Supplier Data Protection Appendix

1. BACKGROUND AND PURPOSE

This Data Protection Appendix applies to the Agreement between the Parties when the Supplier and/or its Subprocessors process the Customer's Personal Data based on the Agreement. The Customer is a legal entity, such as a company. This appendix does not apply to the personal data of consumer customers.

In the processing of Personal Data under this appendix, the Customer is the Controller and the Supplier is the Processor.

2. DEFINITIONS

“Subprocessor” means third parties used by the Supplier to fulfill its contractual obligations. For the sake of clarity, suppliers from whom the Supplier procures products to be delivered to the Customer are not considered Subprocessors of the Supplier.

“Separate Pricing” is defined in section 3.

“Personal Data” means any information relating to an identified or identifiable natural person (hereinafter “Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

”Processor” means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Controller.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.

“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

“Law” and ”Laws” mean the European Union General Data Protection Regulation (679/2016) and other applicable data protection regulations in force in Finland.

“Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data; where the purposes and means of such processing are determined by Union or Member State law, the Controller or the specific criteria for its nomination may be provided for by Union or Member State law.

”Data Subject” is defined above in connection with the definition of “Personal Data”.

“Agreement” means the cooperation agreement to which this appendix is attached or to which this appendix otherwise applies.

3. PROCESSING

The types of Personal Data and categories of Data Subjects are:

• Personal Data of the Customer's employees and representatives necessary for the delivery of the Supplier's products and services to the Customer: name, address, phone number, email address, and other contact information

The subject of the processing is the aforementioned Personal Data, and the duration of the processing is for the term of the Agreement.

The nature and purpose of the processing is the delivery of products and services in accordance with the Agreement.

The Supplier processes Personal Data only in accordance with the documented instructions provided by the Customer, which are attached as Appendix 1 to this Data Protection Appendix, unless otherwise required by law applicable to the Supplier. For the sake of clarity, the Customer may also provide subsequent instructions in writing or via email. If the Supplier is required by law to act otherwise, the Supplier shall inform the Customer of this legal requirement prior to processing, unless such notification is prohibited by law.

The Supplier ensures that its personnel and those of its Subprocessors authorized to process Personal Data on its behalf have committed to confidentiality or are subject to an appropriate statutory obligation of confidentiality.

If the Supplier is obligated by Law or other applicable legislation, regulations, or authority decisions, or is instructed or required to assist the Customer in fulfilling obligations related to the Customer's Personal Data—such as responding to data requests from Data Subjects or authorities, or performing tasks outside the scope of product or service delivery—the Customer shall pay the Supplier a separate fee for these tasks according to the Supplier's hourly/daily price list (“Separate Pricing”). These tasks may include, for example, transferring, deleting, or correcting Personal Data, providing information about Personal Data, collecting data for such purposes, or allowing audits or inspections.

At the rate specified in the Separate Pricing, and taking into account the nature of the processing, the Supplier shall assist the Customer through appropriate technical and organizational measures, insofar as possible, to fulfill the Customer's obligation to respond to requests for exercising Data Subject rights under the Law.

At the rate specified in the Separate Pricing, the Supplier shall assist in ensuring that the Customer can comply with its legal obligations regarding processing security, notifying the supervisory authority or Data Subject of Personal Data Breaches, conducting data protection impact assessments, and prior consultation with the supervisory authority.

At the rate specified in the Separate Pricing, the Supplier shall, at the Customer's choice, delete or return all Personal Data to the Customer after the termination of the Agreement and delete existing copies of Personal Data, unless legislation requires retention or the Supplier needs to retain it under legal conditions to establish, exercise, or defend a legal claim.

At the rate specified in the Separate Pricing, the Supplier shall make available to the Customer the information necessary to demonstrate compliance with the obligations set out in this section and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor authorized by the Customer. The auditor must not be a competitor of the Supplier, and the timing of the audit must be agreed upon in advance with the Supplier.

The processing of certain Personal Data is also subject to the Supplier's privacy policy, available as amended from time to time at https://www.verkkokauppa.com/fi/ohjeet/tietosuojaseloste.

4. USE OF SUBPROCESSORS

The Customer hereby grants a general written prior authorization for the Supplier to use Subprocessors for the processing of Personal Data. The Supplier's current list of Subprocessors is available at https://www.verkkokauppa.com/fi/ohjeet/alikasittelijat. If the Customer does not accept a new Subprocessor, either the Supplier or the Customer has the right to terminate the Agreement with thirty (30) days' notice. However, orders already placed for products or services, sales agreements, or other contracts for their delivery cannot be terminated or cancelled.

When the Supplier uses the services of a Subprocessor to perform specific processing activities on behalf of the Customer, the same data protection obligations as set out in this appendix shall apply to that Subprocessor.

5. CUSTOMER OBLIGATIONS

The Customer is the Controller of the Personal Data processed under this appendix. The Customer is responsible for, among other things, the accuracy of the Personal Data and ensuring that the Supplier and Subprocessors have the right to process it. The Customer is responsible for ensuring that the Personal Data provided to the Supplier or its Subprocessors complies with data protection legislation and has been disclosed to the Supplier and Subprocessors in the manner required by such legislation. However, the Supplier is the Controller for Personal Data subject to the Supplier's privacy policy.

6. DATA SECURITY

Taking into account the state of the art and the costs of implementation, the nature, scope, context, and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the Customer and the Supplier shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, such as:

a) pseudonymization and encryption of personal data;

b) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;

c) the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident;

d) a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing.

7. NOTIFICATION OF A PERSONAL DATA BREACH

The Supplier shall notify the Customer of a Personal Data Breach without undue delay after becoming aware of it.

8. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES AND OTHER TERMS

The Supplier shall not transfer Personal Data to countries outside the European Economic Area or the European Union unless authorized by Law or with the Customer's consent. Authorization under Law may include, for example, the conclusion of European Commission Standard Contractual Clauses or another lawful basis.

For the sake of clarity, the limitations of liability in the Agreement also apply to this appendix.

APPENDIX 1. PERSONAL DATA PROCESSING INSTRUCTIONS PROVIDED BY THE CUSTOMER

1. PERSONS PROCESSING PERSONAL DATA

The Supplier restricts access to the Customer's Personal Data so that only authorized and appropriately trained persons have access. Both the processed Personal Data and the persons with access to it are limited to what is necessary for specific processing activities.

The Supplier ensures that its personnel and those of its Subprocessors authorized to process Personal Data on its behalf have committed to confidentiality or are subject to a statutory obligation of confidentiality.

2. DATA PROTECTION AND SECURITY MANAGEMENT

The Supplier has a comprehensive data protection and security management policy applicable to the services provided to the Customer. The Supplier reviews and updates this policy annually as needed. The policy includes guidance and support for management and employees on data protection and security issues in accordance with business requirements and applicable laws.

3. FACILITY SECURITY

The Supplier is responsible for the facility security of its own premises and for issuing relevant regulations to ensure that only persons required for the performance of the Agreement have access to the Customer's Personal Data in accordance with section 1.1. The Supplier also strives to ensure data protection and security during maintenance activities.

4. DATA COMMUNICATIONS

Where necessary, data communications between the Supplier and the Customer related to the Agreement and its implementation shall be encrypted. Any manual data transfer shall be carried out with careful consideration of the security classifications of the data being transferred.

5. LOG DATA OF PERSONAL DATA PROCESSING

The Supplier shall reasonably consider the use of audit logs in Supplier systems or applications containing Personal Data. Any logs shall be retained for a reasonable period as required by applicable law in each situation.