ROBIT PLC PRIVACY NOTICE

PERSONAL DATA OF SUPPLIERS’ REPRESENTATIVES AND CONTACT PERSONS

Last updated 1 June 2021

1. Introduction

This document describes how Robit Plc (hereinafter ”Robit”) and its staff process the personal data of Robit’s suppliers’ representatives and contact persons. Robit acts as a controller to such personal data.

As a controller, we are responsible for such personal data, and for the processing of such personal data. Protecting your privacy and your personal data is of utmost importance to Robit. We are committed to complying with the requirements of data protection regulation applicable to us in the processing of your personal data. The means and purposes of processing the personal data Robit’s suppliers’ representatives and contact persons are described in more detail in this Privacy Notice.

What is stated in this Privacy Notice, applies, where appropriate, to the processing of personal data conducted by Robit group companies.

2. Data controller and contact person

Data Controller

Robit Plc
(Business ID: 0825627-0)
Viikkiniityntie 9
33880 Lempäälä
Tel.: +358 3 3140 3400

Contact Person

Arto Halonen
c/o Robit
Tel.: +358 40 028 0717
Email: arto.halonen@robitgroup.com

3. Legal bases for processing and processing purposes

Processing of personal data must always be based on a legal basis set forth in the EU’s General Data Protection Regulation (the “GDPR”). Processing of personal data of Robit’s suppliers’ representatives and contact persons is based on the following legal bases:

• Data subject’s consent under applicable legislation;
• Compliance with a legal obligation to which Robit is subject;
• The performance of a contract between the data subject or an organization represented by the data subject and Robit, or other relevant connection between them, in which case the legal ground for processing is legitimate interest of Robit or a third party (such as current or future business partners, suppliers or customers). A legitimate interest may be, in particular:
  1. Ensuring and improving data security or the security of premises and data network; Protection of Robit’s property; To prevent and investigate suspected fraud and misuse;
  2. Managing and developing the supplier relationship;
  3. Other legitimate business purposes, such as service and product development.

Personal data is processed in particular for the following purposes:

1. Managing the deliveries of services or products ordered by Robit from a data subject or an organization represented by the data subject, as well as the execution of and the obligations related to the delivery of the services or products;
2. Invoicing and keeping track of the accuracy of the invoicing;
3. Taking care of, managing and developing supplier relations and other relevant connections comparable to such relations, such as the execution of mutual communications;
4. Developing the production of services and business development by using various surveys, for instance;
5. Analysing and compiling statistics for business purposes;
6. Advertising and marketing, including targeted marketing and electronic direct marketing, but only to the extent permitted by the applicable law or where the data subject has explicitly consented to such practices;
7. The execution of administrative payments and costs;
8. The prevention and investigation of malpractices, which can be conducted for example through camera and other technical monitoring.

After the termination of a delivery agreement or a relevant connection, Robit may transfer data subject’s personal data to direct marketing register of Robit to the extent permitted by the law.

The provision of personal data in the manner described in this Privacy Notice is partially based on a contract between the data subject and Robit or an entity represented by the data subject and Robit. In the context of entering into a delivery agreement as well as in the context of the delivery of services or products, the data subject is obliged to provide Robit with certain personal data for the processing purposes described in this Privacy Notice. The foregoing does not apply in situations where the provision of the data or certain processing of the data is based on the data subject’s consent. The non-delivery of personal data can prevent Robit from performing its contractual or other obligations or commitments, which can lead to the fact that a delivery contract cannot be entered into.

4. Categories of personal data processed by Robit

Robit may process the following personal data directly necessary for the maintenance of the relevant connection between the data subject and Robit and that relate to taking care of the rights and obligations of the parties. These personal data can be categorised as follows:

Basic information, such as

• Name
• Contact information (such as address, telephone number and email)
• When representing an entity, information concerning the data subject’s employer and position or assigned tasks within the entity

Information related to the contractual relation or other relevant connection between the data subject and Robit, such as

• Information related to the relevant contract and the data subject’s association to the contract, information on orders on products and/or services;
• Invoicing and payment details
• Information on communications between the data subject and Robit, and information on visits
• Possible permissions and prohibitions concerning direct marketing

Data collected through technical monitoring, such as

• log data of Robit’s data systems where appropriate
• data relating to access control and access control recordings where appropriate
• data relating to camera surveillance and other electronic surveillance recordings recorded when the data subject is visiting Robit’ premises

Furthermore, Robit may process change data of the above mentioned data categories.

