, by searching for your address in the address bar), your personal information is shared with Google. Google will process your data in accordance with the  Terms of use  and to  confidentiality rules  from Google Maps/Google Earth.  

Purpose and legal basis: Klarna shares this information on the basis of Klarna's legitimate interest in conducting its business (Article 6(1)(f) GDPR), as Google Maps provides address functionality when checkout. We ensure that the processing this involves is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for that purpose. You have the right to object to this processing, for reasons relating to the circumstances of your particular case. See it  section 2  for more information on your rights.

7.3 Categories of recipients with whom Klarna shares your data when you use one of Klarna's payment methods involving the granting of credit or when you use the Klarna card or the single-use card  

7.3.1 Debt collection companies (for unpaid debts).

Description of recipient: Klarna may need to share your information when we sell or outsource the collection of unpaid debts through a third party, such as a debt collection company.  

Purpose and legal basis: This data is shared for the recovery of your unpaid debts. Debt collection companies process personal data in accordance with their own privacy statements, or only on behalf of Klarna in their capacity as Klarna's data processor. This data is shared on the basis of our legitimate interest in collecting and selling debts (Article 6(1)(f) GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in collecting and selling receivables. We ensure that the processing this involves is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for that purpose. You have the right to object to this processing, for reasons relating to the circumstances of your particular case. See it  section 2  for more information on your rights.  

7.3.2 VISA and digital wallet providers.

Recipient Description: We share information about you and your purchases when you use the Klarna Card with VISA and with members of the VISA Card Network. If you also add the Klarna Card to your digital wallet, we may need to share your information with the provider of that wallet. In this case, the data will be processed in accordance with the privacy statement of this provider.

Purpose and legal basis: Sharing takes place to the extent necessary to carry out card transactions, prevent fraud and follow the rules of the VISA card network. If you renew your Klarna card or if you receive a new card, we will pass this information to VISA so that VISA can inform third parties with whom you have previously chosen to store your card information (for example, for transactions recurring). The sharing is done in order to perform the contract with you (Article 6(1)(b) GDPR).

7.3.3 Debt Acquirers (for Open Debts).

Description of recipient: Klarna can transfer your open debts to debt acquirers.

Purpose and legal basis: When transferring your debt to an acquirer and on an ongoing basis until you repay the debt, Klarna will share your contact and identifying information (name, date of birth, social security number, address and phone number), information about your financial situation (such as residual credit, repayments, and any negative payment history against current debt), and information about any goods or services associated with the debt. The buyer will process personal data concerning you in accordance with its own privacy statement, which you will be aware of at the time of the transfer of the debt.  

The sharing of personal data with different acquirers is based on our legitimate interest to sell unpaid receivables in the context of our commercial activities (Article 6(1)(f) of the GDPR). We ensure that the processing this involves is necessary for the pursuit of this interest, and that our interest outweighs your right to object to the processing of personal data concerning you for this purpose. You have the right to object to this processing, for reasons relating to the circumstances of your particular case. See it  section 2  for more information on your rights.

7.4 Categories of recipients when using the Klarna accounts service (savings and payment accounts).

7.4.1 Credit institutions and other financial institutions.

Description of recipient: We share your information with credit institutions and other financial institutions (such as other banks) when you make transactions or payments on other accounts.

Purpose and legal basis: If you have made payments to a Klarna account, Klarna will process the information we receive from the bank you used for the transaction, such as contact and identification data and payment. If you transact or make payments to accounts at other banks, Klarna will also pass on some of your contact and identification data and payment information to the recipient, as well as to the credit institution or to the recipient's financial institution. The sharing is done in order to perform the contract with you (Article 6(1)(b) GDPR).

7.5 Categories of recipients with whom Klarna shares your personal information when you use the  Klarna Shopping Service.

7.5.1 Affiliate Networks.

Description of recipient: When you choose to click on a sponsored link in the Klarna mobile app or on our website that links to a store, product or service, you will be redirected to another company's website by through a third party, called an affiliate network.  

Purpose and legal basis: The Affiliate Network may place tracking technology on your device which contains information that you have clicked on this link in the Klarna mobile application, which is then used to document your visit to the store in order to calculate a potential commission due to Klarna.

The Affiliate Network may process your data in accordance with its own privacy statement. The processing is based on a balancing of interests (Article 6(1)(f), GDPR). When balancing interests, Klarna has determined that we have a legitimate interest in providing you with sponsored links to market stores in the Klarna mobile app and on our website. We ensure that the processing this involves is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for that purpose.  

You have the right to object to this processing, for reasons relating to the circumstances of your particular case. See it  section 2  for more information on your rights.

7.5.2 Google.

Description of the recipient: When you use the Klarna mobile application through our web portal, Google collects information about your device through the Google reCAPTCHA service implemented there, in some cases with additional information that you choose to enter in the reCAPTCHA service.  

Purpose and legal basis: Klarna processes this information on the basis of Klarna's legitimate interest in conducting its business (Article 6(1)(f) GDPR), as the reCAPTCHA service prevents misuse of our services (e.g. example by preventing robots from trying to connect). Google will process this information in accordance with  his  Terms of use  and to his  confidentiality rules . We ensure that the processing this involves is necessary to pursue that interest, and that our interest outweighs your right not to have your information processed for that purpose.

You have the right to object to this processing, for reasons relating to the circumstances of your particular case. See it  section 2  for more information on your rights.

7.5.3 Partners in the Personal Finance Service and in the Program of Offers and Benefits.

Description of recipient: Partners in the Personal Finances service and the offers and benefits program.  

Purpose and legal basis: If you choose to take advantage of Klarna's offers and benefits under the Personal Finance service or the offers and benefits program, Klarna will share the personal information necessary for you to take advantage of the offer with our business partners (including the fact that you are a customer of Klarna). Each offer specifies the data that will be shared. The data is shared in order to perform the contract between you and Klarna (Article 6(1)(b) GDPR).

7.5.4 Logistics and transport companies.

Description of recipient: Logistics and transport companies.

Purpose and legal basis: Klarna will share your personal information with the logistics and transport companies that deliver the goods you order if you have subscribed to package tracking. Contact and identification data and tracking numbers are examples of information we share.

Logistics and transport companies process your data in accordance with their own privacy statements. Sharing is done to perform the contract between you and Klarna (Article 6(1)(b) GDPR).  

7.6 Categories of recipients with whom Klarna shares your personal information if you contact our customer service via social media.

7.6.1 Social media.

Description of recipient: Social media companies such as Facebook, Instagram or Twitter.

Purpose and legal basis: If you contact us via social media such as Facebook or Twitter, personal data about you will also be collected and processed by these companies in accordance with their privacy statements. The sharing is done in order to perform the contract with you (Article 6(1)(b) GDPR).