PRIVACY POLICY Customers

Last updated: 4th May 2026

INFORMATION ABOUT OUR PROCESSING OF PERSONAL DATA

It is important to us that you feel secure about how we handle your personal data. In summary, the following applies:

• FirstVet AB is responsible for the processing of your personal data.

• Why we process your personal data: We use and process your personal data when you interact with us – this may be when you make a purchase, book a consultation service or when we are otherwise in contact with you, e.g. via customer service, when you make a return (if applicable) or when we send you marketing material. We also process your personal data when we develop our products and services and to create a more personalised experience for you. The sections of the privacy policy referring to e-commerce is only applicable in markets where there is an e-commerce offering.

• Information we process: Personal data is any type of information that can be directly or indirectly linked to you. For example, we process identity information, contact information, purchase information, payment information, messages, technical data and your customer profile.

• Transfers outside the UK or the EU/EEA: Your personal data is generally processed within the UK or the EU/EEA, but may sometimes, and when certain safeguards are in place, be transferred to and processed in a country outside of these areas.

• Sharing of personal data: If necessary, your personal data may be shared with companies within our group, with suppliers, with subcontractors, with banks, authorities and advisors, and with other independent third parties who perform certain tasks on our behalf.

• Your rights: You have the right to access, rectify, erase and be informed. In certain cases, you also have the right to object to our use of your data or to our transfer of your data.

Below you can read detailed information about what personal data we process about you, why we do so and what rights you have. If you have any questions about our processing of personal data, you can contact us using the contact details below.

If you would like to know how we process your personal data when you apply for a job with us or if you are a contact person for one of our partners or suppliers, you can read more in our Privacy Policy for Job Applicants and Privacy Policy for Contact Persons.

1. WHO IS THE DATA CONTROLLER AND WHO SHOULD YOU CONTACT?

FirstVet AB, company registration number 559047–9894 ("FirstVet", "we", "us", "our") is the data controller for the processing of personal data as described here. This means that we are responsible for ensuring that the processing is carried out in accordance with applicable data protection legislation, including the General Data Protection Regulation of the EU and UK ("GDPR") and applicable national laws (including in the UK, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and the Data (Use and Access) Act 2025.

FirstVet AB
Address: Sveavägen 34, 111 34 Stockholm
Email: support@firstvet.co.uk
Telephone number: +44 330 808 1281

2. PERSONAL DATA WE PROCESS

2.1 Your personal data

We process data about you when you purchase our products, visit our website, book a consultation service, contact us in other ways or receive marketing from us. We only collect the personal data we need for the specific purpose. The personal data we collect also depends on how you interact with us. We usually collect your personal data directly from you, but we may also collect your personal data from our partners, such as insurance companies. Depending on the situation, we may collect the following information about you:

• Payment information: such as payment method, order amount, subscription fee, transaction reference, transaction time, amount.

• Identity information: such as information that enables us to identify you, such as your name, personal identification number and/or date of birth, username (e.g. on social media).

• Social media content: such as images, videos and other content that you share on social media that relates to us, e.g. if you tag us in a post or event.

• Recording information: such as your voice, video image, information you provide in conversations with us, e.g. when you have booked a consultation with a vet, as well as a transcript of the conversation.

• Contact details: such as information that enables us to contact you, such as your address, country of residence, email address and telephone number.

• Customer profile: all categories of data listed in this section and data created by us in connection with this, such as mosaic data, your perceived preferences, segment affiliation, etc. Read more in the section below (2.2).

• Purchase information: such as information about consultations you have booked or a product or subscription you have purchased/ordered; e.g. item number, price, size (where applicable), delivery address information (if different from that provided under Contact details), etc.

• Messages: such as information in your communication with us; e.g. content of emails, information you provide when contacting our customer service; information you provide when returning products or cancelling your purchase, product reviews, customer surveys, etc.

• Technical data: such as IP address, information about the device you are using (e.g. computer or mobile phone), such as operating system and browser type, login information, information about your user behaviour, browsing history, and which features you have used and when, collected via cookies or similar tracking technology, as well as location data.

For more information on how we use cookies, please see our Cookie Policy.

2.2 More about your Customer Profile

We use the information we collect about you to personalise the content you see and tailor the marketing that is displayed to you and sent to you based on what we believe will interest you.

This means that we use automatic processing and analysis of your personal data to gain a better knowledge and understanding of you and your personal preferences. To achieve this, we look at your Identity Data, Contact Details, Purchase Information, Payment Information, Messages and Technical Data to create a weighted Customer Profile about you.

