Privacy Policy

Last updated: 2 March 2026

1. Introduction

Drop (ALAI Holding AS, org.nr 932 953 736) respects your privacy. This statement describes how we collect, use and protect your personal data.

We follow GDPR (General Data Protection Regulation) and Norwegian privacy legislation.

2. Data controller

ALAI Holding AS
Org.nr: 932 953 736
Address: Klofta, Norway
Email: post@alai.no

3. Data Protection Officer (DPO)

In accordance with GDPR articles 37–39 and the Personal Data Act, a Data Protection Officer has been appointed for Drop:

Alem Bašić
Email: alem@alai.no
Telefon: +47 40 47 42 51
Company: ALAI Holding AS (org.nr 932 953 736)
Appointed: 2 March 2026

The Data Protection Officer is responsible for ensuring that Drop processes personal data in accordance with applicable privacy legislation, including GDPR and the Norwegian Personal Data Act. You can contact the DPO directly with questions about how your personal data is processed.

4. What data we collect

We collect the following personal data:

• Identification data: Name, date of birth, address, phone number, email address
• BankID verification: To verify your identity
• Transaction data: Transfers, payments, account number (encrypted)
• Technical data: IP address, device information, platform
• Usage data: How you use the app (to improve the service)

5. Purpose of data collection

We use your personal data to:

• Deliver our services (remittance and QR payment)
• Verify your identity (BankID)
• Prevent fraud and money laundering
• Improve Drop and develop new features
• Send you important notifications about your account
• Fulfil our legal obligations

6. Legal basis

We process personal data based on:

• Consent: When you register and accept our terms
• Contract performance: To deliver the service you have requested
• Legal obligations: Anti-money laundering law, GDPR, financial legislation

7. Data sharing

We do not share your personal data with third parties, except:

• Payment partners: To execute transfers
• BankID: For identity verification
• Authorities: When legally required (e.g. the police in cases of suspected crime)

We never sell your personal data.

8. Data retention

We store personal data for as long as necessary to deliver the service. Transaction data is stored for a minimum of 5 years in accordance with anti-money laundering legislation.

If you delete your account, all personal data will be deleted within 30 days, except for data we are legally required to retain.

9. Your rights

Under GDPR you have the right to:

• Access: See what personal data we hold about you
• Rectification: Correct errors in your personal data
• Erasure: Have your personal data deleted (with certain exceptions)
• Data portability: Receive a copy of your data in a structured format
• Restriction: Request restricted processing of your data
• Objection: Object to the processing of your data

For å utøve disse rettighetene, send en e-post til post@alai.no.

10. Security

We use industry standards to protect your data:

• TLS 1.3 encryption for all communication
• End-to-end encryption for sensitive data
• Regular security tests and audits
• Limited access to personal data (authorised personnel only)

11. Cookies

Drop bruker cookies for å forbedre brukeropplevelsen. Se vår cookie policy for detaljer.

12. Contact and complaints

If you have questions about how we process your personal data, you can contact us:

General enquiry: post@alai.no

Data Protection Officer (DPO):
Alem Bašić — alem@alai.no — +47 40 47 42 51
ALAI Holding AS (org.nr 932 953 736)

Hvis du mener vi har brutt personvernreglene, kan du klage til Norwegian Data Protection Authority (datatilsynet.no).