5. Regular sources of personal data

Personal data are collected from the data subject himself/herself or from an organization represented by a data subject, for instance in the context of entering into a contract, filling in and signing order forms, or in connection to invoicing. When the contractual relation continues and in the context of delivering the ordered products and/or services, personal data is collected from the data subject himself/herself also by other means, for instance in various communications occasions via telephone or email or during the data subject’s visit on Robit’s sites.

Personal data may also be collected and updated from registers of companies belonging to the same group of companies and economic interest group with Robit as well as from authorities and companies providing services related to personal data, such as Suomen Asiakastieto.

6. Transfers and disclosures of personal data

Robit may transfer personal data to third parties in the following manner in order to fulfil the processing purposes described in this Privacy Notice. When personal data are transferred to an entity which processes personal data on behalf of Robit (i.e. data processor), Robit has through contractual arrangements ensured that personal data is processed only in accordance with Robit’s written instructions and only for the purposes described in this document and that access to personal data is restricted to persons who need access to data based on their tasks.

• Data processors: Robit may transfer personal data to processors in order for the processors to perform services and tasks assigned to them. Data processors’ tasks relate, for instance, to provision and maintaining of devices, data systems and software, as well as provision of other data processing services.

Some of the data processors used by Robit are located outside the EU or EEA area. Robit has contractually ensured that these entities undertake to apply an appropriate level of data protection in their processing practices, and thus the data transfers are subject to appropriate safeguards. More information on cross border transfers of the personal data and on the appropriate safeguards applied thereto from time to time is available from the contact person mentioned under Section 2 of this Privacy Notice.

Robit shares the personal data of suppliers’ representatives and contact persons to the companies belonging to the same group of companies with Robit to the extent necessary in order to e.g. facilitate the ordering and provision of products and/or services by Robit and to facilitate communications and cooperation between the Robit group companies in relation to such products and/or services.

Robit may disclose personal data to competent authorities when required to do so under applicable laws, to prepare for legal proceedings or to defend a claim within the limits permit-ted or required by applicable legislation from time to time.  In case of the sale of Robit’s business, or a part of it, or in case Robit conducts other organizational changes to its business, Robit may disclose personal data to the buyers and their advisors in accordance with the then current legislation.

7. Data retention period

The retention period of personal data depends on the data concerned and its purpose of use. Robit retains personal data at least as long as they are needed for the execution of the informed purposes of processing, such as in the performance of Robit’s contractual obligations or in managing the contractual relation with the supplier.

The retention periods are determined in accordance with the following criteria:

• Related personal data will be retained for as long as the legitimate interest of Robit can reasonably be considered valid. The validity of the legitimate interest is determined by, for example, the communications between Robit and the data subject. Ultimately, the retention period of personal data is tied to the term of a contract with the data subject or an organization represented by the data subject.
• Statutory retention periods may also apply. For instance, the accounting regulation requires that the information included in the accounting materials are retained for six years.
• Related personal data will be deleted when the data subject withdraws his/her consent or objects to the processing of your personal data for direct marketing purposes. In this case, however, Robit may keep the information regarding the data subject’s objection to receiving direct marketing

When personal data are no longer needed, the data is destroyed in a secure way or irrevocably anonymized.

8. Rights of the data subject

The GDPR provides the data subject with several rights based on which the data subject can in many situation himself/herself decide on the processing of his/her personal data. The data subject may use the following rights with regard to Robit to the extent Robit acts as the controller to the personal data of the data subject in question. The extent of your rights is subject to the legal basis for processing and exercising your rights requires identification.

• Right of access: The data subject has the right to obtain a confirmation from the controller on whether the controller processes personal data concerning the data subject and the right to access such data. The data controller may ask the data subject to specify his/her access request, amongst others, with regard to the details of the data to be delivered.
• Right to rectification: The data subject has the right to obtain from the controller the rectification of inaccurate personal data concerning him/her processed by the controller, or to have incomplete personal data processed by the controller to be completed.
• Right to be forgotten: The data subject has the right to obtain from controller the erasure of personal data related to him/her and the controller has the obligation to erase such data in case there is no longer a legal ground for the processing of such data or, where the legal or contractual obligation binding the controller related to the storing of the personal data has ended or, where the data subject has withdrawn his/her consent to the processing of his/her personal data.
• Restriction of processing: In certain cases, where so prescribed by law, the data subject may have the right to obtain from the controller restriction of processing of his/her personal data.
• Right to data portability: The data subject may, subject to certain conditions prescribed by law, have the right to receive the personal data concerning him/her processed by the controller in a commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the original controller.
• Right to object to processing of his/her personal data: In certain cases, the data subject may have the right to object to processing of personal data concerning him or her. The right to object is applicable in such situations in particular where the processing of personal data is based on the controller’s legitimate interest. In such situations the controller has to follow the data subject’s request, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
• To the extent the processing of personal data has been based on the data subject’s unambiguous consent, the data subject has, at any time, the right to withdraw his/her consent regarding the processing.

