Issued with reference to Act No. 90/2018 on Data Protection and the Processing of Personal Data, which gives effect to Regulation (EU) 2016/679 of the European Union (GDPR).

Scope and Processing of Personally Identifiable Data

Spesía is legally required to protect the personally identifiable data of its clients and takes that responsibility seriously. Trust is a key element in all of Spesía's operations, and the Company therefore places great emphasis on ensuring that this Privacy Policy is followed in compliance with applicable legal requirements.

This Policy explains how the Company collects, uses, shares and protects its clients' personally identifiable and financial information. Its purpose is to inform clients about the security and processing of personally identifiable data within Spesía, and the purpose and legal basis for such processing, with a view to ensuring transparency in accordance with applicable data protection legislation.

This Privacy Policy applies to the processing of personally identifiable data by Spesía eignastýring hf., ID No. 430924-0440, Grandagarður 16, 101 Reykjavík (hereinafter “Spesía”). This Policy applies only to individuals and not to legal entities. It does not cover other online services operated by third parties to which Spesía's service links.

Please read this Privacy Policy carefully. If you do not agree with its contents, you may stop using Spesía's services at any time.

Controller and Processor

Spesía is the controller of the processing of personally identifiable data and is responsible for ensuring that the processing carried out complies with data protection law at all times, and must be able to demonstrate such compliance. The controller determines the purposes of the processing and the means used to process personally identifiable data.A processor is a party that processes personally identifiable data on behalf of, or for, the controller under a data processing agreement. Where Spesía engages the services of a processor, it enters into a data processing agreement with that processor and ensures that they afford personally identifiable data adequate protection in accordance with applicable law.

In some cases there may be more than one controller, in which event the processing of personally identifiable data is carried out by two or more parties. In those cases each party is responsible for defined aspects of the processing and they are considered joint controllers. If Spesía processes personally identifiable data together with another party in this manner, a joint controller arrangement is put in place.

What Information Do We Collect?

In order to provide efficient and personalised services, Spesía collects various types of information about you, both information you provide to Spesía and information obtained from other parties in connection with the services, with your consent. Among other things, the Company collects information in order to fulfil the obligations imposed on it under the Act on Markets in Financial Instruments and the Act on Measures against Money Laundering and Terrorist Financing. The main categories of personally identifiable data we process are:

• Identification data: Name, ID number (kennitala), nationality and identification documents (e.g. electronic ID) so that the Company is able to verify your identity.
• Contact data: Address, email address, telephone number and other contact details, which are also used to contact you during the business relationship.
• Financial data: Account numbers, transactions and portfolio positions, and information on the source and extent of income, assets and liabilities.
• Contract data: The basis and content of agreements you enter into with the Company, consents and terms. This information is collected for the purpose of giving effect to theirprovisions. It may include, for example, information on your financial position, your investment knowledge and experience, and your attitude towards risk.
• Due diligence data: Information generated by customer due diligence under Act No. 140/2018 on Money Laundering, including the purpose of the business relationship and the source of funds.
• Technical data: Browser type, operating system, IP address and how you use Spesía's website and app, for the purpose of improving the Company's services and products. This allows us to identify which parts of our service work best and how accessibility and functionality can be improved for the benefit of all clients.
• Communications history: Copies of all electronic communications with clients. Telephone calls to Spesía may be recorded; call recording forms part of the Company's security framework and is based on the data protection legislation.
• Cookies: See Spesía's separate cookie policy at www.spesia.is The above list is not exhaustive, and Spesía may collect other information about you where this is considered necessary given the nature of the business relationship or communications at any given time. If accurate information is not provided, this may affect Spesía's ability to provide you with appropriate services.

Why Do We Collect This Information?

We collect, store and analyse data through our services for the following purposes:

1. Performance of a contract (GDPR Article 6(1)(b))
   Spesía needs to obtain and process certain personally identifiable data about you in order to provide you with appropriate services under the agreement between you and Spesía. The information is obtained, among other things, to comply with laws and regulations, but also to provide you with personalised advice and to assist you in making decisions that suit your personal circumstances and views. Such information is processed on the basis of your consent, in order to perform our contract with you, and on the basis of Spesía's legitimate interests.
   
