Privacy Policy (HTML version)

Last Updated: 9 October 2025

Introduction

Warren BV (“Warren,” “we,” “us,” or “our”) is committed to protecting your privacy. This privacy policy (the “Privacy Policy) explains how we collect, use, share, and protect personal data. We process personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

We may update this Privacy Policy from time to time (see “Changes to This Privacy Policy” below). If you have any questions, feel free to contact us using the details provided at the end of this Privacy Policy.

Warren Pension Fund

Warren provides certain services within the platform in its capacity as data processor for Warren Pension Fund OFP. If you are also subscribed to the services of Warren Pension Fund, please refer to the privacy policy of Warren Pension Fund for information on how your personal data is processed in that context. This may for example affect the applicable retention periods for your personal data based on specific legal requirements.

From whom do we collect personal data?

At Warren, we have developed a wealth enablement platform designed to enhance financial well-being for companies’ employees, contractors, and their dependents through software, digital tools, education, and AI-powered coaching.

In the course of our business, we may collect personal data from customers, users of the platform, prospects, visitors to our website, persons who provide their business card or otherwise their contact details to us, and persons who contact us by e-mail or otherwise.

What Personal Data We Collect and Why?

Warren uses your personal data to operate, provide, and improve our financial wellness platform and services. We always ensure that we have a valid legal basis (such as your consent, fulfilling our contract with you, complying with a legal obligation, or our legitimate interest) for each use of your data.

Why?	Which Data?	On which legal basis?
To register you as a new user and set up your account	Identification information, including your name, email address, telephone number, date of birth, nationality, login credentials, employer’s name, employee ID, work contact details (as far as needed for verification and access)	The necessity for the performance of the contract we have concluded with you (art. 6.1 b) GDPR)
To personalise your experience, including:
• the initial set-up of tools like budgeting or saving goals;
• providing you with relevant educational content	Input provided through our service, including information regarding your financial situation, such as income range, savings, debts, expenses, responses to our financial questionnaires.
Profile and usage data	The necessity for the performance of the contract we have concluded with you (art. 6.1 b) GDPR)
To enable and support the features of our platform	Input provided through our service	The necessity for the performance of the contract we have concluded with you (art. 6.1 b) GDPR)
	Bank account details and financial transaction data	The prior, express, free, specific and informed consent of you. (art. 6.2 a) GDPR)
To communicate with you about our services, e.g., to send necessary account and transactional communications, updates about new features or changes to the platform, or support needs	Contact information
Records of our communications with you	Necessary for the exercise of our legitimate interests (art. 6.1 f) GDPR)
To send you newsletters or relevant tips	Contact information	The prior, express, free, specific and informed consent of you. (art. 6.2 a) GDPR)
You can opt out of these at any time
To analyze platform performance and improve our services	Usage data
Feedback
Records of our communications with you	Necessary for the exercise of our legitimate interests (art. 6.1 f) GDPR)
To maintain the security of our platform, user accounts, and financial data or to detect suspicious activities	Device information, IP addresses, and usage patterns	Necessary for the exercise of our legitimate interests (art. 6.1 f) GDPR
To comply with our legal obligations (e.g. financial regulations), to establish, exercise, or defend legal claims, to fulfil reporting obligations to regulatory authorities, and to respond to lawful requests by public authorities, or as otherwise required by law	Data needed for such compliance	Necessary to comply with a legal obligation (art. 6.1 c) GDPR)

We will not use your personal data for purposes that are unrelated to the services you sign up for, unless we obtain your consent or have another lawful basis for doing so. We do not sell or rent your personal information to third parties for their own marketing or commercial purposes.

Rest assured that any new use of your data will remain consistent with the purposes described in this Privacy Policy. If a new purpose arises that is not compatible with the original purposes for which your data was collected, we will seek your consent or provide you with appropriate notice and choice.

We collect most personal data directly from you when you sign up or use the platform’s features. In some cases, we may receive data from third parties with your permission – for example, if you connect your bank accounts through an integrated financial data service, or if your employer provides basic enrollment information to allow your access. We will not collect any special categories of personal data (such as health, genetic, or biometric data) unless it is strictly necessary (for instance, biometric ID verification for compliance) and, in such cases, we will do so in accordance with the law and with your explicit consent where required.

Third-Party Service Providers and Data Sharing

We treat your personal data with care and confidentiality. We may share your information only in the following circumstances and with appropriate safeguards:

Service Providers: We employ trusted third-party companies and individuals to support our platform’s operations. These service providers process personal data on our behalf and under our instructions, and they include:
- Cloud hosting and infrastructure providers: to securely store and manage data and ensure our applications run smoothly (for example, reputable cloud data center services).
- Analytics and technology tools: to help us analyze usage of our platform or to provide certain functionality. For instance, we might use analytics services to understand app performance, or AI/machine-learning services to power some of the coaching or insight features. These providers only receive the data necessary for their function (e.g. usage events for analytics, or anonymized financial patterns for AI model improvement) and are not allowed to use it for any other purpose.
- Communication services: to send emails, SMS messages, push notifications or in-app messages. We may use email delivery services or mobile notification services to contact you (for things like verification codes or newsletters). These providers have access to your contact details only for the purpose of sending communications on our behalf.
- Customer support and CRM tools: to manage support tickets, user inquiries, or surveys. If we use a customer support platform or a customer relationship management tool, it will process data like your name, contact, and support history to help us assist you efficiently.

In all cases, our service providers are carefully vetted and bound by data processing agreements under GDPR. They must only process personal data for the purposes we specify and must provide sufficient guarantees to protect your data (including confidentiality obligations and appropriate security measures). We remain responsible for ensuring our service providers handle your personal information in line with this Privacy Policy and applicable law.

Within the Warren Group: If Warren has affiliates or subsidiaries involved in operating the platform, your data may be shared within our corporate group on a need-to-know basis. For example, if a subsidiary company in another region is helping to develop a particular feature, we might share relevant data with that team. Any internal data sharing is done in compliance with GDPR requirements and with our employees and associates under strict confidentiality obligations.