The requests shall be directed to the contact person mentioned in section 2 of this Privacy Notice.

In addition, the data subject has the right to lodge a complaint with the supervisory authority on the processing of the personal data by the controller. The complaint shall be made to the competent supervisory authority, in Finland to the Data Protection Ombudsman, in accordance with its instructions. The web-site of the Data Protection Ombudsman can be found here.

9. Changes to this Privacy Notice

Robit may, from time to time, change this Privacy Notice. You can tell when changes have been made to the Privacy Policy by referring to the “Last Updated” legend at the top of this webpage . Robit encourages you to review this document regularly for any changes. If Robit will materially change the ways in which Robit processes the personal data of Robit’s suppliers’ representatives and contact persons, Robit will post a notice on this webpage or send an e-mail to the data subjects.

ROBIT PLC PRIVACY NOTICE

SHAREHOLDERS

Last Updated 1 June 2021

1. Introduction

This Privacy Notice describes how Robit Plc (hereinafter ”Robit”) processes personal data of the shareholders, including other holders of rights, of Robit. Robit acts as a controller to such personal data.

As a controller, we are responsible for the personal data of the shareholders, and for the processing of such personal data. Protecting your privacy and your personal data is of utmost importance to Robit. We are committed to complying with the requirements of data protection regulation applicable to us in the processing of your personal data. The means and purposes of processing the personal data of the shareholders are described in more detail in this Privacy Notice.

2. Data controller and contact person

Data Controller

Robit Oyj
(Business ID: 0825627-0)
Viikkiniityntie 9
33880 Lempäälä
Tel.: +358 3 3140 3400

Contact Person

Violetta Silver
c/o Robit Plc
Tel.: +358 45 202 0252
Email: violetta.silver@robitgroup.com

3. Legal bases for processing shareholders’ personal data

The EU General Data Protection Regulation (EU) 2016/679 (“GDPR”) applies to all processing of personal data as a general law. Processing of personal data must always be based on a legal basis set forth in the GDPR.

Processing of shareholders’ personal data is based on the following grounds:

• Robit’s legal obligation
• Data subject’s consent under applicable legislation
• Legitimate interest of Robit

A legitimate interest may be, for instance, Robit’s group-wide information sharing, marketing and administrative activities, prevention of fraud or misuse of IT systems or money laundering, physical as well as IT and network security, as well as potential merger and acquisition activities. The provision of personal data of the shareholder as described in this Privacy Notice is necessary in order for Robit to comply with legal obligations to which Robit is subject.

4. Categories of personal data processed by Robit and purposes of processing

Robit processes the following shareholders’ personal data for the purposes of complying with legal requirements based in particular on the Limited Liability Companies Act (624/2006), for organizing General Meetings as well as collecting meeting participation information.

Shareholders’ personal data processed by Robit:

• identifying information, such as name of the shareholder, guardian or other holders of rights, personal identification number or other identifier, nationality and date of birth
• contact details
• payment and taxation related information
• information related to the shares owned by the shareholder, such number of shares per class of shares and the number and type of dispositions related to the shares
• information related to the shareholder’s participation to the general meetings
• information related to the communications between Robit and the shareholder

Furthermore, Robit may process change data of the above mentioned personal data.

Robit has camera surveillance on its premises. In addition to the foregoing personal data, Robit processes data relating to camera surveillance and other electronic surveillance recordings recorded when the data subject is visiting Robit’ premises.

5. Regular sources of personal data

Robit collects data concerning shareholders from the shareholder him/herself or from other permitted sources, such as from the book-entry register maintained by Euroclear Finland Oy or public sources in accordance with the applicable legislation.

6. Transfer and disclosure of personal data

Robit may transfer shareholders’ personal data to third parties in the following manner in order to fulfil the purposes of processing described in this Privacy Notice. When personal data are transferred to an entity which processes personal data on behalf of Robit (i.e. data processor) Robit has through contractual arrangements ensured that personal data is processed only in accordance with Robit’s written instructions and merely for the purposes described in this Privacy Notice and that access to personal data is allowed only for persons who need access to data based on their tasks. Data processors’ tasks relate, for instance, to provision of data systems and software as well as offering other data processing services.

