DATA CONTROLLER AND GENERAL INFORMATION

Privacy and security of personal information is important to Svalner Atlas Finland Oy (Business ID: 2293331-1) and Svalner Atlas Accounting Oy (Business ID: 2675318-2). Both Svalner Atlas Finland Oy and Svalner Atlas Accounting Oy may process personal data of their clients, potential clients or other data subjects parallelly, but they both act as independent data controllers determining the purposes and means of processing of personal data. For processing of personal data of any website visitors of svalneratlas.fi, Svalner Atlas Finland Oy acts as the sole data controller.

Svalner Atlas Finland Oy and Svalner Atlas Accounting Oy are referred in this privacy policy (the “Privacy Policy”) both separately and together, as the context indicates, as “SAF”, “we” or “us”.

For the purposes of this Privacy Policy, “controller”, “processor”, “personal data”, “data subject” and “processing” shall have the meanings given to them in them in the applicable data protection legislation. For the purposes of this Privacy Policy, the “applicable data protection legislation” shall mean the applicable laws and regulations in respect of the processing of personal data and data protection, including the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, “GDPR”) as well as supplementary Finnish legislation, case-law and guidance from supervisory authorities.

SAF is committed to protect the personal data it receives and to process personal data in accordance with the applicable data protection legislation.

This Privacy Policy applies to and describes the processing of personal data collected by SAF through and in connection with:

• the SAF website (www.svalneratlas.fi) and other online services in use from time to time;
• SAF’s marketing activities and communications, contacts, seminars and other events; and
• professional services provided by SAF.

All such services hereinafter referred to together as the “Services”.

By visiting the SAF website and our other online services, attending our marketing activities, seminars or other events, using our Services and/or submitting any personal data SAF, you expressly understand that SAF may process personal data concerning you in accordance with this Privacy Policy. If you do not understand or consent to the processing of personal data, please do not use, access or otherwise provide SAF your personal data.

As a client of SAF , you are automatically added to our newsletter list based on the client relationship. You may however at any time decide to unsubscribe and opt-out, if you do not want to receive these newsletters.

Our website may include links to third-party websites and services operated by other data controllers. As they are not controlled by us, this Privacy Policy is not applicable to their use. We offer these links only as additional information to provide better client service. Please also note that this Privacy Policy does not apply to any links to third party websites or services which one may come across in connection with the use of the Services. Therefore, we encourage you to consult any privacy policies on these third-party websites separately. SAF assumes no responsibility for the privacy practices of any other data controller. All collection, use, processing and storing of any personal data by a third party shall be subject to the applicable privacy policies of such third party.

WHAT ARE THE PURPOSES OF PROCESSING PERSONAL DATA

SAF only collects personal data that is relevant and necessary for the intended purpose.

SAF may collect and process personal data to the extent necessary for the purposes of:

• setting up and maintaining our client relationships;
• conducting and performing our Services;
• identifying our clients as per applicable laws and conducting research for conflicts of interest;
• fulfilling the rights and obligations of the clients and the data controller;
• processing of personal data regarding our stakeholders (such as suppliers, job applicants, employees or other business partners);
• processing of personal data of website visitors for the purpose of ensuring and developing the technical functionality and security of our website;
• processing of personal data for the purposes related to our Services including developing, providing, fulfilling, and marketing of our Services;
• communicating and collaborating with SAF’s stakeholders, such as direct electronic marketing, newsletters and organizing of seminars or other events in accordance with applicable law;
• designing and developing our business operations, performing market research, maintenance and development of our Services or quality assurance;
• protecting the rights and property of SAF as well as preventing and investigating fraud and other misuses; and
• complying with the legal obligations of SAF and otherwise in connection with law enforcement or other civil or criminal legal proceedings.

WHAT IS OUR LEGAL BASIS OF PROCESSING PERSONAL DATA

The legal basis for processing personal data is, depending on the purpose of processing as listed above, either performance of a contract, legitimate interests of the data controller, consent, or compliance with a legal obligation of the data controller. Processing personal data is necessary for us based on the following reasons:

• Performing our obligations in accordance with any contract that we may have with our clients or other stakeholders.
• It is in our legitimate interest or a third party’s legitimate interest to use personal data to ensure that we provide our Services in the most efficient and appropriate manner.
• Compliance with any legal obligations which are imposed on us.

CATEGORIES OF PERSONAL DATA PROCESSED

In order to provide the Services, SAF needs to collect certain information, by which a person is individually identifiable (i.e. “personal data”).

