Privacy Notice

1. Who We Are

Elsa Holding AB, Swedish company registration number 559519-9133, is the controller of the personal data described in this notice.

Elsa Partners & Friends is a brand used by Elsa Holding AB.

Postal address: Skänstad Östra Skintegården 2, 516 91 Dalsjöfors, Sweden

General inquiries: info@elsapf.com

Privacy and legal inquiries: legal@elsapf.com

This notice applies when you visit elsapf.com or contact us through the website or by email.

The website is intended for business inquiries about possible inventory transactions. It does not accept loan, investment, deposit, payment, or financing applications.

2. Personal Data We Process

When you visit the website, our website and hosting systems may process:

• IP address.
• Date and time of a request.
• Requested page or file.
• Referring page.
• Browser, device, and operating-system information.
• Error, performance, and security information.

When You Contact Us

When you contact us, we may process:

• Name.
• Work email address.
• Company and role.
• Telephone number, if provided.
• Your message and related business information.
• Technical information connected with the submission.
• Later correspondence about the inquiry.

Sensitive Data

Do not send a personal identity number, identity document, payment information, health information, criminal-offense information, or other sensitive personal data through the public contact form.

If a business inquiry proceeds to transaction review, we will provide the Transaction Review Privacy Notice before requesting due-diligence information.

3. Why We Process Personal Data

Operating and protecting the website. We process technical information to deliver the website, maintain security, prevent misuse, investigate errors, and keep the service reliable. The legal basis is Article 6(1)(f) of the General Data Protection Regulation. Our legitimate interests are providing a functional and secure business website, protecting our systems, and diagnosing technical problems. Technical and security logs are retained for 30 days, unless a specific incident requires relevant records to be kept longer for investigation or a legal claim.

Responding to business inquiries. We process contact and message information to review, answer, and administer an inquiry and to consider a possible business relationship. The legal basis is Article 6(1)(f) of the General Data Protection Regulation. Our legitimate interests are communicating with business contacts and evaluating genuine business opportunities. If you are contracting personally and the processing is necessary to take steps at your request before a contract, Article 6(1)(b) may apply instead.

If no business relationship is established, we retain the inquiry for up to 12 months after our last substantive contact. If a relationship is established, we provide any additional privacy information required for the further processing and apply the retention periods relevant to that relationship.

Meeting legal obligations and handling claims. We may process and retain information when necessary to comply with a legal obligation, respond to a lawful authority request, establish or defend a legal claim, or protect our legal rights. The legal bases are Article 6(1)(c) of the General Data Protection Regulation when processing is required by law and Article 6(1)(f) when necessary for our legitimate interest in handling and defending legal claims.

4. Where the Data Comes From

We normally receive contact data directly from you. We receive technical website data from your browser or device when it communicates with the website.

5. Who Receives Personal Data

Access is limited to people who need the information for the purposes described above. Recipient categories may include:

• Authorized personnel of Elsa Holding AB.
• Hosting, content-delivery, security, website, and form providers.
• Email and business-communication providers.
• IT support providers acting under Elsa's instructions.
• Professional advisers, including lawyers, auditors, accountants, and insurers, when necessary.
• Authorities, courts, or other recipients when disclosure is required by law or necessary for a legal claim.

Processors

Providers acting as our processors may process personal data only under the applicable agreement and our documented instructions, except where applicable law requires otherwise.

6. Transfers Outside the EEA

We do not transfer the personal data covered by this notice outside the European Economic Area.

7. Is Providing the Data Required?

Fields marked as required in the contact form are needed so we can understand and respond to the inquiry. You are not legally required to provide them, but we may be unable to respond if you do not.

Optional fields are labeled optional.

8. Your Rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• Request access to your personal data.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete personal data.
• Ask us to restrict processing.
• Object to processing based on legitimate interests.
• Receive certain data in a portable format when processing is automated and based on consent or a contract.
• Withdraw consent at any time when processing is based on consent.

How to Exercise a Right

To exercise a right, email legal@elsapf.com. We may request information reasonably necessary to confirm your identity. We normally respond within one month, subject to the extensions allowed by law.

You may complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten, or another competent EEA supervisory authority.

9. Automated Decisions

We do not use the personal data covered by this notice for decisions based solely on automated processing that produce legal or similarly significant effects.

10. Security

We use technical and organizational measures designed to protect personal data against unauthorized access, alteration, loss, and disclosure. No method of online transmission or storage is completely secure.

11. Changes to This Notice

We may update this notice when our processing or legal obligations change. The current version and update date will be published on this page. If a change materially affects how we use personal data, we will provide additional notice where required.

12. Contact

Questions may be sent to legal@elsapf.com.

Elsa Holding AB, company registration number 559519-9133, Skänstad Östra Skintegården 2, 516 91 Dalsjöfors, Sweden.