Hoist Finance - Privacy Policy

Who are we?

We are Hoist Finance AB (publ), a Swedish listed company and parent company of the Hoist Finance Group.

What information do we collect – and why?

In this privacy policy, we describe the types of personal data we process, why we need it, and how long we store it.

1. Personal data in the recruitment process

When you apply for a job at Hoist Finance AB or any other company within the group —via either our website or an external recruitment partner — we need to process your personal data for the purpose of handling applications and selecting suitable candidates.

Type of information	Why we process it	Legal basis	How long we store the information
Contact details (e.g. name, address, telephone number, email) and CV information (e.g. work experience, education, qualifications, languages, identification number, cover letter)	To handle job applications and carry out selection processes	Performance of a contract	5 years after completion of recruitment (successful candidates), 2 years (other candidates)
Reference details	To assess your suitability for the position	Performance of a contract	5 years after completion of recruitment (successful candidates), 2 years (other candidates)
Information from background checks (e.g. identification number, population register, tax information, credit information, information about business involvement and legal proceedings)	To ensure that you are suitable for the position	Performance of a contract, legal obligation	Until recruitment process is completed

2. Personal data when subscribing to our mailings

When you register for our subscription service (to receive e.g. press releases, reports) we process your personal data solely for the purpose of providing the service.

Type of information	Why we process it	Legal basis	How long we store the information
Contact details (e.g. name, address, place of residence, country, telephone number, email address)	To send out mailings and reminders	Performance of a contract	30 days after the subscription has ended

Data security

We take several technical and organisational measures to protect your personal data against loss, unauthorised access, or misuse. Access is restricted to persons who require such access in their work and who comply with our instructions and confidentiality requirements.

We have procedures in place to deal with suspected data breaches and will notify you and the relevant authorities if required by law.

Your rights

You have several rights under data protection legislation:

Right of access: You can request a copy of the personal data we hold that pertains to you. We will respond within one month.
Right to rectification: You can ask us to correct or delete inaccurate data. If necessary, we may ask for additional information to confirm your request.
Right to restrict processing: You can ask us to pause all processing if you believe the information is incorrect, if it is being processed unlawfully, or if we lack a legitimate interest.
Right to object: If we process data based on our legitimate interest or for a task in the public interest, you may object to the processing.
Right to data portability: You can obtain the data you have provided to us in a structured and commonly used format. This applies when the processing is based on consent or agreement.
Rights in automated decision-making: You have the right to avoid decisions that are made solely by automated means and that may significantly affect you. We do not use such automated decision-making.
Right to erasure (‘right to be forgotten’): You can request erasure when the data is no longer needed or when the processing is unlawful. However, we are required by law to retain certain data, for example to combat money laundering. This data is archived until it can be erased.
Right to lodge a complaint: You have the right to lodge a complaint with the Swedish data protection supervisory authority, the Swedish Authority for Privacy Protection.

Changes to this privacy policy

We update the policy regularly. Significant changes that affect you will be announced at least two weeks in advance. We do not communicate minor linguistic or clarifying changes directly.

Last updated: 21 January 2026

Contact

If you have any questions about this privacy policy or how we process your personal data, please contact:

Hoist Finance AB (publ)
Attn: Data Protection Officer
P.O. Box 7848
SE-111 21 Stockholm
Sweden

Email dpo@hoistfinance.com