   
2. Legal obligation (GDPR Article 6(1)(c))
   Spesía's processing of personally identifiable data is to a large extent based on the Company's need to comply with legal obligations. Spesía retains personally identifiable data only for as long as necessary for Spesía to provide the services offered, and otherwise in accordance with statutory provisions or where business interests require it and there are legitimate grounds for doing so. The principal legislation includes:
   
   - Act No. 161/2002 on Financial Undertakings
   - Act No. 140/2018 on Measures against Money Laundering and Terrorist Financing
   - Act No. 115/2021 on Markets in Financial Instruments
   - Act No. 45/2020 on Managers of Alternative Investment Funds
   - Act No. 116/2021 on Undertakings for Collective Investment in Transferable Securities
   - Act No. 145/1994 on Accounting
   - Act No. 90/2003 on Income Tax
   
   Examples of processing on this basis include customer due diligence, reporting to supervisory authorities, and the retention of data under accounting and tax legislation.
   
   
3. Legitimate interests (GDPR Article 6(1)(f))
   In limited cases, Spesía processes personally identifiable data on the basis of the Company's legitimate interests, where those interests are considered to outweigh the rights and freedoms of the individual concerned. Such processing does not take place where the individual's fundamental rights and freedoms relating to data protection outweigh those interests.Examples of processing on this basis include the development and improvement of the Company's services, marketing to existing clients, and information systems security and fraud prevention. You may object to processing on this basis; see the section on your rights below.
   
   
4. Consent (GDPR Article 6(1)(a))
   In certain cases, the processing of personally identifiable data is based on your consent, for example through cookies on Spesía's websites. You may withdraw your consent at any time without affecting the lawfulness of the processing carried out while the consent was in force.
   
   
5. Development and maintenance of the product
   Spesía also analyses your use of its app or online services in order to improve and further develop them. This analysis includes identifying which features you use most and how often you log in, from where, and with which browser, phone and operating system. We also collect information from clients in other ways for the same purpose, including feedback received via email, social media or user testing. You may opt out of marketing emails at any time, for example by clicking the unsubscribe link in our emails or by contacting Spesía. Such information is processed on the basis of your consent, in order to perform our contract with you, and on the basis of Spesía's legitimate interests.
   
   
6. To provide you with comparisons
   Spesía may also use your information to create demographic or statistical summaries, which are used, among other things, to show you how your information, behaviour or circumstances compare with the information, behaviour or circumstances of others. Such information is processed on the basis of your consent and in order to perform our service agreement with you.
   
   
7. To maintain good communication
   It is very important to Spesía to be able to communicate openly with you and our other clients, both so that we can inform you of updates, new features or other important changes to theservice, and so that you can easily let us know if you wish to share comments or suggestions with us. We welcome all feedback and endeavour to respond to it promptly. Such information is processed on the basis of your consent, in order to perform our contract with you, and on the basis of Spesía's legitimate interests.
   

How Do We Share Personally Identifiable Data?

Personally identifiable data may be shared with third parties to the extent necessary to perform contractual obligations towards clients. Spesía also discloses information to public authorities where required by law and where requested, such as to the Financial Supervisory Authority of the Central Bank of Iceland or other supervisory authorities, the tax authorities, the courts or the National Commissioner of Police. In addition to the above, other parties such as clients' commercial banks may receive personally identifiable data from the Company in limited cases.

In particular circumstances, personally identifiable data may be transferred outside the European Economic Area (EEA). This is done only where necessary in order to comply with a client's requests or where required by law. Where such a transfer takes place, the strictest security requirements are observed in accordance with data protection legislation.

Spesía uses processors in certain cases, in particular in connection with the outsourcing of activities that may be outsourced under Act No. 45/2020 on Managers of Alternative Investment Funds, such as accounting and settlement services, maintenance of registers of unit holders, custody services and internal audit. Spesía ensures that service providers acting on the Company's behalf afford personally identifiable data adequate protection in accordance with this Privacy Policy.

How Do We Store Personally Identifiable Data?

The security of your personally identifiable data is a key element of all of Spesía's operations, and the Company has implemented various security measures to protect your personally identifiable data. The purpose is to meet Spesía's legal requirements relating to information security and to prevent unauthorised use, copying, access or disclosure to third parties. Data encryption, the use of pseudonyms and extensive security testing are examples of such measures.