Some of the data processors used by Robit are located outside the EU or EEA area. Robit has contractually ensured that these entities undertake to apply an appropriate level of data protection in their processing practices, and thus the data transfers are subject to appropriate safeguards. More information on cross border transfers of personal data and on the appropriate safeguards applied thereto from time to time is available from the contact person mentioned under Section 2 of this Privacy Notice.

Robit discloses personal data with the entities belonging to the same group of companies with Robit for a number of different purposes (such as centralized group functions, including without limitation intra-group communication, coordination and reporting). Such an exchange of information involves intra-group transfers of personal data between Robit group entities located in different parts of the world.

Unless otherwise required for personal safety reasons of the shareholder, the following personal data of the shareholder can be viewed on the public access terminal located at Euroclear Finland’s customer service data terminal:

• name and address or home municipality of the shareholder
• date of birth
• nationality
• details of ownership
• number of waiting lists and reason for being on a waiting list
• information on any joint owners

In addition, Robit regularly discloses personal data of the shareholders with Euroclear Finland Oy, for purposes of maintaining the book-entry system. Robit may also disclose personal data to competent authorities when required to do so under applicable laws, to prepare for legal proceedings or to defend a claim within the limits permitted or required by applicable legislation from time to time.

In case of the sale of Robit’s business, or a part of it, or in case Robit conducts other organizational changes to its business, Robit may disclose personal data to the buyers and their advisors in accordance with the then current legislation.

7. Data retention period

Robit or such data processor that processes personal data on behalf of Robit retains personal data in accordance with applicable legislation for at least as long as the shareholder owns Robit’s shares. When Robit no longer needs the data for the purposes described in this Privacy Notice, the data are deleted from Robit’s and/or processors’ data systems and other data files and irrevocably anonymized. Some of the personal data of shareholders, such as personal data included in general meeting minutes, may be retained indefinitely.

Where personal data are collected on the basis of an obligation based on applicable law, the retention time of personal data may also be subject to explicit statutory requirement.

8. Rights of the data subject

The data subject may use the following rights with regard to Robit to the extent Robit acts as the controller to the personal data of the data subject in question. The extent of the data subject rights is subject to the legal basis for processing and exercising your rights requires identification.

• Right of access: The data subject has the right to obtain a confirmation from the controller on whether the controller processes personal data concerning the data subject and the right to access such data. The data controller may ask the data subject to specify his/her access request, amongst others, with regard to the details of the data to be delivered.
• Right to rectification: The data subject has the right to obtain from the controller the rectification of inaccurate personal data concerning him/her processed by the controller, or to have incomplete personal data processed by the controller to be completed.
• Right to be forgotten: The data subject has the right to obtain from controller the erasure of personal data related to him/her and the controller has the obligation to erase such data in case there is no longer a legal ground for the processing of such data or, where the legal or contractual obligation binding the controller related to the storing of the personal data has ended or, where the data subject has withdrawn his/her consent to the processing of his/her personal data.
• Restriction of processing: In certain cases, where so prescribed by law, the data subject may have the right to obtain from the controller restriction of processing of his/her personal data.
• Right to data portability: The data subject may, subject to certain conditions prescribed by law, have the right to receive the personal data concerning him/her processed by the controller in a commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the original controller.
• Right to object to processing of his/her personal data: In certain cases, the data subject may have the right to object to processing of personal data concerning him or her. The right to object is applicable in such situations in particular where the processing of personal data is based on the controller’s legitimate interest. In such situations the controller has to follow the data subject’s request, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
• To the extent the processing of personal data has been based on the data subject’s unambiguous consent, the data subject has, at any time, the right to withdraw his/her consent regarding the processing.

The requests shall be directed to the contact person mentioned in section 2 of this Privacy Notice.

In addition, the data subject has the right to lodge a complaint with the supervisory authority on the processing of the personal data by the controller. The complaint shall be made to the competent supervisory authority, in Finland to the Data Protection Ombudsman, in accordance with its instructions. The web-site of the Data Protection Ombudsman can be found here.

9. Changes to this Privacy Notice

Robit may, from time to time, change this Privacy Notice. You can tell when changes have been made to the Privacy Notice by referring to the “Last Updated” legend at the top of this webpage. Robit encourages you to review this Privacy Notice regularly for any changes. If Robit will materially change the ways in which Robit processes the personal data of Robit’s customers’ representatives and contact persons, Robit will post a notice on this webpage or send an e-mail to the data subjects.

ROBIT PLC PRIVACY NOTICE

JOB APPLICANTS

Last updated 1 June 2021

1. Introduction

This document describes how Robit Plc (hereinafter ”Robit”) and its staff process the personal data of job applicants applying to Robit. Robit acts as a controller to such personal data.

