Privacy policy

Cappy always processes personal data in accordance with applicable law, including the EU’s General Data Protection Regulation.

Privacy policy for Cappy

Version 2.0, in effect from: 2026-08-27.

General

Cappy AB, reg. no. 559267–1357, with address Kungsportsavenyen 21, 411 36 Gothenburg, Sweden (”Cappy”) cares about your personal integrity.

The terms ”we”, ”our”, ”ours” and ”us” in this policy refer to Cappy. The terms ”you”, ”your” and ”yours” refer to the person whose personal data is processed by Cappy.

This privacy policy describes how Cappy processes personal data when you, for example:

  • create or have a Cappy account,
  • use Cappy’s app, web applications or other services,
  • visit our website,
  • contact our support or in other ways communicate with us,
  • participate in surveys, campaigns or referral programs,
  • receive information or marketing from Cappy, or
  • apply for a position with Cappy.

This Privacy Policy covers such processing where Cappy is a data controller. In some parts of our services Cappy also processes personal data as a data processor on behalf of your employer. The difference is described further below.

Cappy processes personal data in accordance with applicable law, including the EU’s General Data Protection Regulation (GDPR).

We want you to feel secure with the data we process, and we therefore ask that you read this privacy policy that describes how we process your personal data and what rights you have according to law. You are always welcome to contact us if you have any questions about our processing of your personal data. You will find our contact information in section 6 below.

1. What personal data do we process, for which purposes, according to what legal basis and how long do we store it?

Cappy’s processing as a data controller

In the table below you will find information about what personal data we process, why we process it, what legal basis we have for the processing and how long we store your personal data for the respective purposes.

Before you create and activate a Cappy account, Cappy may process certain identity, contact and employment data on behalf of your employer, for example to identify you and enable your Cappy account to be connected to the correct employer. For this processing, your employer is the data controller and Cappy is the data processor.

When you create and activate your personal Cappy account, a direct relationship is established between you and Cappy. Cappy is the data controller for the processing activities where Cappy determines the purposes and means of the processing within this relationship. These processing activities are described in the table below. At the same time, Cappy may continue to process certain personal data solely on behalf of your employer, as described in more detail under the heading “Cappy’s processing as a data processor”.

We may receive personal data:

  • directly from you, for example when you create your account, provide contact details, contact us, respond to a survey, or participate in an offer;
  • from your employer, when your employer connects you to Cappy or provides information required for employer-related features;
  • through your use of Cappy and our services, for example technical information, logs, choices and usage data;
  • from our partners and service providers, where required for a specific feature; and
  • from publicly available or other lawful sources, where relevant for a specified purpose.

Where Cappy receives personal data from someone other than you, we will provide the information required under the GDPR where applicable.

