Investors

Privacy statement

Privacy statement updated on January 29, 2021

This privacy statement describes how Revenio Group Corporation collects and processes the personal data of shareholders, subscribers to the company's newsletters, website visitors and representatives of partners. We are committed to protecting your privacy and will only process your personal data in accordance with applicable data protection and privacy legislation and good data processing practices.

WHO PROCESSES YOUR DATA?

Revenio Group Corporation (Business ID: 1700625-7)
Address: Äyritie 22
01510 Vantaa
Finland

WHO CAN YOU CONTACT ABOUT DATA PROTECTION QUESTIONS?

If you have questions related to data protection or want to exercise your rights, you can contact:

privacy@revenio.fi

WHAT PERSONAL DATA DO WE PROCESS?

If you are our shareholder, we process the following data about you, such as:

• the name of the shareholder or nominee registration manager
• social security number or other identification code
• contact information
• payment information
• tax information
• number of shares by share class
• the party of the central securities depository, in whose book-entry account the shares are registered
• information on joint owners
• other information according to the book-entry system.

If you are a subscriber of our newsletters, we process the following data about you:

• E-mail address

If you are a representative of our partner, we process the following data about you:

• Name
• E-mail address
• Telephone number
• Employer company / organization
• Position in the company or organization/job title
• Communication with you
• Information about our meetings

If you visit our website (https://www.reveniogroup.fi/en/), we process data collected with the help of cookies about from where you visit our website, which parts of our website you visit and which browser you use, among other things. Further information on the use of cookies is available in our cookie policy.

FOR WHAT PURPOSES AND ON WHAT BASIS DO WE PROCESS YOUR PERSONAL DATA?

The processing of shareholders' data is based on the Limited Liability Companies Act. The purpose of data processing is to keep a shareholder list of the shares and their owners connected to the book-entry system.

The sending of our electronic newsletters (such as annual reports and press releases) is based on your order.
If you are a representative of our partner, we will process your data for the implementation, analysis and development of cooperation based on a legitimate interest based on the contractual relationship between the company you represent and us.

WHERE DO WE GET YOUR PERSONAL DATA?

We collect your personal data primarily from you. If you are a shareholder, we also collect your data from the book-entry system. If you are one of our major shareholders, we can also collect your data from public sources. We can also receive your data from the company you represent or our partner.

TO WHOM DO WE DISCLOSE YOUR PERSONAL DATA?

Based on the Limited Liability Companies Act, the information in the shareholder list is public. The following information about shareholders can be viewed from the public terminal located at Euroclear Finland Ltd's customer service point:

• owner's name and address or municipality of residence
• date of birth
• citizenship
• details on ownership
• number of waiting lists and reason for being on a waiting list
• information on any joint owners.

If the magistrate has ordered a restriction on the release of information about the shareholder (so-called order of non-disclosure) and we or the account manager have been notified of the restriction, the shareholder's municipality of residence, address and other contact information entered in the shareholder list will only be released to the authority.

The names and shareholding information of the major shareholders are also published on our website.

We can disclose ownership and payment information necessary for submitting taxation to the tax administration. Data can also be disclosed otherwise if required by law.

We use the external service provider Euroclear Finland Ltd for the technical implementation and maintenance of the shareholder list.

In processing personal data, we also use the following service providers who process your personal data for us:

• IT system suppliers and other IT service suppliers
• providers of communication services and bulletin distribution services
• website maintenance service providers
• providers of information services (e.g. Modular Finance AB, which collects data on the major shareholders)

DO WE TRANSFER YOUR PERSONAL INFORMATION TO A THIRD COUNTRY?

As a rule, we do not transfer your data outside the EU/EEA area. To maintain the systems, Euroclear Finland Ltd uses external service providers whose partners may operate outside the EU/EEA area. In these cases, the security and appropriateness of the processing of personal data is ensured by an agreement between Euroclear Finland Ltd and the processor of personal data, which takes into account the standard clauses of the European Union Commission according to the Data Protection Regulation, or the transfer of data takes place by applying other appropriate protective measures.

HOW LONG DO WE STORE YOUR PERSONAL DATA?

We store personal data as long as it is necessary for the purposes of personal data processing or to comply with our legal obligations. We regularly evaluate the need to store data and delete or anonymize the data when it is no longer necessary for the purpose for which we collected it.

If you have subscribed to our electronic newsletters, we will send those newsletters until you ask us to stop sending them.

WHAT RIGHTS DO YOU HAVE?

To exercise your rights, you can contact:

privacy@revenio.fi

Right of access to your data

You have the right to receive confirmation from us as to whether we are processing your personal data. You also have the right to get access to your personal data and information about the processing of your personal data in accordance with the Data Protection Regulation.

When you exercise your right to access data, we will provide you with a copy of the personal data we process about you. If you request multiple copies, we may charge a reasonable fee based on administrative costs.

Right to rectification of your data

You have the right to ask us to rectify inaccurate and incorrect data without undue delay. You also have the right to have incomplete personal data completed by providing us with additional information.

Right to the erasure of your data

You have the right to have us delete your personal data without undue delay if:

• your personal data is no longer needed for the purposes for which it was collected or for which it was otherwise processed;
• you withdraw the consent on which the processing was based and there is no other legal basis for the processing of the data in question;
• you object to the processing of your personal data on grounds related to your personal special situation and there is no justified reason for the processing, or you object to the processing of your personal data for direct marketing purposes;
• we have processed personal data illegally; or
• personal data must be deleted in order to comply with the legal obligation applicable to us.

Right to restriction of processing

You have the right that we limit the processing of your personal data in such a way that, in addition to storage, your personal data may only be processed with your consent or to present, prepare or defend a legal claim or to protect the rights of another person, if:

• you dispute the accuracy of your personal data, in which case we will limit the processing while verifying the accuracy of the data;
• we process your personal data illegally, and you object to the deletion of your personal data and instead demand the restriction of the use of your personal data;
• we no longer need your personal data for the purposes of processing, but you need it to present, prepare or defend a legal claim; or
• you have objected to the processing of your personal data on grounds related to your personal special situation and you are waiting to find out whether our legitimate grounds override the grounds for your objection.

Right to data portability

You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and the right to transfer the data in question to another data controller if:

• we perform the processing automatically; and
• the processing is either based on your consent or is necessary for the implementation of the agreement between us or for the
implementation of pre-contractual measures at your request.

The right to transfer data from one system to another is limited to a procedure that does not adversely affect the rights or freedoms of others.

Right to object to the processing of personal data

You have the right to object to our processing of personal data based on our legitimate interest on the basis of your personal special situation.

Right to cancel the contract

You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal of consent does not affect the legality of our processing based on your consent prior to its withdrawal.

Right to file a complaint with the supervisory authority

You have the right to file a complaint with the Data Protection Ombudsman if you believe that your rights based on the Data Protection Regulation have been violated in the processing of personal data. The supervisory authority in Finland is the Data Protection Ombudsman (www.tietosuoja.fi/en/).

HOW DO WE ENSURE INFORMATION SECURITY WHEN PROCESSING YOUR PERSONAL DATA?

We store your personal data in systems that are protected by firewalls, personal user rights and passwords, as well as by other generally acceptable technical and organizational means in the industry at any given time.

The materials we maintain manually are located in premises to which unauthorized access is blocked.

Only the persons who need to process your personal data in order to perform their work tasks have access to your personal data that we process.