As a controller, we are responsible for the personal data of job applicants, and for the processing of such personal data. Protecting your privacy and your personal data is of utmost importance to Robit. We are committed to complying with the requirements of data protection regulation applicable to us in the processing of your personal data. The means and purposes of processing the personal data of job applicants are described in more detail in this Privacy Notice.

What is stated in this Privacy Notice, applies, where appropriate, to the processing of personal data conducted by Robit group companies.

2. Data Controller

Robit Plc
(Business ID: 0825627-0)
Viikkiniityntie 9
33880 Lempäälä
Tel.: +358 3 3140 3400

Contact Person

Jaana Rinne
c/o Robit Plc
Tel.: +358 40 521 3286
Email: jaana.rinne@robitgroup.com

3. Legal bases for processing and processing purposes

The EU General Data Protection Regulation (EU) 2016/679 (“GDPR”) applies to all processing of job applicants’ personal data as a general law. Furthermore, certain provisions of the Finnish Act on Protection of Privacy in Working Life (759/2004) apply.

Processing of personal data must always be based on a legal basis set forth in the GDPR. Processing of employees’ data is based on the following legal bases:

• processing is necessary in order to take steps at the request of the data subject prior to entering into an employment contract
• Legal obligation to which Robit is subject
• Data subject’s consent under applicable legislation
• Legitimate interest of Robit. A legitimate interest may be, for instance, ensuring and improving data security or the security of premises and data network; preventing and investigating suspected fraud or misuse; and protection of Robit’s property.

Personal data of job applicants is processed in particular for the following purposes:

• 1. Recruiting; receiving and processing applications;
  2. Conducting personal and aptitude assessments;
  3. Maintaining a CV database;
  4. Informing the candidates whether they were selected to the position or not, as well as other communications between the job applicant and Robit.

4. Categories of personal data processed by Robit

Robit may process the following personal data directly necessary for the processing purposes mentioned above. These necessary personal data can be categorised as follows:

Basic information, such as

• Name of the applicant
• Personal identity number
• Contact details (such as address, telephone number and email address)

Information relating to suitability to the position, such as

• Information on work experience, qualification data and information relating to education
• Results of personal and aptitude assessment or other suitability assessment data. Those candidates that are, on the basis of the first interview, suitable for the position, may be required to participate to a personal and aptitude assessment. A person who is to be evaluated is always provided with a copy of the statement given.

Other information obtained from the job applicant, such as

• Job application and possible appendices of the application

Other information accumulated during the recruitment, such as

• Notes made by the interviewers
• Communications between the job applicant and Robit

Data collected through technical monitoring, such as

• Data collected from the job applicant’s use of Robit’s recruitment systems
• data relating to camera surveillance and other electronic surveillance recordings

In addition to the categories of personal data presented above, Robit may process special categories of personal data or personal data that is otherwise sensitive as follows:

• Drug test certificate or data included in it to the extent permitted in applicable legislation in order to establish the employee’s performance and ability to work.

5. Regular sources of personal data

According to the principal rule set forth in the Act on Protection of Privacy in Working Life, data relating to employees shall primarily be collected from the job applicant him/herself. In addition, data is collected also from other permitted sources, such as from data systems to which personal data of the applicant is recorded in connection with the job applicant’s use such data system.

6. Transfers and disclosures of personal data

Robit may transfer job applicant’s personal data to third parties in the following manner in order to fulfil the processing purposes described in this Privacy Notice. When personal data are transferred to an entity which processes personal data on behalf of Robit (i.e. data processor) Robit has through contractual arrangements ensured that personal data is processed only in accordance with Robit’s written instructions and only for the purposes described in this document and that access to personal data is restricted to persons who need access to data based on their tasks.

• Data processors: Robit may transfer personal data to processors in order for the processors to perform services and tasks assigned to them. Data processors’ tasks relate, for instance, to payroll management, offering and managing of devices, data systems and software as well as offering other data processing services.

Some of the data processors used by Robit are located outside the EU or EEA area. Robit has contractually ensured that these entities undertake to apply an appropriate level of data protection in their processing practices, and thus the data transfers are subject to appropriate safeguards. More information on cross border transfers of the employee personal data and on the appropriate safeguards applied thereto from time to time is available from the contact person mentioned under Section 2 of this document.

In certain cases Robit may share job applicants’ personal data to the companies belonging to the same group of companies with Robit to the extent necessary for the purposes of recruitment.

Robit discloses personal data for instance to authorities and Robit’s service providers within the limits allowed or required in currently applicable legislation.

