Privacy Notice

Rwk Group Holding AB, Swedish company registration number 559544-6450, with registered address Törnrosvägen 74A, 181 61 Lidingö, Sweden, operates the Lane Labs service ("Lane", "Lane Labs", "we", "us").

This notice explains how we process personal data in our own capacity as controller in connection with the website at lanelabs.ai (the Site), business enquiries and our customer relationships. It also explains the different role we have when Lane processes customer-provided content on a customer's instructions.

Who this notice covers and our role

This notice covers personal data about:

• visitors to the Site;
• people who submit the contact or demo-request forms;
• prospective and current customer contacts;
• Lane users and customer administrators;
• people who request support or otherwise communicate with us; and
• business contacts who receive marketing from us, where permitted.

When we are controller. Rwk Group Holding AB determines why and how the Site, enquiry, business contact, account administration, security and direct marketing data described in this notice is used. Rwk Group Holding AB, not an individual board member or employee, is the controller for that processing.

When we are processor. Lane is an AI workspace for financial teams that brings documents, spreadsheets, data, and email into connected workflows. If a customer puts personal data into Lane through documents, spreadsheets, databases, email, integrations, prompts or generated outputs, the customer normally determines the purposes and means of that processing. Rwk Group Holding AB then processes that data for the customer as processor (or sub-processor) under the customer agreement and data processing agreement. The customer is responsible for its own lawful basis and notices. People seeking to exercise rights over personal data in customer content should contact the relevant customer first; we will assist that customer as required by the applicable agreement and law.

Personal data we process as controller

• Contact form: first name, last name, email address and the message you choose to send.
• Demo-request form: first name, last name, email address, company name, primary location, organisation type, number of financial professionals, and how you heard about Lane. This form does not ask you to subscribe to marketing.
• Communications and support: the content, time and routing details of correspondence, and any follow-up information you provide. Please do not send customer content, credentials, or sensitive personal data through the Site forms.
• Customer and user administration: where a Lane account or business relationship is established, business identity and contact information such as name, work email, organisation, role, account identifier and administration or access records.
• Business marketing records: business contact details, organisation and role, source of the relationship, communications sent, and objection, unsubscribe or suppression records. We do not use Site analytics or advertising pixels to create marketing profiles.
• Website request and security data: a hosting or content-delivery provider may process IP address, requested URL, date and time, user-agent, referrer, response status and similar request or security-log information.
• Local browser preference: after you dismiss the Site privacy notice, the Site stores a version number and dismissal and expiry timestamps in your browser for 180 days. This value is not designed to be sent to Lane. See the Cookie Notice.

We usually obtain this data directly from you, from your organisation when it provisions or administers Lane, or from systems used to operate the relationship. If we lawfully obtain a business contact from a referral, event or public professional source, we will record enough source information to provide the required notice and honour objections.

Purposes and legal bases

A customer employee or other user is not treated as personally contracting with us merely because their employer or organisation is the customer. Where we rely on legitimate interests, you may ask us for information about the balancing assessment and may object as described in section 8.

The local privacy-notice preference is written only at your request to remember the dismissal and remains on your device. The Site currently has no optional analytics or advertising storage requiring consent.

Customer content and Lane's processor role

Customer content can include personal data about customer users, employees, clients, investors, counterparties, advisers, vendors, portfolio-company personnel and people appearing in documents, spreadsheets, databases or email. The actual categories depend on what the customer chooses to process and which features it uses.

For this processing, Lane acts only on the customer's documented instructions, subject to the customer agreement and data processing agreement. Lane does not determine the customer's GDPR legal basis. The applicable agreement describes the service scope, processing instructions, authorised providers, locations, retention and deletion arrangements for customer content. Lane does not make a blanket EU-only or zero-retention commitment in this notice.