The legal basis for this is your consent (Article 6.1 (a) GDPR). Consent is collected via the website (e.g. when you create an account) and via our cookie banner (in the case of Technical Data). You always have the right to withdraw your consent by contacting us using the contact details listed in section 1. You can withdraw your consent to Technical Data collected through cookies or similar tracking technologies in our cookie banner.

We do this while you are a customer with us and for up to three months thereafter. Customer means that you are either an account holder or have made a purchase of a product or service from us in the last 36 months.

We use your Customer Profile to:

1. Deliver our services with personalised content based on what we believe is most relevant to you,

2. Send you personalised marketing, and

3. Target advertising and sponsor posts on social media.

Read more about these purposes in the respective table in the section "Personalised marketing" below.

3. HOW WE USE YOUR PERSONAL DATA

3.1 User account

3.2 Providing services to you

3.3 Online sales of products (only applicable in markets where there is an e-commerce offering)

3.4 Marketing

3.5 Customer service, competitions and events

3.6 Development of our business, products and services

3.7 General processing

4. WHO DO WE SHARE YOUR PERSONAL DATA WITH?

We need to share your personal data with other parties in order to provide our products and services and to comply with laws and regulations. We share your personal data with:

• Our group companies (including FirstVet AB, our parent company, and its subsidiaries), for example to enable digital veterinary services, orders in our e-commerce, customer support, and for analysis and quality work, with the aim of providing a consistent customer experience and access to veterinary expertise.

• Veterinary clinics and veterinary hospitals, when necessary.

• Insurance companies and partners, for example to market our services in their offering to you, verify you as a policyholder and, where necessary, share medical records and other measures necessary for us to provide our services to you.

• Logistics and courier services for order processing and delivery.

• Service providers that provide systems necessary for our business and that handle the day-to-day operations, technical support, storage and maintenance of our IT solutions, such as internally used systems, platforms and hosting services.

• Banks and payment service providers to process payments and refunds.

• Analytics service providers (such as Google) to track and analyse traffic and user behaviour on the website and for marketing purposes.

• Social media platform providers such as Meta for marketing purposes.

• PR/marketing agencies to enable and manage competitions and events.

• Debt collection agencies in the event of non-payment for the collection of overdue debts.

• Government authorities when required by law or official decision.

• Courts in the event of a dispute or other legal proceedings.

• Law firms, auditors and other advisors.

• Other third parties, such as potential buyers and sellers, and advisors, if necessary to carry out a restructuring, merger, acquisition or sale of all or part of our assets.

5. WHERE YOUR DATA IS PROCESSED

We always strive to ensure that your personal data is processed within the United Kingdom or the EU/EEA, but in certain situations we may need to transfer your personal data to partners and service providers located outside the United Kingdom or the EU/EEA (so-called "third countries"). This occurs in certain cases and to a limited extent.

Regardless of where your personal data is processed, we take all reasonable contractual, technical and organisational measures to ensure that the level of protection for this processing is equivalent to that applicable within the United Kingdom or the EU/EEA (as applicable).

Where available, we will rely on an adequacy decision covering the processing of personal data by partners and service providers in third countries from: (i) the European Commission, where your data is subject to the EU GDPR, or (ii) the Government of the United Kingdom, where your data is subject to the UK GDPR. Otherwise, we include the appropriate standard contractual clauses issued by the European Commission and/or the Information Commissioner's Office (the "ICO") (as applicable depending on whether your data is subject to the EU or UK GDPR) with our partners and service providers who process personal data in third countries.

6. WHERE DO WE GET YOUR PERSONAL DATA FROM?

We mainly collect personal data directly from you, for example when you order a product from us, communicate with us or visit our website. We also collect personal data from other actors and sources, such as:

• Other group companies.

• Public address registers or credit reference agencies.

• Social media platform providers such as Google and Meta.

• Digital identity and security providers, such as BankID.

• E-commerce-related providers, such as payment services and shipping companies.

• Our partners, such as insurance companies.

We may also create new information about you, for example, when we predict your preferences based on how you have interacted with us.

7. DO YOU HAVE TO PROVIDE YOUR PERSONAL DATA?

Providing your personal data to us is voluntary, but in order for us to perform certain services and functions, it is necessary to provide us with your personal data, such as when purchasing products or subscriptions, subscribing to our newsletter, and participating in competitions and events. If you do not provide the personal data we request, it will be impossible for us to perform the requested services or provide our products to you.

