Home

Products

Use cases

Discover

Contact

Explore the docs

Get in touch

Explore the docs

Get in touch

Privacy Notice for Testers – Anessa

Legal | Last updated: 5 November 2026

1. General

Insurely AB, org. no. 559103-5646, a company registered in Sweden with its registered address at Kungsgatan 9, 111 43 Stockholm, Sweden ("Insurely", "we", or "us"), cares about your privacy and wants you to understand how we collect and use your personal data. This privacy notice ("Notice") explains how we process your personal data when you help us test our open finance products and services, offered under the name Anessa ("Services"), under the tester agreement you have signed with us, and how you can exercise your data protection rights.

Insurely is the controller of your personal data, even though our Services are offered under the name Anessa. We are responsible for and committed to processing your personal data in accordance with applicable data protection laws. You can contact Insurely using the contact details set out in section 8 below.

This Notice applies once you have become a tester by signing the tester agreement. How we process your personal data when you visit our tester website or express interest in becoming a tester is described in our separate privacy notice for the website and tester sign-up.

2. What personal data we process, why and on what legal basis

2.1 Personal data we process

Personal data is any information that identifies you or can reasonably lead to your identification. As a tester, we process the following categories of personal data:

  • Contact data, which includes your first and last name, your personal email address and your phone number, which we collect when you are onboarded and use to communicate with you via WhatsApp.
  • Authentication data, which includes personal data depending on the authentication method implemented in your country. For countries where logging in is supported by an electronic identification system (such as BankID for Sweden, MitID for Denmark, or any other electronic identification system applicable in your country), we will process your personal identity number. If a password-based authentication method is implemented, we will process your login credentials (email and password), while if a multi-factor authentication method is implemented, we will process your phone number or email.
  • Insurance data, which includes any information relating to your insurance, such as the insurance name, insurance company, insurance number, insurance premium, start and end date of the insurance policy, insurance amount, payment method, or any information about the insured item or persons. Note that the category "insured item or persons" will vary depending on the type of your insurance, e.g. home, pet or car insurance. In some cases, this will include special categories of personal data (i.e. certain data types of a particularly sensitive nature, such as health data). You can read more about the basis on which we lawfully process this data in section 3 of this Notice. Insurance data will sometimes also comprise personal data of a member of your household (for instance, where they are also insured under the same policy). Where this is the case, we ask that you notify those other individuals of this Notice.
  • Wealth data (including investments and pensions), which includes any information relating to your wealth products and data, including pension and investment products and data, such as the product name, company name, product type, name of policyholder, last day of policy, etc.
  • Financial data, which includes information about the invoice you send to us, such as the amount of compensation, VAT ID, Tax ID, invoice ID, invoice date, task name, task duration, and bank account details such as bank name, country of the bank, IBAN and SWIFT/BIC.
  • Communication data, which includes the content of our communications with you, such as emails or messages that we exchange through WhatsApp or another communication channel.

We collect this personal data directly from you and not from any other third party.

2.2 Why we process your data, on what legal basis and for how long

The GDPR requires a legal basis for each purpose for which we process your personal data.

Testing our Services

  • Personal data: Contact, Authentication, Insurance and Wealth data
  • Legal basis: Performance of the tester agreement (Art. 6(1)(b) GDPR). Data of co-insured persons: our legitimate interest in testing and developing our Services (Art. 6(1)(f)). Special categories of data: your explicit consent (Art. 9(2)(a); see section 3)
  • Storage: 30 days from each time we access your accounts, then deleted or anonymised

Compensating you

  • Personal data: Contact and Financial data
  • Legal basis: Performance of the tester agreement; legal obligations under tax and accounting law (Art. 6(1)(c))
  • Storage: As long as required by tax and accounting law

Support and communication

  • Personal data: Contact and Communication data
  • Legal basis: Performance of the tester agreement; for other contacts, our legitimate interest in testing and developing our Services and managing our tester relationships (Art. 6(1)(f))
  • Storage: While you are a tester (6 months from signing the tester agreement). Before the term ends, we may contact you to ask whether you want to renew

Establishing, exercising or defending legal claims

  • Personal data: Contact, Authentication, Insurance, Wealth, Financial and Communication data
  • Legal basis: Our legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f))
  • Storage: Signed tester agreements and consents are archived [indefinitely]; other data as long as needed in the specific case. Contact privacy@anessa.co for details

When we test our Services:

  • We access your insurance and/or wealth accounts only after you have authenticated yourself, and not continuously, for the term of the tester agreement (6 months from the date you sign it).
  • We only access, store and delete your data. We do not alter it.
  • If other people are covered by your insurance policy, we may also access their Contact and Insurance data and store it in the same way as yours.

3. Sensitive data

When you become a tester, we will access all relevant data relating to your insurance.