Only Spesía employees with the requisite authorisations have access to data relating to supervised activities. All employee look-ups are also logged. All Spesía employees have a clean criminal record and are bound by confidentiality in respect of everything they may learn about clients' affairs. Spesía actively monitors its employees and reserves the right to report any breach of confidentiality to the appropriate authorities.

How Long Do We Retain Personally Identifiable Data?

Spesía retains personally identifiable data about clients for the duration of the contractual relationship. Thereafter, Spesía deletes personally identifiable data in accordance with applicable rules, unless legal obligations require further retention. In general, personally identifiable data are retained for 5–7 years from the end of the business relationship, having regard to the legislation governing the Company's activities, including the acts listed above in relation to why this information is collected.

What Rights Do You Have?

In accordance with data protection legislation, you are entitled to have certain measures taken to safeguard your rights in relation to the processing of personally identifiable data. These rights are as follows:

• Right to information: You have the right to receive information about the data being processed about you so that you can exercise your other rights under data protection law.
• Right of access: You have the right to obtain information as to whether personally identifiable data about you are being processed. This includes the right to obtain confirmation of this, a copy of the data being processed, and other information about the processing, such as its purpose and the consequences of such processing for you.
• Right to object: The right to object to personally identifiable data about you being used for particular purposes, such as marketing purposes.
• Right to data portability. The right to transfer your own data that you have provided to the controller, for example if you wish to reuse them with another service or controller.
• Right to rectification and/or erasure: You have the right to have personally identifiable data about you that are unreliable or incorrect rectified or erased. You also have the right to request that personally identifiable data about you be erased where they are no longer necessary in light of the original purpose of the processing. In certain cases Spesía may have to refuse such a request on the basis of legal obligations; if so, you will be informed of the reasons.
• Right to restriction of processing: You have the right to require that the processing of personally identifiable data be restricted in certain cases, for example while a dispute about the accuracy of the data is being resolved.
• Withdrawal of consent: Where the processing of personally identifiable data is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of the processing carried out while the consent was in force, for example by deleting your Spesía account or by contacting Spesía directly and having the account closed. This also entails the withdrawal of consent to the sharing and processing of account information within Spesía's service. If you withdraw your consent, however, this means that you can no longer use Spesía's services in whole or in part, or that certain features may not function as intended. Please note that where legislation requires personally identifiable data to be retained for longer, that legislation prevails; see the discussion of information security and retention.

In some cases, exceptions to your rights may apply, for example where provisions of other legislation provide otherwise or where the rights of others prevail. The general rule, however, is that your rights apply.

Processing of Personally Identifiable Data about Children

Spesía may process personally identifiable data about children where this is necessary in order to provide the services requested. If a child using Spesía's services or products is under 13 years of age,Spesía will always obtain the consent of a parent or guardian for the processing of personally identifiable data about the child, in accordance with data protection legislation.

Changes to Spesía's Privacy Policy

Spesía reserves the right to update this Policy to reflect changes in business practices and legal obligations. Any changes will be made available on Spesía's website, and you are deemed to have accepted the changes by continuing to use Spesía's services. If, in Spesía's assessment, the changes are significant, you will be notified separately before they take effect. Minor changes are deemed to have been accepted through your continued use of Spesía's services.

Contact and Remedies

If you have any questions about this Policy or the processing of your personally identifiable data, you may contact Spesía's Data Protection Officer. The Data Protection Officer is the point of contact for data subjects, provides advice regarding their rights, and is responsible for ensuring that Spesía complies with data protection legislation.

If you believe your rights have been infringed, please contact us. All inquiries, comments and suggestions relating to data protection may be sent to privacy@spesia.is.

If a dispute arises concerning the processing of personally identifiable data, a complaint may be lodged with the Icelandic Data Protection Authority (Persónuvernd) by email to postur@personuvernd.is or by post to Persónuvernd, Rauðarárstígur 10, 105 Reykjavík. See further information at www.personuvernd.is

Version

The CEO is responsible for this Policy, which shall be reviewed annually, or more frequently if circumstances so require.

This Privacy Policy was last updated in May 2026.