8. YOUR RIGHTS

8.1 General

We are responsible for ensuring that your personal data is processed in a lawful, transparent and open manner in relation to you and that your data is accurate and up to date. You have certain rights regarding our processing of your personal data. If you wish to exercise any of your rights, please contact us using the contact details in section 1.

We will respond to you as soon as possible, and at the latest within one month of receiving your request. If we are unable to respond to your request or need more time, we will explain why.

8.2 Right of access (register extract)

You have the right to know whether or not we process personal data about you. If we do, you also have the right to obtain information about what personal data we process and how we process it. You also have the right to obtain a copy of the personal data we process about you.

If you are interested in specific information, please specify this in your request. For example, you can specify whether you are interested in a certain type of information or whether you want information about data from a specific period of time.

8.3 Right to rectification

If any of the personal data we process about you is incorrect, you have the right to have it corrected. You also have the right to supplement incomplete personal data with additional information necessary to make the data correct. Once we have corrected your personal data or supplemented it with new information, we will inform those to whom we have disclosed your data of the updated data, provided that this is not impossible or too cumbersome. If you request it, we will also tell you who we have disclosed your data to. If you request rectification, you also have the right to request that we restrict our processing of your data while we investigate the matter.

8.4 Right to erasure (right to be forgotten)

In certain cases, you have the right to request that we erase the personal data we have registered about you. You have the right to have your data erased if:

• The data is no longer needed for the purposes for which it was collected or otherwise processed.

• You object to the processing of the data on the basis of our legitimate interest and we cannot demonstrate that our reasons for processing outweigh your interests.

• The personal data is being processed unlawfully.

• We have a legal obligation to delete the personal data.

If we delete your data after you have requested it, we will also inform those to whom we have disclosed the data of the deletion, provided that this is not impossible or too cumbersome. If you ask us, we will also tell you to whom we have disclosed your data.

8.5 Right to restriction

Restriction means that the data is marked so that in future it may only be processed for certain limited purposes. The right to restriction applies:

• When you believe that the data is incorrect and you have requested correction. In this case, you can also request that the processing be restricted while we investigate whether the data is correct or not.

• If the processing is unlawful and you do not want the data to be deleted.

• When we no longer need to process the data for the purposes for which we collected it, but you need it to establish, assert or defend legal claims.

• If you have objected to processing based on our legitimate interest. In this case, you may request that we restrict processing while we investigate whether our interest in processing your data outweighs your interests.

Even if you have requested that we restrict processing, we have the right to use the data for storage, to assert or defend legal claims, or to protect someone's rights. We may also process the data for reasons relating to an important public interest. When the restriction ceases, we will inform you of this. If we restrict the processing of your data, we will also inform those to whom we have disclosed the data, provided that this is not impossible or too cumbersome. If you ask us, we will also tell you to whom we have disclosed your data.

8.6 Right to object

You have the right to object to our processing of your personal data based on our legitimate interest. If you object to the processing, we will, based on your specific situation, assess whether our interests in processing the data outweigh your interests in the data not being processed for that purpose. If we cannot demonstrate compelling legitimate grounds that outweigh yours, we will cease the processing to which you object, unless we must process the data to establish, exercise or defend legal claims.

If you object to the processing, you also have the right to request restriction during the period we investigate the matter.

8.7 Right to data portability

Data portability means that you have the right to obtain the data we have collected about you, from you, in a structured, commonly used and machine-readable format, and that you have the right to transfer this to another data controller. The right to data portability only applies:

• For data collected from you, about you,

• If the processing is based on your consent, and

• The processing is automated.

8.8 Right to withdraw consent

You have the right to withdraw your consent to a specific type of processing at any time. This does not affect the lawfulness of processing before consent was withdrawn.

Please contact us using the contact details provided in section 1 above if you wish to withdraw your consent. You can withdraw your consent to the processing of Technical Data in our cookie banner, i.e. in the same place where you gave your consent.

8.9 Right to complain

Please contact us if you are dissatisfied with how we process your personal data, so that we can try to resolve your issue together. See our contact details in section 1 above. You also have the right to lodge a complaint with the supervisory authority. The Swedish Data Protection Authority (IMY) is the Swedish supervisory authority for our use of your personal data. You also have the right to lodge a complaint with the supervisory authority in the country where you live or work, or in the country where you believe a violation of the regulations has taken place. In the United Kingdom, the supervisory authority is the ICO. See here: https://ico.org.uk/make-a-complaint/.

9. CHANGES TO THE PRIVACY POLICY

We reserve the right to change and update this privacy policy on an ongoing basis. In the event of significant changes, we will clearly inform you of this in an appropriate manner.