2. For what purpose do we process your data and on which legal basis?

2.1 Data processing when using Grover Services

We process personal data in accordance with the provisions of the GDPR and the Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter, the “Spanish Data Protection Law” for the following purposes:

a) For the performance of contractual and pre-contractual obligations (Article 6 (1) sentence 1 (b) GDPR)

The processing of personal data (Article 4 No. 2 GDPR) is carried out for the purpose of providing this website and for the marketing of the products, in particular for the conclusion and processing of contracts, for invoicing, for the implementation of pre-contractual measures, for answering inquiries in connection with our business relationship and for all activities required for the operation and administration of the company.

The purposes of data processing are primarily based on the specific product. Further details regarding the purpose of data processing within the scope of contracts can be found in the respective contract documents and terms and conditions.

In particular, Grover processes the personal information that you provide as a user during registration, for contractual purposes or within the scope of an inquiry. In particular, this concerns the following data: Name, date of birth, e-mail address, address (invoice and possibly differing shipping address), order information, optional telephone number and bank details. In addition, Grover stores the password, which the user can freely choose. The password is not stored in plain text, but only a so-called hash value.

If you use our service offering for digital products, we will collect data about your purchase of the digital item to ensure the proper functioning of our services, facilitate customer support and improve our products. This data includes transaction details, product identifiers, and purchase history.

If you use our service offering for tech-accessories, we will collect order data to ensure the proper functioning of our services, facilitate customer support and improve our products. This data includes order details, your full name, email address and shipping address.

If you utilize our add-on service, Grover Care, we will also collect data about product damages reported by You.

Also, we collect and process personal data about you (including name, email and postal code), if you enroll in any of our loyalty programs.

b) Based on legitimate interests (Article 6 (1) sentence 1 (f) GDPR)

In addition, we process your data beyond the provision of the website and the actual fulfilment of the contract to protect legitimate interests of us or third parties, as in the following cases in particular:

• Response to your inquiries outside of a contract or pre-contractual measures such as those received through our contact forms or social media platforms;

• Advertising or market and opinion research, unless you have objected to the use of your data, this includes existing customer advertising;

• Evaluation of our advertising measures, e.g. tracking of click and opening behavior in e-mail campaigns;

• Enforcement of legal claims and defense in legal disputes;

• Ensuring IT security and IT operation;

• Creditworthiness check;

• Prevention and investigation of criminal offences, among others, by verifying your identity;

• Ensuring the quality and reliability of the services used for the purposes of prevention and detection of fraudulent activities;

• Sending out payment reminder notifications regarding your upcoming payment if you select pay by invoice as your payment method;

• Measures for business management and further development of products.

Our legitimate interest is to market our products in the best possible way and to further develop them and our company, or to protect our company against impairments and dangers and to enforce our claims.

c) Based on your consent (Art. 6 para. 1 sentence 1 lit. a GDPR)

If you have given us your consent to process personal data for specific purposes (e.g. evaluation or use of data for marketing purposes, receipt of advertising by e-mail), the legality of this processing is based on your consent.

If you have given your consent for email marketing, we will contact you to celebrate your birthday. To facilitate this, we will process your name, email address and date of birth.

If you choose to write a review about our services and/or products on the platform provided by Trustpilot A/S ("Trustpilot"), your consent will be the legal basis for this data processing. To facilitate your review, we will share your name, email address, and reference number with Trustpilot. For more details on how Trustpilot processes your data, please refer to their Privacy Policy here.

You consent can be revoked at any time. Please note that the revocation is only effective for the future.

d) Due to legal requirements (Art. 6 para. 1 sentence 1 lit. c GDPR)

We are also subject to various legal obligations, e.g. money laundering law, tax laws, which require the processing of data.

e) Based on your explicit consent (Art. 9 para. 2 lit. a GDPR)

If you have given us your explicit consent to process personal data including biometric data or health data or data relating to religious or ideological beliefs revealed as a result of the bank account check (see below under 2.) for the purposes of fraud prevention, risk assessment and identity verification, the legality of this processing is based on your explicit consent. Your consent can be revoked at any time. Please note that the revocation is only effective for the future.

In cases of early termination due to health issues, we may collect and process personal data through your submission of health data.

2.2 Credit assessment, risk analysis and fraud prevention

a) Creditworthiness Check

In the course of the ordering process, we may check your creditworthiness. For this purpose we transmit the following data to so-called credit bureaus cooperating with us:

• Customers (including Freelancer): Full name, billing and shipping address, date of birth, phone number, email.

• Business customers: Company, company address.

We transfer your personal data to the following companies, among others, for credit assessment:

• Experian Bureau De Crédito, S.A.U, C / Príncipe de Vergara, 132, 28002 Madrid

• Equifax Ibérica S.L., Paseo de la Castellana, 259-D, Torre Espacio, planta 26 28046, Madrid

Before transferring your personal data to these companies, we endeavour to accurately establish your identity by verifying your personal data during your account creation via a business partner. This serves as an additional layer of security and accuracy. It aims to ensure that no personal data that is obtained as a result of fraudulent activities is shared with these consumer reporting agencies.

