PRIVACY STATEMENT

This Privacy Statement (hereinafter referred to as the ”Statement”) describes how CIM Consult Solution Oy collects, processes and disclose personal information about the Service (”Service”) and the websites www.ccsgroup.com, www.ccsgroup.no, www.ccsgroup.se and www.ccsgroup.fi. Read this Description carefully before using the Service or browsing a web page.

1.            THE REGISTRAR

The controller under applicable data protection law is CIM Consult Solution Oy (hereinafter referred to as ”CCS”, ”we”, ”us” or ”us”). CIM Consult Solution Ltd is responsible for processing your personal data in accordance with this Statement and applicable privacy laws.

Contact details of the registrar:

CIM Consult Solution Ltd.

Business ID: 0937857-9

Address: Yliopistonkatu 34, 20100 TURKU

Data Protection Officers:

Jari Lehto / Janne Salminen

Address: Yliopistonkatu 34, 20100 TURKU

Email: GDPR@ccsgroup.fi

We are part of the CCS Group. Contact details of CCS Group’s Privacy Officer:

Lars Kvendbö

Address: Nybergflata 2, N-3072 Skien, NORWAY

Email: lars@ccs.no

2.            COLLECTION OF PERSONAL DATA

Your personal information may be collected in different ways. As a rule, we collect and process personal data that

• You have given us when you are in contact with us, eg. when you buy our Services, Products or registered Service, subscribed to our newsletter or contacted us to request a quote or information

• arising out of the use of the Service or Product or on a web site during a visit, for example, when signing in to the Service; and

• obtained from other sources, for example in the Trade Register, the Population Information System, the Enterprise Information System or the Postal Address Information System, in the extent permitted by applicable laws.

You do not have to give us your personal information, but if you choose to do so, we may not be able to provide our Services and Products to you.

We collect and handle, for example, the following personality groups:

• basic information, such as name, professional title and relationship with the company you represent and contact information (email, address and telephone number) and the language of the transaction;

• Customer relationship information such as Service and Order Information, Payment Information, Billing Information, Marketing Authorizations, and Bans;

• Customer contacts and associated correspondence and registrations regarding the rights of the data subjects

• Personal data generated by our service and the use of our Products, such as usernames, passwords, identification data, log information on the use of the Service or Product, information collected through cookies or similar technologies (device ID and type, operating system and application settings); and

• other case-by-case information on your consent.

3.            PURPOSE OF HANDLING OF PERSONAL DATA AND LEGAL BASIS

We only collect and process personal information that is necessary for our business, customer relationship management, and appropriate commercial purposes.

We will process your personal information for the following purposes:

1.            Provision of Services and Customer Relationship Management

We treat personal information primarily to provide and deliver to you or the company you represent for Service or Products. In order to do so, we maintain and maintain a customer relationship between you and your company and us. In this case, the processing of personal data is based on the agreement between you or your company and us.

2.            Marketing

We may be in touch with you to tell you about the new features of our Service or Product or to market and sell you other services. We can also process your personal information for marketing research and customer inquiries. The processing of personal data is based on our legitimate expectation to provide information as part of the Service and to market our other services to you. You may at any time have the right to object to the processing of your personal data for direct marketing (see Section 8 of this Explanation).

3.            Service development, security and internal reporting

We also deal with personal information in order to ensure the security of the Service and the webpage, to improve the quality of the service and webpage, and to develop the Service. We can also build internal reports based on personal data for the management to conduct our business properly. In these cases, the processing of personal data is based on our legitimate interest in ensuring the proper security of our Service and Website, as well as providing adequate and relevant information for the development of the Service and the management of our business.

4.            Compliance with the law

We can process your personal information to meet our statutory obligations, for example, regarding accounting or enforcing information requests based on law (eg tax authorities).

5.            Other purposes you have agreed to

We will also treat your personal information for other purposes if you have consented to such processing.