Why do we process your personal data? (Purpose) What personal data do we process? What is the legal basis for the processing? How long do we store your personal data?
To create, identify, administer and maintain your personal Cappy account and our direct relationship with you.
Name, personal identity number where required for secure identification, telephone number, email address, account status, registration date, language, settings and other account identifiers.
To fulfil our agreement with you.
For as long as you have a Cappy account. When the account is closed, we delete or anonymise the data unless it needs to be retained for a longer period for another purpose set out in this Privacy Policy or to comply with a legal obligation.
To administer transactions and financial services between you and Cappy.
Identity data, contact details, pay-related data, information about other compensation and payments, transaction data, amounts, dates, payment references and other information required for the relevant service.
To fulfil our agreement with you and, where applicable, to comply with a legal obligation.
For as long as you have a Cappy account. When the account is closed, we delete or anonymise the data unless it needs to be retained for a longer period for another purpose set out in this Privacy Policy or to comply with a legal obligation.
To provide information about work, deviations and absence, earned and expected pay and other available compensations and payments (for example bonuses or expenses).
Number of hours worked per pay period, deviations and absence, earned pay and other available compensations and payments (for example bonuses or expenses), withdrawals made, regular pay.
Consent.
For as long as you have a Cappy account or until you withdraw your consent. Thereafter, we delete or anonymize the data unless it needs to be retained for a longer period for another purpose set out in this Privacy Policy or to comply with a legal obligation.
To provide information about location, work and other related information and functionality.
Employers, employment relationships, colleagues, workplaces and work shifts.
Consent.
For as long as you have a Cappy account or until you withdraw your consent. Thereafter, we delete or anonymize the data unless it needs to be retained for a longer period for another purpose set out in this Privacy Policy or to comply with a legal obligation.
To provide voluntary functionality and information relating to personal finances, learning and other Cappy services that you choose to use.
Banks and bank accounts, savings and investments, financial health, income and expenses, training and courses started and completed, ratings and feedback.
Consent.
For as long as you have a Cappy account or until you withdraw your consent. Thereafter, we delete or anonymize the data unless it needs to be retained for a longer period for another purpose set out in this Privacy Policy or to comply with a legal obligation.
To communicate with you about your Cappy account and our services, provide support, respond to enquiries, and provide important service and security information.
Name, contact details, account status, and information relevant to the communication or support matter.
To fulfil our agreement with you and, in certain cases, legitimate interest.
For as long as you have a Cappy account and for up to 2 years thereafter, or until the data is anonymised earlier, unless the data needs to be retained for longer to handle the communication or support matter or to establish, exercise or defend legal claims.
To provide you with information about Cappy, our current and future products and services, features, offers, campaigns and opportunities to use Cappy, including through a current or future employer. We may also ask whether you would like to recommend Cappy to others or participate in referral and recommendation programs.
Name, telephone number, email address, account status, information about whether you are or have previously been connected to a Cappy employer, communication and marketing preferences, and limited information about your interaction with such communications.
Legitimate interests in maintaining our relationship with users, developing our business and marketing Cappy’s products and services. Where applicable law requires prior consent for direct marketing through a particular communication channel, we only use that channel where the applicable requirements have been met.
For as long as you have a Cappy account or until you object to processing for direct marketing purposes. If you close your Cappy account, Cappy will stop processing your account data for direct marketing purposes. However, limited information may be retained to respect previous objections or unsubscribe requests.
To conduct user surveys, collect feedback and analyse how our services are perceived.
Contact details, responses, feedback, account/user category and any information provided voluntarily.
Legitimate interests or consent, depending on the survey.
For 2 years, thereafter, we delete or anonymize the data.
To analyse how Cappy and our services are used, monitor functionality and usage patterns, and develop and improve our products and services.
User data, account type, usage data, information about features used, choices and interactions within Cappy, technical logs, date and time, and other limited information about how the service is used.
Legitimate interests in analysing, developing and improving our products and services.
Personal data is retained only for as long as necessary for the analysis purpose. The data may thereafter be anonymised and used for statistics, analysis and product development.
To provide, protect, analyse and improve our website and digital services.
IP address, device and browser information, technical logs, date and time, pages visited, referring page, use of features and similar online identifiers.
Legitimate interests or consent where required under applicable cookie rules.
Retention periods vary depending on the type of data and technology used. Technical and security-related logs are retained only for as long as necessary for their respective purposes. Retention periods for cookies and similar technologies are set out in our Cookie Policy.
To administer referral, tip and recommendation programs, identify who submitted a referral, follow up on the referral and administer any applicable reward.
Name, contact details, referral ID, the company to which the referral relates, referral status and information about any reward, as well as, where required for payment, tax, accounting or reporting purposes, personal identity number, payment details and tax-related information.
To fulfil our agreement with you relating to the referral program, our legitimate interest in administering and following up on referrals, and compliance with legal obligations relating to, for example, accounting, tax and reporting, depending on the processing activity.
For the duration of the programme and thereafter for as long as required under applicable accounting, tax and limitation rules.
To administer recruitment processes and assess candidates’ suitability for a position.
Name, contact details, CV, application documents, education, work experience, references, interview notes and other information voluntarily provided by the candidate.
Steps taken at your request prior to potentially entering into an employment agreement and our legitimate interest in administering and evaluating the recruitment process.
For 1 year after the recruitment process has ended, separate consent if candidate is to be retained longer for future roles.
For accounting purposes.
Personal data contained in accounting records and supporting documentation, such as name, personal identity number where applicable, transaction and payment data, employer or other counterparty, and information about payments between you and Cappy.
To fulfill a legal obligation.
For 7 years after the end of the calendar year when the current fiscal year ended.
To comply with our legal obligations relating to customer due diligence, measures to prevent money laundering and terrorist financing, financial sanctions, and other applicable regulatory requirements.
Identity and contact details, personal identity number, information about the customer relationship and services used, transaction data, information required for customer risk assessment, information concerning any PEP or sanctions status, and other information from you, your employer, public authorities, public sources, or our screening and information service providers that is necessary to comply with our legal obligations.
To fulfill a legal obligation.
For the period required under applicable law. Data subject to anti-money laundering legislation is normally retained for 5 years from the point in time specified by law and may, where the statutory conditions are met, be retained for a longer period, up to a maximum total period of 10 years.
To investigate, counteract and prevent fraud and similar situations.
Identity, account, transaction, device, contact and usage data, as well as other information that is necessary in the individual case to prevent, detect or investigate fraud, misuse or security incidents.
Legitimate interests to prevent, detect and investigate fraud, misuse and security incidents and, where applicable, compliance with a legal obligation.
For as long as the data is needed for the relevant fraud prevention or security purpose, taking into account applicable limitation periods and any specific retention requirements.
To enable Cappy’s creditor (third party) to determine, assert and defend legal claims.
Personal identification number, amount, date of withdrawal, date of repayment (regular payday).
Legitimate interests to enable a third party to defend its interests in potential legal claims against employers if Cappy is unable to do so.
For as long as the data needs to be retained to establish, exercise or defend the relevant legal claim, taking into account applicable limitation periods.
To determine, assert and defend legal claims.
The information necessary to establish, exercise or defend the relevant legal claim.
Legitimate interests to defend our interests in potential legal claims.
In accordance with the longest storage time applicable for the other purposes listed above, unless there is a risk of a potential dispute, in which case the data will be processed until it is no longer needed to ensure Cappy’s rights or until the dispute is settled.

