Privacy statement, stakeholders

Updated 12 February 2019

Kojamo Plc (Business ID: 0116336-2)
on behalf of itself and the companies belonging to the same Group (hereinafter referred to as “Kojamo”)
Mannerheimintie 168a
FI-00300 Helsinki, Finland
Tel. +358 (0)20 508 3000

Kojamo Group’s data protection officer
Mannerheimintie 168a
FI-00300 Helsinki, Finland
Tel. 020 508 3000
tietosuoja@kojamo.fi

Data subjects should contact the [person/address] above in writing in all matters relating to the processing of personal data and the exercise of the rights of the data subject.

Kojamo’s stakeholder data file, Annual General Meeting registration, partner, sponsorship and grant programme data file.

Personal data are processed for the purpose of communications and information distribution between Kojamo and the persons belonging to its stakeholders and to enable the registration of Kojamo’s shareholders for Annual General Meetings via the electronic service of Euroclear Finland Ltd.

The personal data of partners are processed for the purpose of realising, maintaining, managing and developing cooperation between Kojamo and the partners.

The personal data of sponsorship and grant applicants and recipients are processed for the purpose of realising the application and selection processes, contacting the selected persons and other communications with them as well as paying out sponsorship payments and grants.

Personal data processing is based on the implementation of the agreement between Kojamo and the data subject, the implementation of preceding measures as well as Kojamo’s justified benefit. Kojamo’s justified benefit is connected to the cooperation with the data subject and the preparation, development or termination thereof, the analysis and development of Kojamo’s business as well as communications with stakeholders and partners. The processing of personal data may also be based on your consent for sending you marketing and communicating materials about our services by utilising your personal data.

If personal data processing is based on an agreement with the data subject, the disclosure of personal data is a prerequisite for the establishment of a contractual relationship.

Enabling Annual General Meeting registrations requires the identification of shareholders and ownership and, hence, the processing of personal data.

Personal data required for the implementation of the purposes of use of personal data can be processed in the stakeholder data file and the partner data file, including:

• name
• title/position
• employer
• contact details (mailing address, telephone number, e-mail address)

The following data may be collected when registering for the Annual General Meeting:

• name
• personal ID
• contact details (mailing address, telephone number, e-mail address)
• securities account number
• number of shares and votes
• voting information

The telecommunications link between the user’s browser and the server of Euroclear Finland Ltd is SSL encrypted, and the securities account number will only be used for identification taking place in Euroclear Finland’s system. Kojamo shall have the option to access an individual shareholder’s voting information to validate the voting results. Based on the social security number, the system will compare the provided information to the list of the company’s shareholders maintained by Euroclear Finland Ltd and pick the registrant’s ownership information from the list of shareholders.

In the sponsorship and grant programme data file, the personal data of registered applicants and sponsorship or grant recipients may be processed, including:

• name
• date of birth
• contact details (mailing address, telephone number, e-mail address)
• banking details
• for a data subject who is under 18 years of age, also corresponding information about the subject’s guardian
• other information about the data subject included in the application submitted to Kojamo
• potential other information the data subject has provided Kojamo with

The personal data of stakeholders and partners are collected from the data subjects themselves (e.g. in connection with meetings, other interaction or registering for the Annual General Meeting). When providing an authorisation, a person enters the required personal data of the representative. Information may also be collected from external sources, such as newspapers and other publications, generally available Internet sources and other generally available sources (such as the data subject’s employer) as well as from data files maintained by external service providers.

The personal data of grant applicants and recipients are collected from the data subject or, if the data subject is under the age of 18, from the data subject’s guardian.

As a rule, personal data is not disclosed outside Kojamo Group. Personal data may be disclosed within the limits permitted and required by the established laws to parties with a statutory right to access the data. Personal data may also be transferred to Kojamo’s service providers that process personal data on behalf of Kojamo in accordance with a confidentiality obligation and a binding data privacy contract as prescribed by law. Euroclear Finland Ltd shall ensure the technical maintenance of data pertaining to Annual General Meeting registrations.