For the decision on the conclusion, performance or termination of a contractual relationship, we use not only an address check, but also information about your previous payment behavior as well as probability values for your future behavior, which include, among other things, address data. We obtain this information from the following providers, among others:

• Experian Bureau De Crédito, S.A.U, C / Príncipe de Vergara, 132, 28002 Madrid

• Equifax Ibérica S.L., Paseo de la Castellana, 259-D, Torre Espacio, planta 26 28046, Madrid

Grover is collecting and sharing data about customer sessions (including name, address, email address, phone number and IP address) and payment with Mastercard Europe SA. The legal basis for this is legitimate interest (Article 6 (1) sentence 1 (f) GDPR), resulting from our interest in preventing abuse and fraud and avoiding debts in current and future rental contracts. In this regard, such personal data will be transferred and stored  outside  the  country in which  it was  collected (e.g., transfer  to  and  storage  in  the  United  States) based on the Mastercard Binding Corporate Rules, as approved by the competent Data Protection Authority in the EU. These rules include your right to enforce them as third-party beneficiaries.

For the decision on the establishment of a contractual relationship, we also carry out our own analyses to detect abuse and fraud. In particular, we use the following categories of data:

• Customer characteristics (e.g. data from credit reports, age, mobile phone provider, e-mail provider)

• Shopping cart data like device categories

• Behavioral data (e.g. number of orders and their status, behavior on the website)

• Payment data like payment methods

• Reconciliation of account data with other user accounts with regard to matching data

• Customer characteristics such as data from credit reports and mobile phone providers.

• Only if applicable, bank account data, in particular, account balances, turnover and transaction data

• Data required to complete identity verification checks including a scan of a photo ID (e.g. a passport, a driver's license or an identity card), an image, a video including audio data and biometric facial identifiers.

The credit information and the own analyses for fraud detection can contain probability values (score values), which are calculated on the basis of scientifically recognized mathematical-statistical procedures and their calculation includes among other things (but not exclusively) address data. The legal basis for this is Article 6 paragraph 1 letter f) GDPR. The legitimate interest results from our interest in reducing the contractual risk, in protection against bad debts and against the danger of misuse of our services by third parties. Your interests worthy of protection are taken into account in accordance with the statutory provisions.

In individual cases we check the calculation or the calculation result manually.

In order to prevent abuse and fraud and to avoid debts in current and future rental contracts of the customer, the longer-term storage (see 3.) of creditworthiness data and data from our own analyses is necessary for the detection of abuse and fraud. The legal basis is Art. 6 Paragraph 1 Letter f) GDPR. Our legitimate interest arises from our interest in detecting fraudulent behaviour or patterns of behaviour, recognising and taking into account developments in the creditworthiness of our customers, evaluating the rental agreements (the risk portfolio and the probability of default are relevant for investors, among others) and reviewing and improving our risk management (by analysing the data records - only in anonymised form).

If the other legal requirements are met, we will also forward information about delays in payment or a possible loss of receivables to credit agencies cooperating with us, please see 2.2. The legal basis for this is article 6 paragraph 1 letter f) GDPR. Our legitimate interest results from our and third parties' interest in reducing contractual risks for future contracts.

b) Identity Check

In order to detect/prevent fraudulent activities, we use the services of Onfido Limited. It is necessary for us to check whether the scan of a photo ID is genuine or fraudulent by confirming that the photo/video matches the facial biometrics in the photo on the provided document or in our database. Biometrics adds a layer of protection against stolen IDs and impersonation attacks. For this data processing, the legal basis is your explicit consent in accordance with Art. 9 para. 2 lit. a GDPR. We do not share these types of data with third parties unless required by law. You can revoke your consent with effect for the future at any time. The data processing that took place until the revocation remains lawful. If you want to obtain further information on retention periods, please see “How long will my data be stored for?” further below.

c) Bank Account Check

You can have your bank account checked by us if your credit score is negative. During this process, we check your bank account data by using our partner called FinTecSystems GmbH. This is necessary for the purpose of deciding on the establishment of a contractual relationship, for identity verification and for fraud prevention. We only review your three months of financial data such as your account balances and turnover. We do not share your bank account data with third parties. The legal basis for this is Article 6 (1) sentence 1 (a) GDPR.

Even though we are only interested in your financial data, your data related to your health, religious or ideological beliefs may be visible in your transactions. In such cases, your consent extends to special categories of personal data pursuant to Article 9 (1) of the GDPR. The legal basis for this is your explicit consent in accordance with Article 9 paragraph 2 letter a) GDPR.

You can revoke your consent with effect for the future at any time in this context. The data processing that took place until the revocation remains lawful. If you want to obtain further information on retention periods, please see “How long will my data be stored for?” further below.