## **The platform usage data we collect from all users** ### **User data** - To open an account on Zinsli, we need your name, email address (verified), address, and phone number (verified) so that we can identify you as a user and to ensure increased security at login (two-factor authentication). - If you use the contact form, the name, email address and message you provide will be forwarded to us. - We track certain user actions, for example how many products a user looks at before deciding on an investment product. This data is stored anonymously (i.e. without username). The tracking data is used internally to identify general, but not individual, behavior patterns on the platform and thus improve the user experience. The data is not shared and is not broken down to specific users. - We track whether a user has received an invitation and not responded to it, or whether someone has accepted the invitation but not paid a deposit. The tracking of invitation acceptance status and deposit status is used for automated sending of reminder emails and to display the status of the users themselves and the landlords on the platform. The data is not used to evaluate individual users. - When opening a rental deposit account, additional data is requested. The exact data depends on the selected products. This data is communicated to the selected partner for the purpose of opening and managing the account. This data may include but is not limited the following aspects: - About the rental property/tenancy: the amount of the deposit, monthly rent including utilities, deposit term, property name, accepted products.- About the landlord and administration: name, address, telephone number and IBAN- About the tenants: Home town, nationality, date of birth and IBAN ### **Technical log data** When accessing the platform, the user's Internet browser automatically transmits certain usage data for technical reasons. This so-called log file information is stored separately from other data that the user may provide: - Date and time as well as duration of access - Browser type/version - Operating system used - URL of the previously visited website - Amount of data transferred - IP address (Internet Protocol address) - Name of the service provider - Name of the retrieved files - http status code (e.g. "request successful") - URL of the accessed web page The aforementioned log file information is stored exclusively for technical reasons and is not assigned to a specific person at any time. IP addresses are stored for security reasons for a maximum of 30 days and then deleted. Data whose further storage is required for evidentiary purposes is exempt from deletion until final clarification of the respective incident. ### Cookies #### Necessary Necessary cookies help make a website usable by enabling basic functions such as page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

Name/Provider	Purpose	Expiration/Type
zinsli-token Zinsli Finance AG	Allows registered users to log in to our website on future visits without having to re-enter their login information	7 days HTTP Cookie
zinsli-token-2fa Zinsli Finance AG	Allows registered users to log in to our website on future visits without having to re-enter their login information	4 hours HTTP Cookie

## **Data we only collect with explicit user consent** - With the consent to user-specific tracking, the user allows us an even more detailed insight into the use of the platform. - The data will be used for internal purposes only and will be used for the following purposes, among others:- Understanding and improving our software platform.- Improving usability and developing features.- Identifying and fixing software bugs and performance issues.- Conducting market research and analysis. - This tracking is done using Google Analytics. Google Analytics is a web analytics service provided by Google LLC ("Google"). Google Analytics uses cookies that are stored on your computer and that allows an analysis of your use of the platform. The information generated by the cookie is usually transferred to a Google server in the USA and stored there. - A user can adjust the consent to this tracking at any time in their user profile on the platform. ### Cookies #### Statistics Statistics cookies help website owners understand how visitors interact with websites by collecting and reporting information anonymously.

Name/Provider	Puropose	Expiration/Type
_ga Google	Registers a unique ID that is used to generate statistical data about how the visitor uses the website.	2 years HTTP Cookie
_ga_# Google	Collects data on how many times a user has visited a website, as well as data for the first and last visit. Used by Google Analytics.	2 years HTTP Cookie

#### Marketing Marketing cookies are used to follow visitors on websites. The intention is to show ads that are relevant and appealing to the individual user and therefore more valuable to publishers and advertising third parties.

Name/Provider	Purpose	Expiration/Type
NID Google	Registers a unique ID that identifies a returning user's device. The ID is used for targeted advertising.	6 months HTTP Cookie

## **How we protect your data** - All data is stored encrypted in the cloud in a data center located in Switzerland. - Access to data requires proper permission as well as multi-factor authentication. ## **Disclosure of your data** We do not transfer your personal data to third parties for purposes other than those listed below. We will only pass on your data to third parties if: - you have given your express consent to do so, - the transfer is necessary for the execution of a contract with you, - we are legally obliged to do so, or - the disclosure is necessary for the assertion, exercise or defense of legal claims and there is no reason to believe that you have an overriding interest worthy of protection in the non-disclosure of your data. ## **For questions** If you have any questions about this policy, please contact us at hey@zinsli.com. Please note that this is a curtsey translation and it is the German version of this document is legally binding.

Privacy Policy