As a rule, data are not transferred outside the area of the member states of the EU or the EEA, unless it is necessary for the purpose of processing personal data or the technical implementation of processing data, in which case the transfer of personal data shall conform to the requirements of data protection legislation pertaining to the implementation of suitable or appropriate protective measures, for example, using model contractual clauses approved by the European Commission or otherwise such that the processing of personal data takes place in accordance with this privacy statement.

The personal data processed in the stakeholder data file and the partner data file shall be stored for as long as it is necessary to process them for the purposes of use of the collected personal data. Nonetheless, the personal data in question shall be processed for a maximum of one (1) year from the latest communication between Kojamo and the data subject. Kojamo shall store data linked to Annual General Meeting registrations for one (1) year after the Annual General Meeting.

The personal data processed as part of the data file for sponsorship and grant programmes is stored for 6 years from the issuance of the sponsorship or grant and, in other cases, for 2 years from the date of the data subject’s application.

Personal data collected for Kojamo’s marketing and communication purposes, whose processing is based on Kojamo’s legitimate interests or your consent, shall be stored for as long as it is necessary to process them for the purposes of use of the collected personal data, unless you cancel any prior consent you may have given. Nonetheless, the personal data in question shall be processed for a maximum of one (1) year from the latest communication between you and Kojamo.

Personal data may be stored for a longer time, if necessary to fulfil an obligation imposed on Kojamo by a law, decree or some other official source.

The databases and data networks used for processing personal data are protected by organisational and technological measures.

Electronically processed data file information is protected with firewalls, passwords and other required technical means that are commonly approved in the data security sector at a given time.

Manually maintained materials are located in premises where unauthorised access is prevented.

Only designated employees of Kojamo or companies operating by commission and on behalf of Kojamo who have signed a non-disclosure agreement shall have access to the data in the data file using an individual access right granted by Kojamo.

The right of access to personal data

Data subjects have the right to be informed by Kojamo whether their personal data is being processed and to inspect what personal data concerning them is contained in the data file. The data subject also has the right to obtain a copy of the processed personal data. The access request shall be sent to Kojamo in accordance with section 2 and it must be in writing and signed. The access request may also be submitted personally by visiting Kojamo. The access right may be refused on legal grounds. As a rule, exercising the access right and delivery of the copy are free of charge, but Kojamo may charge a reasonable fee for their implementation based on the administrative costs if the data subject repeatedly requests copies or the requests are apparently groundless or unreasonable.

The right to request the rectification or erasure of personal data and the restriction of the processing of personal data

Kojamo will correct, erase or supplement any personal data in the data file that is incorrect, unnecessary, incomplete or outdated for the purposes of processing either at its own initiative or at the data subject’s request (by contacting Kojamo in accordance with section 2). The data subject shall also have the right to request that Kojamo restrict the processing of their personal data in circumstances such as when the data subject is waiting for Kojamo’s reply to a request to rectify or erase their personal data.

The right to object to the processing of personal data in some cases

On the basis of a specific personal reason, the data subject shall have the right to object to the processing of personal data by Kojamo that is based on Kojamo’s justified benefit. In this case, the data subject must contact Kojamo in accordance with section 2 and itemise the grounds on which the data subject objects to the processing. Kojamo may refuse the request on legal grounds.

The data subject shall also have the right to object to personal profiling as well as other processing measures directed by Kojamo at the data subject’s personal data to the degree that the processing of the personal data is based on Kojamo’s justified benefit.

The right to prohibit direct marketing

The data subject shall have the right to prohibit the processing and disclosure of the data subject’s personal data for the purpose of direct advertising, telemarketing or other direct marketing as well as marketing surveys and opinion polls by notifying Kojamo of this in accordance with section 2.

The right to revoke consent

If the personal data are processed on the basis of the data subject’s consent, the data subject shall have the right to revoke their consent by notifying Kojamo of this in accordance with section 2.

The right to data portability

To the degree that the data subject has submitted to the data file data that are processed in order to execute an agreement between Kojamo and the data subject or on the basis of the data subject’s consent, the data subject shall have the right to obtain such data in a structured, commonly used and machine-readable format as well as the right to transfer said data to another controller (if this is technologically feasible).

The right to lodge a complaint with a supervisory authority

The data subject has the right to lodge a complaint with a competent supervisory authority if Kojamo has not complied with the applicable data protection laws in its operations.