4.            TRANSFER AND DELIVERY OF PERSONAL DATA

We may disclose personal information to other companies within the CCS Group, subject to the applicable law, for the purposes described herein, including the marketing of the products and services of the aforementioned companies. Personal data can also be transferred between companies within the CCS Group for internal administrative purposes, such as reporting purposes and effectively conducting our business, such as using centralized information and communication systems. The disclosure of personal information within the CCS Group is based on our legitimate expectation to conduct our business and to effectively manage our customer relationships and to inform customers about the services of other CCS Group companies.

We may disclose personal information to third parties:

• in the extent permitted by or required by law, for example in connection with a request for information from a competent authority or in connection with legal proceedings;

• when our partners handle our personal information on our behalf and in accordance with our instructions. We always ensure that your personal data is handled properly;

• If we are involved in mergers, acquisitions or divestments of a business or part thereof;

• when we consider that disclosure is necessary to enforce our rights, to protect you or others, to investigate misconduct or to respond to a request from a public authority; and

• with your consent to the parties concerned.

5.            TRANSFER OF PERSONAL DATA OTHER THAN THE EU OR THE EEA

We do not transfer customer data from outside the EU and the EEA.

6.            COOKIES

We also use cookies and other similar technologies on the web site www.ccsgroup.com, www.ccsgroup.no, www.ccsgroup.se and www.ccsgroup.fi. Cookies are small text files placed on your device for collecting and remembering useful information, to enhance our web site functionality and usability. We may also use cookies and other similar technologies for statistical purposes, such as compiling statistics on how to use the website to understand how users use the webpage and improve their user experience.

You can block cookies, restrict cookies, or remove cookies from your browser. Because cookies enable our website to function, limiting the use of cookies may affect the usability of a webpage.

You can read more about cookies here at www.ccsgroup.fi

7.            STORING OF PERSONAL DATA

Personal data will only be retained for as long as is necessary for the purposes specified in this Explanatory Memorandum.

Personal data will be retained for customer relationship. Personal data may also be retained, if necessary, after the termination of the customer relationship, to the extent permitted or required by applicable law. For example, after the end of our relationship, we typically keep personal information that is necessary to meet demands or claims in accordance with the current limitation period. For example, we may retain personal information as necessary to comply with your direct marketing ban.

Personal data will be deleted when their retention is no longer necessary to carry out the law, or either party’s rights or obligations.

8.            YOUR RIGHTS

You have the right to inspect your personal information. You may at any time request your personal information to be corrected, updated or removed. However, please note that any personal information that is necessary for the purposes specified in this Specification or whose retention by law is required cannot be removed.

You have the right to object or limit the processing of your personal data to the extent required by applicable law.

In certain cases, you have the right to transfer the personal information you provide to us from one system to another, that is, your right to have your personal information in a structured, commonly used, machine-readable form and transfer your personal data to another registrar.

When processing your personal information, you have the right to withdraw your consent at any time. We will not process personal data unless there is a different legal basis for processing.

You can use your rights by sending a request to us at GDPR@ccsgroup.fi

If you feel that your processing of personal data is inappropriate, you have the right to contact the Data Protection Supervisor. You can find the contact details of the Data Protection Supervisor on the Privacy Supervisor’s website: http://www.tietosuoja.fi/en/index.html.

9.            SECURITY

We will take appropriate measures (including physical, digital and administrative) to protect your personal data from loss, destruction, misuse, unauthorized access or disclosure. For example, access to personal data is limited to persons who need them to handle their duties.

Please note that appropriate actions cannot prevent any potential security breaches. In the event of personal data security breaches, we will inform you of any applicable laws.

10.         CHANGING THE SELECTION

We have the right to change this Explanation. We will notify you of any changes to our website www.ccsgroup.com, www.ccsgroup.no, www.ccsgroup.se and www.ccsgroup.fi, where you will also find the latest version of this Description.

11.         CONTACT

To inquire about this Description or to learn more about processing your personal information, please contact us by email at GDPR@ccsgroup.com.