International Cooperation for the Protection of Personal Data

Effective Date: 18 september 2023

Issued by: Neobank Capital

Applies to: All employees, contractors, subsidiaries, affiliates, and partners of Neobank Capital

1. Purpose

Neobank Capital operates globally and is committed to protecting personal data through cooperative engagement with international regulators, supervisory authorities, and partner organizations.

The purpose of this policy is to:

1. Ensure compliance with international data protection laws.
2. Promote responsible data sharing and cooperation with foreign regulators.
3. Facilitate joint investigations, audits, and enforcement actions to protect individuals’ rights.
4. Establish clear protocols for cross-border collaboration while safeguarding customer data.

2. Scope

This policy applies to:

1. All personal data processed by Neobank Capital that may be subject to international cooperation.
2. Interactions with foreign data protection authorities (DPAs), law enforcement, and regulatory bodies.
3. Collaboration with partners and vendors in jurisdictions outside the country of data collection.
4. Internal teams and officers handling requests for cooperation or joint data protection initiatives.

3. Principles of International Cooperation

Neobank Capital adheres to the following principles when engaging in cross-border cooperation:

1. Lawfulness and Transparency: All cooperation must comply with applicable laws and regulations and be communicated transparently.
2. Purpose Limitation: Personal data will be shared strictly for legitimate and defined purposes, such as regulatory compliance, fraud prevention, or legal investigation.
3. Data Minimization: Only the minimum necessary personal data required for cooperation is shared.
4. Security: All shared data must be transmitted and stored securely using encryption and access control measures.
5. Accountability: All cooperation activities are logged, auditable, and overseen by the Data Protection Officer (DPO).
6. Respect for Data Subject Rights: Data subject rights are preserved, including access, correction, objection, and erasure, wherever legally feasible.

4. Cooperation with International Data Protection Authorities

1. Neobank Capital actively engages with DPAs, regulators, and supervisory authorities in jurisdictions where personal data is processed.
2. The DPO serves as the primary liaison for international regulatory communications.
3. Cooperation may include:
4. Notifications of breaches affecting multiple jurisdictions.
5. Joint audits or inspections.
6. Exchange of best practices, guidance, and compliance methodologies.

5. Cooperation with Law Enforcement Agencies

1. Personal data may be disclosed to foreign law enforcement only when required by law, treaty, or formal request.
2. Requests must be reviewed by the Legal & Compliance Team and approved by the DPO.
3. All law enforcement requests are documented, including scope, justification, and legal basis.
4. Data disclosure is limited to what is strictly necessary for the investigation or legal process.

6. Cooperation with International Partners and Vendors

1. Partners and vendors outside the country of data collection must comply with Neobank Capital’s international data protection standards.
2. All cooperation agreements must include:
3. Data protection obligations aligned with GDPR and other relevant laws.
4. Encryption and security measures.
5. Protocols for cross-border data handling.
6. Periodic audits ensure compliance with these obligations.

7. Joint Investigations and Enforcement Actions

Neobank Capital may participate in:

1. Cross-border investigations initiated by regulatory authorities.
2. Data protection enforcement actions that require coordination with foreign DPAs.
3. Collaborative remediation of data breaches impacting multiple jurisdictions.

All joint actions must be coordinated through the DPO and documented for accountability and compliance purposes.

8. Documentation and Reporting

1. All international cooperation activities are recorded in internal compliance logs.
2. Records include:
3. Parties involved (regulators, partners, law enforcement)
4. Purpose and scope of cooperation
5. Data categories shared
6. Legal basis and authorizations
7. Security measures implemented
8. Documentation is retained in compliance with Neobank Capital’s Records of Processing Activities (ROPA).

9. Training and Awareness

1. All employees, contractors, and affiliates involved in international cooperation must undergo mandatory training on:
2. International privacy laws (GDPR, UK GDPR, Swiss FADP)
3. Secure data handling and encryption protocols
4. Regulatory liaison procedures
5. Training is updated annually or upon significant regulatory or operational changes.

10. Roles and Responsibilities

11. Review and Updates

1. This policy is reviewed annually or sooner if international regulations, company operations, or cooperation practices change.
2. Updates must be approved by the DPO and Chief Legal Officer (CLO).

12. Contact Information

Data Protection Officer (DPO)

📧 privacy@neobank.capital

📍 Neobank Capital – Global Privacy Office, 2355 116 74, Stockholm, Sweden