Your Cappy account is personal and separate from any individual employment relationship. If your employment with an employer that uses Cappy ends, certain employer-related features may cease or become unavailable. However, your Cappy account may remain active and be used for other available Cappy features or to connect you to another employer that uses Cappy.

When we state that personal data is anonymized, this means that the data is processed in such a way that it can no longer be linked to you or any other identifiable person. Anonymized data is no longer considered personal data and may, for example, be used for statistics, analysis and the development of our services.

When we rely on legitimate interests as the legal basis for processing, we assess our own or a third party’s interest in the processing, whether the processing is necessary, and how the processing affects your interests, rights and freedoms.

Examples of Cappy’s legitimate interests include administering and developing our business and services, maintaining security, preventing misuse, communicating with users and, where appropriate, marketing our products and services.

For direct marketing, Cappy normally uses only basic account, contact and communication information, as well as information needed to determine whether an offer is relevant. We do not use detailed information about, for example, your pay, financial situation, bank accounts, loans, earned wage withdrawals or absence from work to target marketing to you, unless we have specifically informed you about the processing and have an applicable legal basis.

Cappy’s processing as a data processor

When Cappy processes personal data solely on behalf of your employer, the employer determines the purposes of the processing and is the data controller. In such cases, Cappy processes the personal data in accordance with the employer’s instructions in its capacity as a data processor.

This applies, for example, before you have created and activated a Cappy account, when your employer provides Cappy with limited identity, contact and employment data so that we can identify you and connect your future Cappy account to the correct employer.

Cappy manages early payouts of your earned pay and other compensation, and makes pay payments on the regular payday, as well as other payments, on behalf of your employer. This means that Cappy acts as a data processor on behalf of your employer when processing personal data for these purposes. Your employer remains responsible for paying your pay.

When Cappy acts as a data processor on behalf of your employer, Cappy processes personal data such as employment information, contact information, schedule, working time, absence, pay, payments, bank details, and other information provided by the employer. The personal data is processed as long as you have a Cappy account or as long as your employer is connected to Cappy, unless Cappy receives other instructions from your employer.

The same type of personal data may, in certain cases, be processed by Cappy as a data controller for a different and separate purpose. This does not affect the allocation of responsibilities for processing that Cappy carries out solely on behalf of the employer.

Personal data that Cappy processes solely in its capacity as a data processor on behalf of your employer is not used by Cappy for its own marketing purposes.

If you wish to have more information about the processing that your employer is responsible for as a data controller, we kindly ask that you contact your employer.

2. To who do we disclose your personal data and where do we process it geographically?

Your personal data may be disclosed to and processed by third parties. For example, we may share personal data with:

  • IT, hosting and cloud service providers;
  • providers of identification and security services;
  • payment and banking infrastructure providers;
  • communication and support service providers;
  • analytics and marketing service providers;
  • CRM and customer management systems;
  • employers where required for employer-connected services;
  • lenders where required for the relevant service;
  • auditors, legal advisers and other professional advisers; and
  • public authorities or other recipients where we are required to do so by law.

Where the recipient processes personal data on our behalf, we enter into a data processing agreement. Where the recipient independently determines the purposes and means of the processing, the recipient is an independent data controller.

Cappy aims to process personal data within the EU/EEA. However, some of our service providers or their sub-processors may process personal data outside the EU/EEA. Where such a transfer takes place, we ensure that an appropriate transfer mechanism under the GDPR is in place, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where necessary.

