PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA BY AB NEO FINANCE FOR DIRECT MARKETING PURPOSES

INFORMATION NOTICE

ON THE PROCESSING OF PERSONAL DATA BY AB NEO FINANCE FOR DIRECT MARKETING PURPOSES

This information notice provides detailed information on how AB NEO Finance (hereinafter – we, the Company) processes personal data of its clients (hereinafter – you) when you give your consent to process your personal data for direct marketing purposes or when data processing is based on the legitimate interests of the Company (for existing clients prior to the update of this notice in May 2026).

Direct marketing includes offering the Company's services to clients (including personalised offers) and providing information about new Company services, including sending newsletters, ongoing promotions, invitations to participate in surveys or market research, and requests to provide opinions on service and customer care quality. These direct marketing activities may be carried out and information provided to you by email, by phone (calls and/or SMS text messages) to the contact details you provided when registering for specific services.

DATA CONTROLLER

The data controller of personal data processed for direct marketing purposes is AB NEO Finance, legal entity code 303225546, Ukmergės g. 126, Vilnius, operating the peer-to-peer lending platform Paskolų klubas and the payment initiation and account information service Neopay.

Data Protection Officer contact: [email protected]

PURPOSE AND LEGAL BASIS FOR DATA PROCESSING

Purpose – we will process your personal data for direct marketing purposes, i.e. to provide you with relevant information about the Company's services, offers, newsletters, information about our services, products, events, promotions, as well as invitations to participate in surveys or market research where such invitations are related to the Company's service offerings and assessment of client needs.

Legal basis – we process your personal data for direct marketing purposes only upon receipt of your consent (Article 6(1)(a) of the GDPR).

For existing clients, prior to the update of this notice, the legal basis for processing personal data for direct marketing purposes is the legitimate interests of the Company to provide clients with relevant information about the Company's services and offers that may be of interest, as well as requests to provide opinions on our services and their quality, thereby helping us improve the quality of our services or offering new and relevant services.

WHAT PERSONAL DATA WE PROCESS

For direct marketing purposes, we process your contact and identification data: name, surname, email address, phone number and, where relevant to a specific communication channel or offer personalisation, residential address or region.

In order to provide you with more relevant offers and avoid sending you irrelevant communications, we may also process your age, employer, income, place of residence, whether you are an investor or a borrower, your creditworthiness indicators, services and products you have ordered, shown interest in, or for which a creditworthiness assessment has been carried out — when we seek to assess which product or service would be relevant to you, taking into account your needs and interests in providing our clients with personalised offers.

We also process data related to your consent: the date, time, method of giving consent, the content or version of the consent text, the validity status of the consent, as well as the date, time and method of withdrawal of consent.

DATA TRANSFERS

We may transfer your personal data to our engaged service providers acting as data processors who assist in carrying out direct marketing activities, administering communication channels and sending notifications:

  • MailerLite – we use this platform to send monthly newsletters, news and other promotional messages to investors and borrowers
  • Omnisend – this platform is used for automated communication with users, sending personalised and behaviour-based direct marketing offers
  • TCG Telecom – sending SMS text messages to clients (offers, reminders and important notifications)

DATA RETENTION PERIOD

We will process your personal data for direct marketing purposes for 5 years from the date of receipt of your consent, unless you withdraw your consent earlier. As this period comes to an end, we may ask you to renew your consent for direct marketing so that we may continue to inform you about our services and provide you with personalised offers.

You have the right to withdraw your consent at any time by one of the following methods:

Withdrawal of consent does not affect the lawfulness of data processing carried out prior to the withdrawal. Upon expiry of the direct marketing data processing period or upon earlier withdrawal of your consent, we will no longer send you direct marketing messages. However, in order to demonstrate that consent was obtained and properly administered, evidence of the granting and withdrawal of consent will be retained for a further 2 years from the expiry or withdrawal date.

For existing clients based on legitimate interest, we will process your personal data for direct marketing purposes for as long as any contract with the Company is in force or until you object to the processing of your data for direct marketing purposes.

You have the right to object at any time to the processing of your personal data for direct marketing purposes by any of the following means:

  • By contacting us and notifying us of your objection by email: [email protected]
  • By logging into the self-service portal and clicking "I OBJECT"
  • By calling our general number: +37070080075 (calling from abroad: +37068700300)
  • By opting out of email direct marketing messages (newsletters) by clicking the link at the bottom of such an email

PROFILING AND PERSONALISED OFFERS

In order to ensure that the information, offers and other marketing messages we provide are as relevant as possible, we use profiling for direct marketing purposes. Profiling means that we use certain personal data to assess or predict which of our products, services, offers, content or information may be useful and relevant to you. This allows us to better understand your needs, interests and previous interactions with us, and to tailor marketing messages to your situation. No automated decisions are made; profiling for direct marketing purposes does not produce legal or similarly significant effects on you. The assessment of certain personal aspects will allow us to present you with suitable service offers or recommendations; profiling results are used solely to tailor marketing messages to your interests, past behaviour and likely needs.

YOUR RIGHTS

In addition to the aforementioned rights to object to processing on the basis of legitimate interest and to withdraw your direct marketing consent at any time, you also have the following rights:

  • The right to access personal data being processed
  • The right to request rectification of inaccurate personal data
  • The right to request erasure of personal data
  • The right to restrict the processing of personal data
  • The right to data portability

Requests for the exercise of your rights may be submitted in person or in writing by visiting the Company at Ukmergės g. 126, Vilnius, by sending your request by post or by electronic means (email). More information about your rights as a data subject and the exercise of those rights can be found in the Company's Privacy Policy, published on our website: https://www.paskoluklubas.lt/puslapis/24/privatumo-politika

If you have any questions about this notice or the processing of personal data for direct marketing purposes, you may always contact our Data Protection Officer by email: [email protected] (we recommend indicating that the correspondence is intended specifically for the Company's Data Protection Officer).

If you believe that your personal data is being processed unlawfully or in violation of your rights, you have the right to lodge a complaint with the supervisory authority – the State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius, www.vdai.lrv.lt). However, before lodging a complaint with the supervisory authority, we recommend contacting us first so that we may find an appropriate resolution to the issue.