In some cases, depending on the insurance types linked with your account, this will include personal data classified as "special categories" of personal data under the GDPR (sometimes also called "sensitive data"). Special categories of personal data are given extra protection under data protection law because of their inherently sensitive nature. Special category data that we may access includes:

  • personal data revealing trade union membership;
  • data concerning health (which may derive from the type of your insurance, e.g. if it is pregnancy insurance); and

In order to process such data, the GDPR requires that we establish an additional legal basis. To this end, when you enter into the tester agreement, we ask for your separate explicit consent according to Art. 9(2)(a) GDPR, which is provided to you in a separate document together with the tester agreement.

You can withdraw your consent at any time. If you withdraw your consent, we no longer have a legal basis to process the data and will then delete your data without delay. Note that such withdrawal will not affect the validity of the agreement we have with you (the tester agreement).

4. How long we store your personal data

We retain the personal data we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with information you have requested, to comply with applicable legal, tax or accounting requirements, or to establish, exercise or defend legal claims). See section 2.2 for the retention periods that apply to each purpose.

When we have no ongoing legitimate business need or legal reason to process your personal data, we will either delete or anonymise it or, if this is not possible (for example, because your personal data has been stored in backup archives), we will securely store your personal data and isolate it from any further processing until deletion is possible.

5. Recipients of personal data and transfers of personal data

We will disclose the personal data described above to the following categories of recipients:

  • Courts and similar judicial entities and/or authorities, if required to do so by law.
  • Service providers on which we rely for our core operational activities, including WhatsApp (Meta), which we use to communicate with testers, and DocuSign, which we use for electronic signature of the tester agreement and consent.
  • An actual or potential buyer (and its agents and advisers) in connection with any actual or proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer that it must use your personal data only for the purposes disclosed in this Notice.

We primarily store and process your personal data within the EU/EEA. However, WhatsApp (Meta) and certain other service providers may transfer or process personal data in countries outside the EU/EEA, such as the United States.

In such cases, we ensure that the transfer is protected by an appropriate transfer mechanism, namely:

  • where the recipient country, or the recipient, is covered by an adequacy decision of the European Commission (including, for the United States, the EU-U.S. Data Privacy Framework for certified recipients), by relying on that decision; or
  • by implementing standard contractual clauses approved by the European Commission for the transfer of personal data to third countries.

If a transfer mechanism is deemed insufficient due to the national law of the recipient country, Insurely will take additional measures to ensure an adequate level of protection.

You can find out more about the transfers of your personal data and the safeguards we implement to protect your data by contacting us at privacy@anessa.co.

6. Your rights

You have certain data protection rights in relation to how we process your personal data. You can contact us at privacy@anessa.co at any time to exercise your rights as set out below. We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

6.1 Right to access

You have the right to access and receive a copy of your personal data that we process, as well as other supplementary information.

6.2 Right to rectification

You have the right to have inaccurate personal data rectified and, depending on the purpose of the processing, to have incomplete personal data completed.

6.3 Right to erasure

In certain cases, you have the right to request the erasure of your personal data, such as where the personal data is no longer needed for the purpose for which it was collected, or if we no longer have a legal basis to continue processing it.

6.4 Right to restriction of processing

In certain cases, such as when you have contested the accuracy of your personal data, you have the right to request that we restrict the processing of your personal data. In such a case, we will only store your personal data or further process it if permitted to do so by law.

6.5 Right to data portability

You have the right to data portability, which means that in certain cases you can receive the personal data you have shared with us in a structured, commonly used and machine-readable format, and that you have the right to request that we transfer this data to other data controllers where technically possible.

6.6 Right to object

You have the right to object to the processing of personal data based on our legitimate interest. You also have the right to opt out at any time from receiving any marketing communications we send you. Despite that, we will not send you any direct marketing communications (such as emails or messages) while you are a tester.

6.7 Right to withdraw consent

If we process your personal data based on your consent, you have the right to withdraw such consent at any time. Note that withdrawal of your consent will not affect the lawfulness of the processing we carried out prior to such withdrawal, nor will it affect processing of your personal data conducted in reliance on lawful processing grounds other than consent.

7. Informing you of changes to this Notice

If we make changes to this Notice, we will take appropriate measures to inform you. For significant changes in how we collect or process your personal data, we will ask for your consent, if this is required by applicable law.

You can see when this Notice was last updated by checking the "last updated" date displayed at the top of this Notice.

8. Contact information and complaints

If you have any questions, comments or complaints about how we process your personal data, we encourage you to contact us first at privacy@anessa.co, so that we can try to resolve the matter quickly. This does not limit your right to lodge a complaint with a supervisory authority at any time.

You have the right to lodge a complaint with the data protection authority in the EU/EEA country where you live, where you work, or where the alleged infringement took place. If you live in Germany, this is generally the data protection authority of your federal state (Bundesland). A list of the German data protection authorities is available at https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html. You can find the contact details of other EU/EEA supervisory authorities at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

You can also contact the Swedish Authority for Privacy Protection (IMY), which is the lead supervisory authority for the processing of personal data since Insurely has its main establishment in Sweden. IMY can be reached at:

Integritetsskyddsmyndigheten
Box 8114, 104 20 Stockholm, Sweden
Email: imy@imy.se
Phone: +46 (0)8 657 61 00
Website: www.imy.se