3. Cookies and similar technologies

We use cookies and similar technologies, such as pixels, SDKs and local storage, for essential functionality, security, analytics and – where you have consented to it – marketing. Such technologies may involve the processing of information such as your IP address, device information, cookie ID, information about pages visited and interactions with our website.

More information about the technologies and service providers we use, their purposes, retention periods and how you can change your choices is available in our Cookie Policy.

4. Automated decision-making and profiling

Cappy uses automated systems for certain control and security purposes. For example, these systems may identify anomalies or potential matches that require further review.

Such automated checks do not in themselves result in decisions that produce legal effects concerning you or similarly significantly affect you. A potential match is reviewed and assessed by a human before any decision affecting you is made.

5. Your rights

When we process your personal data, you have certain rights according to law. Please note that the exercising of these rights is subject to certain requirements and conditions specified by law (EU’s General Data Protection Regulation).

Your rights may in certain cases be restricted by other applicable legislation. For example, anti-money laundering legislation may prevent Cappy from providing certain information about processing relating to the review or reporting of suspicious transactions or activities.

We respond to requests to exercise your rights without undue delay and normally no later than one month after receiving the request. Where permitted under the GDPR, this period may be extended depending on the complexity of the request or the number of requests received. We may request additional information where necessary to verify your identity before acting on a request.

It is normally free of charge to exercise your rights. If a request is manifestly unfounded or excessive, in particular because of its repetitive character, Cappy may, to the extent permitted by law, charge a reasonable fee or refuse to act on the request.

Your right to information and access

You have the right to request confirmation as to whether Cappy processes personal data about you and, if so, to access that data and receive a copy of it together with the information to which you are entitled under applicable law.

Your right to rectification and erasure

If your personal data is incorrect or incomplete, you have a right to request that we correct or complete the relevant personal data. You can correct some of your personal data yourself directly in the app.

You have the right to request that we delete personal data we have registered about you subject to certain conditions (specified in EU’s General Data Protection Regulation). If your request meets the relevant conditions, we will delete your personal data.

The right to erasure is not absolute. We may need to continue retaining certain personal data, for example to comply with a legal obligation or to establish, exercise or defend legal claims.

Your right to withdraw consent

You have the right to at any time withdraw your consent to our processing of personal data. This will however not affect the legality of the processing that we carried out until you withdrew your consent.

Your right to object

You may, at any time, object to the processing of personal data based on our legitimate interests. We will subsequently no longer process the personal data, unless we are able to prove compelling legitimate grounds for the processing that override your interests, rights and freedoms or if it is for the establishment, exercise or defense of legal claims.

Your right to object to direct marketing

You have the right to, at any time and free of charge, object to the processing of your personal data for direct marketing purposes. If you object, Cappy will stop processing your personal data for such purposes.

You can, for example, exercise this right through your communication settings in Cappy, by using the unsubscribe function in a marketing message, or by contacting us.

Your objection to marketing will not affect your Cappy account or your ability to use our services. We may retain limited information about your objection to ensure that you do not receive such marketing again.

Your right to restriction

Under certain conditions specified in EU’s General Data Protection Regulation, you have the right to request that the processing is restricted. If you have this right such personal data will only, except for storage, be processed with your consent, for the establishment, exercise or defense of legal claims, to protect the rights of another natural or legal person or for other reasons involving an important public interest.

Your right to data portability

You may have the right to obtain personal data relating to you that you have provided to us in a structured, generally used and machine-readable format, and you may have the right to transfer this data to another data controller when technically possible.

Your right to file a complaint

If you are dissatisfied with how we have processed your personal data, you are welcome to contact us so that we have the opportunity to address your concerns. See our contact information in section 6. You also have the right to make a complaint about our processing of personal data to the supervisory authority in your country of residence or employment, or in the country where the processing of personal data which you are dissatisfied with has been carried out. In Sweden, the competent supervisory authority is:

The Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten)
Box 8114
104 20 Stockholm
imy@imy.se

6. Contact Cappy

Your security and data protection are important to us. If you have any questions about this Privacy Policy, how we process personal data, or your rights, you are welcome to contact us:

Cappy AB
Org.nr 559267-1357
Kivra: 559267-1357
106 31 Stockholm
privacy@cappy.se

7. Changes

Cappy reserves the right to amend and update this Privacy Policy from time to time. This is necessary to ensure that we can continuously improve our services and introduce new features to provide you with an even better user experience.

We may also need to make changes to how we process your personal data to ensure that such processing is carried out in accordance with applicable laws and regulations.

The latest version is always available on our website. If we make material changes that affect how we process your personal data, we will inform you in an appropriate manner, for example through Cappy’s services, by email or on our website, before the changes take effect where required by law.