Recipients

We do not sell personal data and the Site does not load advertising technology. We disclose controller data only as needed to:

• authorised Lane personnel and contractors who need it for an enquiry, customer relationship, support, finance, legal or security purpose;
• Plus Five Five, Inc. d/b/a Resend, which delivers contact and demo emails and the demo confirmation. Form content, email addresses and email-delivery metadata are processed for that purpose;
• Vercel Inc., which provides website delivery, deployment infrastructure and request handling;
• Lane's business mailbox provider, which receives form messages and subsequent correspondence;
• professional advisers, auditors, insurers and financing or transaction counterparties subject to appropriate confidentiality; and
• courts, regulators, law-enforcement bodies or other recipients where disclosure is required by law or necessary to protect legal rights.

Providers used to process customer content on customer instructions are addressed separately in the applicable DPA and sub-processor list. The Lane product can use Railway Corporation for product hosting and Supabase Pte. Ltd. for database, authentication, file storage or search functions when those services are within the subscribed scope. Model and integration providers depend on the features enabled for the customer. The customer agreement controls which providers and processing purposes apply.

International transfers

Some providers may process personal data outside Sweden or the EEA. In particular, contact and demo submissions are sent through Resend, whose account data, delivery metadata and logs may be processed or stored in the United States. Product-side locations depend on the services and configuration agreed with the customer.

International transfers are subject to the safeguards required by applicable law. Depending on the destination and provider, these may include an adequacy decision or the European Commission's Standard Contractual Clauses. You may contact us for information about a transfer relevant to your data.

Retention

We keep personal data only for as long as needed for the purpose for which it was collected, and then for any period required to meet legal, accounting, security or claims obligations. The period depends on the type of record, whether an enquiry or customer relationship remains active, and the applicable contract and law.

• Local privacy-notice preference: expires after 180 days, unless you clear it earlier in Privacy choices or your browser settings.
• Contact and demo submissions: the application code sends these by email and does not intentionally write them to an application database. Copies may remain in Resend and Lane's mailbox while we handle the enquiry and reasonable follow-up, or longer where needed for an active customer relationship, legal duty or specific dispute.
• Customer, user-administration and support records: retained while needed to administer the active relationship, then only for documented legal, accounting, security or claims purposes.
• Marketing records: retained while the business relationship or demonstrated relevance continues, until objection or withdrawal where applicable. A minimal suppression record may be kept to ensure the person is not contacted again.
• Website and security logs: retained according to the minimum period needed for delivery, security and incident investigation.
• Customer content processed as processor: returned or deleted on the customer's instructions and under the applicable agreement, subject only to documented legal requirements and the agreed deletion process.

Statutory accounting and transaction records are kept for the period required by applicable Swedish law. Data retained only for a legal requirement or claim is restricted from unrelated use where appropriate.

Your rights

Subject to the conditions in data-protection law, you may ask for access to and a copy of your personal data, correction, deletion, restriction, or data portability. You may object to processing based on legitimate interests. You have an unconditional right to object to direct marketing. Where processing is based on consent, you may withdraw consent at any time without affecting earlier lawful processing.

Submit a request through our contact page or by post using the address in section 10. We may ask for information reasonably necessary to verify your identity and authority, but we will not request more than is proportionate. We normally respond without undue delay and within one month. For a complex request or multiple requests, the GDPR permits an extension of up to two further months; if we rely on it, we will tell you within the first month and explain why. Requests are normally free of charge, subject to the GDPR rules for manifestly unfounded or excessive requests.

If your request concerns personal data in content controlled by a Lane customer, please identify that customer. We may need to refer the request to the customer and assist it as processor.

You may complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se or to the competent supervisory authority where you live or work or where an alleged infringement occurred. We would appreciate the opportunity to address the concern, but contacting us first is not required.

Security and automated decisions

We use measures intended to protect controller data in proportion to its nature and risk. Further information is available on our Security page. No internet service is completely secure, and this notice does not promise that every incident can be prevented or that processing will be error-free.

The Site's contact and demo forms do not make decisions producing legal or similarly significant effects about you solely by automated means. Lane assists financial work; customers and their users remain responsible for review and approval. A customer's use of Lane for its own decision-making is the customer's responsibility and must comply with applicable law.

The Site and Lane's B2B services are not directed to children. Please do not submit a child's personal data through the Site forms.

Changes and contact

We will update this notice when the processing described here changes and will show the new date and version. Where required, we will provide additional notice before a material change takes effect.