7. Data retention period

Robit retains the personal data of the job applicants in accordance with the applicable legislation only for as long as the retention of data is necessary for processing purposes specified in this Privacy Notice. When Robit no longer needs personal data for the specified purposes, the data will be deleted from the data systems of Robit as well as from other files.

The general maximum retention period of personal data of job applicants is one year from the relevant recruitment decision, based on the limitation period for raising discrimination change under the Gender Equality Act (609/1986).

8. Rights of the data subject

The General Data Protection Regulation provides the data subject with several rights based on which the data subject can in many situation himself/herself decide on the processing of his/her personal data. The data subject may use the following rights with regard to Robit to the extent Robit acts as the controller to the personal data of the data subject in question.

• Right of access: The data subject has the right to obtain a confirmation from the controller on whether the controller processes personal data concerning the data subject and the right to access such data. The data controller may ask the data subject to specify his/her access request, amongst others, with regard to the details of the data to be delivered.
• Right to rectification: The data subject has the right to obtain from the controller the rectification of inaccurate personal data concerning him/her processed by the controller, or to have incomplete personal data processed by the controller to be completed.
• Right to be forgotten: The data subject has the right to obtain from controller the erasure of personal data related to him/her and the controller has the obligation to erase such data in case there is no longer a legal ground for the processing of such data or, where the legal or contractual obligation binding the controller related to the storing of the personal data has ended or, where the data subject has withdrawn his/her consent to the processing of his/her personal data.
• Restriction of processing: In certain cases, where so prescribed by law, the data subject may have the right to obtain from the controller restriction of processing of his/her personal data.
• Right to data portability: The data subject may, subject to certain conditions prescribed by law, have the right to receive the personal data concerning him/her processed by the controller in a commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the original controller.
• Right to object to processing of his/her personal data: In certain cases, the data subject may have the right to object to processing of personal data concerning him or her. The right to object is applicable in such situations in particular where the processing of personal data is based on the controller’s legitimate interest. In such situations the controller has to follow the data subject’s request, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
• To the extent the processing of personal data has been based on the data subject’s consent, the data subject has, at any time, the right to withdraw his/her consent regarding the processing.

The requests shall be directed to the contact person mentioned in section 2 of this document.

In addition, the data subject has the right to lodge a complaint with the supervisory authority on the processing of the personal data by the controller. The complaint shall be made to the competent supervisory authority, in Finland to the Data Protection Ombudsman, in accordance with its instructions. The web-site of the Data Protection Ombudsman can be found here.

9. Changes to this Privacy Notice

Robit may, from time to time, change this Privacy Notice. You can tell when changes have been made to the Privacy Policy by referring to the “Last Updated” legend at the top of this webpage. Robit encourages you to review this document regularly for any changes.

ROBIT PLC PRIVACY NOTICE

REPRESENTATIVES AND CONTACT PERSONS OF CUSTOMERS AND PROSPECTS

Last updated 1 June 2021

1. Introduction

This document describes how Robit Plc (hereinafter ”Robit”) and its staff process the personal data of Robit’s customers’ or potential customers’ representatives and contact persons. Robit acts as a controller to such personal data.

As a controller, we are responsible for such personal data, and for the processing of such personal data. Protecting your privacy and your personal data is of utmost importance to Robit. We are committed to complying with the requirements of data protection regulation applicable to us in the processing of your personal data. The means and purposes of processing the personal data Robit’s customers’ and potential customers’ representatives and contact persons are described in more detail in this Privacy Notice.

What is stated in this Privacy Notice, applies, where appropriate, to the processing of personal data conducted by Robit group companies.

2. Data controller and contact person

Data Controller

Robit Plc
(Business ID: 0825627-0)
Viikkiniityntie 9
33880 Lempäälä
Tel.: +358 3 3140 3400

Contact Person

Arto Halonen
c/o Robit Plc
Tel.: +358 40 0280 717
Email: arto.halonen@robitgroup.com

3. Legal bases for processing and processing purposes

Processing of personal data must always be based on a legal basis set forth in the EU’s General Data Protection Regulation (the “GDPR”). Processing of personal data of Robit’s customers’ or prospects’ representatives and contact persons is based on the following legal bases:

• Data subject’s consent under applicable legislation;
• Compliance with a legal obligation to which Robit is subject;
• The performance of a contract between the data subject or an organization represented by the data subject and Robit, or the customer relation or other relevant connection between them, in which case the legal basis for processing is legitimate interest of Robit or a third party (such as current or future business partners, suppliers or customers). A legitimate interest may be, in particular:
  1. Ensuring and improving data security or the security of premises and data network; Protection of Robit’s property; To prevent and investigate suspected fraud or misuse;
  2. Managing and developing the customer relationship;
  3. Marketing and customer acquisition;
  4. Other legitimate business purposes, such as service and product development.

