Privacy Policy

Personal data includes any information that can be directly linked to you as a person, such as your national identity number, contact details, and information about products you have purchased from us. We need this information in order to provide you with good customer service.

Scope of This Privacy Policy

This Privacy Policy applies to data processing carried out by companies within the Storebrand Group and by our data processors.

We process personal data in connection with our pension, savings, insurance, and banking services. In this policy, “Storebrand” refers to the following companies:

• Storebrand ASA
• Storebrand Asset Management AS
• Storebrand Bank ASA
• Storebrand Boligkreditt AS
• Storebrand Forsikring AS
• Storebrand Livsforsikring AS
• Storebrand Pensjonstjenester AS

Who Is Responsible for Processing Your Data?

The data controller is the Storebrand company that determines the purpose of processing your personal data. Which company processes your data depends on which products or services you have signed an agreement for. In Storebrand, the company you have entered into an agreement with is the data controller.

Collection and Use of Personal Data

We collect and use personal data for various purposes and based on different legal grounds.

Customer Administration and Service Delivery

We process personal data to collect, verify, and manage information before entering into an agreement with you. During the customer relationship, we process your data in order to administer and deliver agreed services.

The legal basis for this processing is:

• Performance of a contract
• Our legitimate interest in managing the customer relationship

If special categories of personal data are required, such as health information, we will either request your consent or process the information based on legal obligations.

Shared Customer Register Across the Group

Storebrand operates a shared customer register across its pension, savings, insurance, and banking businesses. The purpose is to manage customer relationships and coordinate information and services across Storebrand companies.

The legal basis is Storebrand’s legitimate interest in providing coordinated and efficient services. All Storebrand group companies are jointly responsible for the customer register.

Development of Products and Services

We process personal data to identify demand for new products and services and to improve existing offerings.

The legal basis is Storebrand’s legitimate interest in developing and improving services.

Marketing

We process personal data to:

• Market our products and services
• Build customer profiles
• Conduct product and customer analysis
• Provide relevant and personalized offers

We use profiling and segmentation to make our communications more relevant.

If you are an existing customer, we process your data based on our legitimate interest in providing information and offers.

If you are not an existing customer, we ask for consent for digital marketing and comply with marketing reservation registers for telephone marketing.

Statistics, Analytics, and Risk Assessment

We use personal data to:

• Conduct analytics and statistics
• Assess risk and profitability
• Set prices and tariffs
• Improve products and services

The legal basis may include legal obligations and Storebrand’s legitimate business interests.

Legal Obligations

We process personal data to comply with laws and regulations, including:

• Anti-money laundering measures
• Counter-terrorism financing
• Tax reporting
• Reporting to public authorities

The legal basis is compliance with legal obligations.

Fraud Prevention and Investigation

We process personal data to prevent, detect, investigate, and manage fraud and other criminal activities directed at Storebrand.

In some cases, we are legally required to share information with authorities such as Økokrim (Norway’s National Authority for Investigation and Prosecution of Economic and Environmental Crime). Under anti-money laundering laws, you may not have the right to access certain information.

Information Security and Physical Security

We process personal data to protect your assets and Storebrand’s systems through:

• Access controls
• Logging
• Server and infrastructure monitoring
• Firewalls
• Camera surveillance

The legal basis may include contractual obligations, legal obligations, and legitimate interests.

Legal Claims and Complaints

We process personal data to establish, defend, and handle legal claims, complaints, and legal proceedings.

This may include processing special categories of personal data where necessary.

Consent

In some cases, we ask for your consent in order to:

• Process sensitive personal data such as health information or trade union membership
• Share additional customer relationship information across Storebrand companies
• Send electronic marketing about products and services you do not already have

Categories of Personal Data

Depending on your relationship with Storebrand, we may process:

• Identification information (e.g. national identity number)
• Contact details and general information
• Financial information and insurance-related data
• Legally required information
• Sensitive personal data such as health information

Sources of Personal Data

We usually collect personal data directly from you. We may also obtain information from:

• Employers
• Public registers and authorities
• Financial institutions
• Credit information companies
• Industry registers
• Sanctions lists
• Other Storebrand companies
• Business partners

If you consent, we may also collect health information from healthcare institutions.

Confidentiality

All Storebrand employees are subject to confidentiality obligations regarding customer information. This obligation also applies between companies within the group.

Sharing Personal Data

We may share personal data:

• Between Storebrand companies
• With public authorities where required by law
• With financial institutions and partners
• With debt collection agencies
• With insurance industry registers
• With service providers acting as data processors

We do not share sensitive categories of personal data such as health information unless legally permitted or consented to.

International Transfers

Some suppliers operate outside the EU/EEA. Personal data is only transferred outside the EU/EEA where there is a valid legal basis and adequate protection for your personal data.

Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate information
• Request deletion of data
• Object to certain processing activities
• Restrict processing
• Request data portability
• Request manual review of automated decisions

You can contact Storebrand’s Data Protection Officer for assistance.

Automated Decision-Making

Some decisions at Storebrand are fully automated in order to ensure efficient and accurate operations. If an automated decision significantly affects you, you may request a manual review.

Cookies

We use cookies to:

• Enable essential website functionality
• Improve user experience
• Analyze website usage
• Support marketing activities

Cookies are grouped into:

• Necessary cookies
• Functional cookies
• Analytics cookies
• Marketing cookies

You can change your cookie settings at any time via the website.

Payment Information

Payment card information entered on storebrand.no is handled by Storebrand’s payment service providers and stored according to their privacy policies. Storebrand only stores payment information when necessary to handle payment-related issues.

Customer Service and Newsletters

We may send newsletters and customer communications based on:

• Your products
• Age
• Life situation
• Place of residence
• Interaction with emails

You can unsubscribe at any time.

Social Media Customer Service

We respond to customer inquiries on social media platforms. Do not share sensitive personal information through these channels. Posts containing personal information may be deleted for privacy reasons.

Personalized Marketing

With your consent, we may use your email address or phone number to provide personalized marketing through:

• Email
• SMS
• Social media
• Third-party advertising platforms

You can withdraw your consent at any time.

Customer Profiles and Profiling

We create customer profiles in order to:

• Personalize communication
• Improve services
• Offer relevant products

We never use sensitive personal data, such as health information, for profiling.

Recording Communications

Storebrand may record:

• Phone calls
• Emails
• Chats

This is done for:

• Legal compliance
• Documentation
• Quality assurance
• Employee training
• Fraud prevention

Investment-related communications may be stored for at least five years.

Customer Surveys

We may ask customers for feedback after interactions with Storebrand in order to improve products and services. Participation is voluntary.

Data Breaches and Errors

If errors occur in the processing of personal data, Storebrand assesses whether the incident must be reported to the Norwegian Data Protection Authority and whether affected individuals should be notified.

Data Protection Officer

You may contact Storebrand’s Data Protection Officer if you have questions about:

• Privacy rights
• Access requests
• Deletion requests
• Data portability

Complaints regarding data processing

Email: personvernombud@storebrand.no

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to ensure it reflects current practices and legal requirements.

Last updated: November 2025.