27 March 2023

The purpose of this privacy notice is to give you information on how we at Kamux Group process personal data relating to our whistleblowing scheme.

1. Data controller

Kamux Corporation (business ID 2442327-8)

Each Kamux Group company is responsible for the processing of personal data in its own activities for the purposes and on the legal basis set out in this privacy notice and may use personal data collected by other Kamux Group companies for the same purposes as necessary.

2. Contact details in privacy matters

As a data subject you may contact Kamux in all privacy matters using following contact information:

Kamux Corporation / Privacy matters
Parolantie 66
FI-13130 Hämeenlinna, Finland

Contact details of Data Protection Officer: privacy@kamux.fi

You can make a request for data subjects' rights by filling in the form at the Kamux place of business.

3. For what purpose is your personal information collected?

The purpose of the whistleblowing scheme is to monitor the Kamux Group's activities and to ensure the protection of persons reporting breaches of European Union and national law. The processing of personal data is based on national laws enacted under the Whistleblowing Directive (e.g. in Finland, the Act on the Protection of Persons Reporting Breaches of European Union and National Law § 2 and § 10). and EU Market Abuse Regulation. The whistleblowing channel allows the company to monitor its compliance with the rules and laws governing its activities, to protect whistleblowers and to ensure the confidentiality of the processing of data. The information will be used to monitor and investigate wrongdoing and, if necessary, to prepare, present or defend a legal claim.

Through the whistleblowing channel, persons who, in the course of their work, have discovered or suspect that they have discovered an infringement of European Union or national laws may submit a report under the applicable law for activities in the public interest in areas such as: public procurement; financial services, money laundering and prevention of terrorist financing; product safety; transport safety; environmental protection; radiation and nuclear safety; food and feed safety; animal health and welfare; public health; consumer protection; protection of privacy and personal data; security of network and information systems; taxation; grants and state aid; competition rules and financial market rules and regulations.

4. What type of information is collected and where do we collect personal data from?

The register may contain the following types of personal data about the whistleblower and the subject of the report and other related persons, such as witnesses:

• Name of the whistleblower, email address, telephone number. The report may also be made anonymously.
• Name of the subject of the report, information related to the illegal activity (incl. place and time), information about witnesses
• Information related to the reporting and processing of the report and messages (including report code and status).
• Any other information provided by the whistleblower himself.

In addition, information is stored on the handlers of reports coming through the channel, such as name, job title, e-mail address, user IDs in the system, log information on the use of the system.

The primary data source for the information stored in the register is the whistleblower himself. In addition, the data will consist of information recorded during the process of handling whistleblowing reports. Other data sources are used within the limits set by law.

5. Who do we share your personal information and may information be transferred outside the EEA?

Kamux does not regularly disclose data to outside the Kamux Group and does not transfer data outside the EEA. However, personal data may be disclosed in accordance with the law, such as for police investigations.

Kamux uses a subcontractor to manage the whistleblowing system and to process reports. As such, personal data will be transferred to subcontractors only to the extent necessary to implement the whistleblowing channel and process reports.

6. How your personal information is protected and how long we process information?

Only persons who have the right to process the data for their work may use the system which contains personal data. The handlers of the reports are bound by the obligation of secrecy. Each user has a personal username and password for accessing the system. The data is collected in databases which are protected by firewalls, passwords, and other technical means. The databases and their backups are situated in locked premises, and only certain individuals who are named beforehand have access to the data. Kamux shall ensure the realization of data protection with data processing agreements concluded with the subcontractors that process personal data. Data in the register is stored for as long as is necessary for the purpose of monitoring or to fulfil statutory obligations. In principle, the report data is retained for five years from the date of the report, unless further retention is necessary for the purposes of an ongoing criminal investigation, judicial proceedings or administrative enquiry or for the protection of the rights of the whistleblower or of the subject of the report. Personal data that is clearly irrelevant to the processing of the report will be deleted without delay.

7. Your rights as a data subject

You can send a request concerning the rights of data subjects to the address mentioned in section 2 or you can make a request by filling in the form at the Kamux place of business.

As a data subject, you have the following rights according to the data protection law. In certain circumstances, the company may have the right to restrict the exercise of the rights set out below, for example if it is necessary for the investigation of a crime or to protect the identity of the whistleblower.

• Right of access, rectification and erasure
• As a data subject you are entitled to obtain information of your personal data processed by Kamux. You have also a right to inspect the personal data concerning yourself, which is stored in the register, and a right to require rectification or erasure of your data.
• Right to object the processing
• You have the right to object your personal data processing.
• Right to lodge a complaint with a supervisory authority
• If you consider that the processing of personal data relating to you infringes the data protection regulation, you have the right to lodge a complaint with a supervisory authority. You may lodge your complaint in the EU Member State of your habitual residence, place of work or place of the alleged infringement.