Personal data is processed in particular for the following purposes:

1. The provision of services and/or products ordered by the data subject or an organization represented by the data subject, and the execution of and the obligations related to the provision of them;
2. Invoicing and keeping track of the accuracy of the invoicing;
3. Taking care of, managing and developing customer relations and other relevant connections comparable to such relations, such as the provision of customer service and the execution of customer communications;
4. Services production, business and customer service development by using customer satisfaction surveys, for instance;
5. Management of sales contact information;
6. Analysing and compiling statistics for business purposes;
7. Advertising and marketing, including targeted marketing and electronic direct marketing, but only to the extent permitted by the applicable law or where the data subject has explicitly consented to such practices;
8. The execution of administrative payments and costs;
9. The prevention and investigation of malpractices, which can be conducted for example through camera and other technical monitoring.
10. Organizing and managing of registrations and participation to our events and follow-up communications relating thereto.

After the termination of a customer agreement or a relevant connection, Robit may transfer data subject’s personal data to direct marketing register of Robit to the extent permitted by the law.

The provision of personal data in the manner described in this Privacy Notice is partially based on a contract between the data subject and Robit or an entity represented by the data subject and Robit. When the data subject places a service or product order by himself/herself or on behalf of the organization represented by the data subject, as well as in the context of the delivery of the services, the data subject is obliged to provide Robit with certain personal data for the processing purposes described in this Privacy Notice. The foregoing does not apply in situations where the provision of the data or certain processing of the data is based on the data subject’s consent. The non-delivery of personal data can prevent Robit from performing its contractual or other obligations or commitments, which can lead to the fact that the data subject or the organization represented by the data subject cannot place a service or product order or that the already ordered services or products cannot be provided.

4. Categories of personal data processed by Robit

Robit may process the following personal data directly necessary for the maintenance of the relevant connection between the data subject and Robit or that relate to taking care of the rights and obligations of the parties. These personal data can be categorised as follows:

Basic information, such as

• Name
• Contact information (such as address, telephone number and email)
• Preferred language where appropriate
• When representing an entity, information concerning the data subject’s employer and position or assigned tasks within the entity

Information related to the customer relation or other relevant connection between the data subject and Robit, such as

• Information related to the relevant contract and the data subject’s association to the contract, information on orders on products and/or services;
• Invoicing and payment details
• Information on communications, including possible marketing communications between the data subject and Robit, and information on visits
• Possible permissions and prohibitions concerning direct marketing

Data collected through technical monitoring, such as

• log data of Robit’s data systems where appropriate
• data relating to access control and access control recordings where appropriate
• data relating to camera surveillance and other electronic surveillance recordings recorded when the data subject is visiting Robit’ premises

Furthermore, Robit may process change data of the above mentioned data categories.

5. Regular sources of personal data

Personal data are collected from the data subject himself/herself or from an organization represented by a data subject, for instance in the context of entering into a contract, filling in and signing order forms, or in connection to invoicing. When the contractual relation continues and in the context of delivering the ordered products and/or services, personal data is collected from the data subject himself/herself also by other means, for instance in various customer service occasions via telephone or email or during the visits on Robit’s sites.

Personal data may also be collected and updated from registers of companies belonging to the same group of companies and economic interest group with Robit as well as from authorities and companies providing services related to personal data, such as Suomen Asiakastieto. In addition, Robit conducts active canvassing, and may collect basic data relating to data subjects from public websites or from other publicly available sources.

6. Transfers and disclosures of personal data

Robit may transfer personal data to third parties in the following manner in order to fulfil the processing purposes described in this Privacy Notice. When personal data are transferred to an entity which processes personal data on behalf of Robit (i.e. data processor), Robit has through contractual arrangements ensured that personal data is processed only in accordance with Robit’s written instructions and only for the purposes described in this document and that access to personal data is restricted to persons who need access to data based on their tasks.

• Data processors: Robit may transfer personal data to processors in order for the processors to perform services and tasks assigned to them. Data processors’ tasks relate, for instance, to provision and maintaining of devices, data systems and software, as well as provision of other data processing services, or to marketing or other equivalent tasks closely related to sales and marketing.

Some of the data processors used by Robit are located outside the EU or EEA area. Robit has contractually ensured that these entities undertake to apply an appropriate level of data protection in their processing practices, and thus the data transfers are subject to appropriate safeguards. More information on cross border transfers of the personal data and on the appropriate safeguards applied thereto from time to time is available from the contact person mentioned under Section 2 of this Privacy Notice.

Robit shares the personal data of customers’ representatives and contact persons to the companies belonging to the same group of companies with Robit to the extent necessary in order to e.g. facilitate the provision of services to its customers and to facilitate communications and cooperation between the Robit group companies in relation to provision of the services.

Robit may disclose personal data within the limits permitted or required by applicable legislation from time to time, for example to competent authorities when required to do so under applicable laws, to prepare for legal proceedings or to defend a claim. In addition, Robit may disclose personal data to a debt collection agency for purposes of debt collection, or to other service providers, but only to the extent that the fulfilment of their tasks require the disclosure of personal data.

In case of the sale of Robit’s business, or a part of it, or in case Robit conducts other organizational changes to its business, Robit may disclose personal data to the buyers and their advisors in accordance with the then current legislation.

7. Data retention period

The retention period of personal data depends on the data concerned and its purpose of use. Robit retains personal data at least as long as they are needed for the execution of the informed purposes of processing, such as in the performance of Robit’s contractual obligations or in managing the contractual relation with the customer.

The retention periods are determined in accordance with the following criteria:

• Related personal data will be retained for as long as the legitimate interest of Robit can reasonably be considered valid. The validity of the legitimate interest is determined by, for example, the communications between Robit and the data subject.
• Related personal data will be deleted when the data subject withdraws his/her consent or objects to the processing of your personal data for direct marketing purposes. In this case, however, Robit may keep the information regarding the data subject’s objection to receiving direct marketing.
• In case of customers’ contact persons and representatives, the retention period of personal data is ultimately tied to the term of a contract with the data subject or an organization represented by the data subject.
• Statutory retention periods may also apply. For instance, the accounting regulation requires that the information included in the accounting materials are retained for six years.

When personal data are no longer needed, the data is destroyed in a secure way or irrevocably anonymized.

8. Rights of the data subject

The GDPR provides the data subject with several rights based on which the data subject can in many situation himself/herself decide on the processing of his/her personal data. The data subject may use the following rights with regard to Robit to the extent Robit acts as the controller to the personal data of the data subject in question. The extent of your rights is subject to the legal basis for processing and exercising your rights requires identification.

• Right of access: The data subject has the right to obtain a confirmation from the controller on whether the controller processes personal data concerning the data subject and the right to access such data. The data controller may ask the data subject to specify his/her access request, amongst others, with regard to the details of the data to be delivered.
• Right to rectification: The data subject has the right to obtain from the controller the rectification of inaccurate personal data concerning him/her processed by the controller, or to have incomplete personal data processed by the controller to be completed.
• Right to be forgotten: The data subject has the right to obtain from controller the erasure of personal data related to him/her and the controller has the obligation to erase such data in case there is no longer a legal ground for the processing of such data or, where the legal or contractual obligation binding the controller related to the storing of the personal data has ended or, where the data subject has withdrawn his/her consent to the processing of his/her personal data.
• Restriction of processing: In certain cases, where so prescribed by law, the data subject may have the right to obtain from the controller restriction of processing of his/her personal data.
• Right to data portability: The data subject may, subject to certain conditions prescribed by law, have the right to receive the personal data concerning him/her processed by the controller in a commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the original controller.
• Right to object to processing of his/her personal data: In certain cases, the data subject may have the right to object to processing of personal data concerning him or her. The right to object is applicable in such situations in particular where the processing of personal data is based on the controller’s legitimate interest. In such situations the controller has to follow the data subject’s request, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
• To the extent the processing of personal data has been based on the data subject’s unambiguous consent, the data subject has, at any time, the right to withdraw his/her consent regarding the processing.

The requests shall be directed to the contact person mentioned in section 2 of this Privacy Notice.

In addition, the data subject has the right to lodge a complaint with the supervisory authority on the processing of the personal data by the controller. The complaint shall be made to the competent supervisory authority, in Finland to the Data Protection Ombudsman, in accordance with its instructions. The web-site of the Data Protection Ombudsman can be found here.

9. Changes to this Privacy Notice

Robit may, from time to time, change this Privacy Notice. You can tell when changes have been made to the Privacy Policy by referring to the “Last Updated” legend at the top of this webpage. Robit encourages you to review this document regularly for any changes. If Robit will materially change the ways in which Robit processes the personal data of Robit’s customers’ representatives and contact persons, Robit will post a notice on this webpage or send an e-mail to the data subjects.