SAF may collect personal data of the following persons, relevant for the above-mentioned purposes of processing:

• clients and their representatives and contact persons;
• representatives and contact persons of subcontractors and suppliers;
• potential clients and their representatives and contact persons;
• other stakeholders and their representatives (job applicants, referees, co-operation partners); and
• persons related to client assignments.

The following personal data of the data subjects, relevant for the above-mentioned purposes of processing, may be processed:

• name;
• e-mail address;
• phone number;
• company and title;
• name and business ID of the company and contact person;
• additional information provided by the data subject;
• personal data processed on a case-by-case basis in connection with client assignments (such as emails, documents, other communication);
• information gathered on the basis of visiting our website, such as IP address and browser information;
• information based on client relationship, such as contact history, feedback and follow-up information;
• invoicing and billing information;
• information needed to carry out certain client assignments, such as date of birth, personal identification number, home address, citizenship, and passport copy; and
• information needed for identifying a person as provided for in the Finnish Act on Preventing Money Laundering and Terrorist Financing (444/2017, as amended) (such as name, date of birth, personal identification number, citizenship, passport copy and information to determine financial situation and political influence of a person).

The data SAF collects may also include information it receives from the email interaction or other contact with its stakeholders in connection with the Services.

SOURCES OF PERSONAL DATA

Personal data is primarily collected from the data subject during the course of our business activities.

Personal data may also be obtained from authorities, courts or other institutions, or public sources. Some of the personal data may also be obtained from the employer of the data subject, referee provided by the data subject, or from a representative or a business partner of a client.

Some of the personal data may also be generated by us based on the data we have. We may, for example, compile and analyse data we possess in order to create new data. Some of the data used for such activities can be collected from public sources, such as trade registers or corporate websites.

RECIPIENTS OF PERSONAL DATA

Unless otherwise stated below, SAF does not sell, lease, rent or otherwise disclose personal data to unauthorised third parties without your consent.

Notwithstanding the above, SAF may provide personal data to third parties working with SAF for the purposes mentioned above, including third party service providers that provide SAF with support with our IT systems. However, such parties are obliged to process the data on our behalf, and they are not permitted to use such personal data for any other purposes than those listed above. They are also required to act consistently with this Privacy Policy and to use appropriate security measures to protect the personal data.

SAF may be obligated by mandatory legislation to disclose personal data to certain authorities, such as law enforcement agencies. SAF may also process personal data in connection with defending the legitimate interests of SAF in civil or criminal legal proceedings or to prevent and investigate fraud and other misuses.

SAF may transfer and provide personal data to its affiliates in the Svalner Atlas Advisors for internal administrative purposes, which may relate to finance, human resources, IT, compliance or other functions. In such cases the transfer is based on the legitimate interests or legal obligations of both entities involved in the transfer.

SAF may transfer, assign and disclose personal data to its affiliates or a subsequent owner or co-owner in connection with a corporate merger, consolidation, restructuring, or the sale of substantially all of the stock or assets or in connection with bankruptcy proceedings or other corporate reorganization, in accordance with this Privacy Policy.

TRANSFERS OF PERSONAL DATA OUTSIDE THE EUROPEAN UNION OR THE EUROPEAN ECONOMIC AREA

As a main rule, personal data is not transferred outside of European Union or the European Economic Area.

However, transfers of personal data outside the European Union or the European Economic Area may occur especially when using some of the features provided by our technical service providers (such as Google Analytics). Any possible transfers of the personal data will always be carried out in accordance with applicable data protection legislation and subject to appropriate safeguards as required.

RETAINING PERSONAL DATA

SAF retains personal data only for as long as it is necessary for the purposes of processing which have been determined in advance.

The personal data is systematically and regularly updated and data type specific retention periods are re-evaluated in regular intervals. On the basis of such evaluations, any personal data which is outdated or has become redundant, i.e. personal data which SAF no longer has a legal basis to retain or process, will be deleted on a regular basis. Personal data has become redundant, for example, when the client, business, co-operation or contract relationship with the controller has ceased, notwithstanding cases where legislation requires retaining personal data or where SAF needs the data for the establishment, exercise or defence of legal claims or to handle a similar disagreement.

When the storage of personal data is no longer necessary for the purpose for which it was initially collected, we may however continue storing the personal data only as long as such processing is required by law or is reasonably necessary for our legal obligations or legitimate interests such as claims handling, bookkeeping, internal reporting, reconciliation purposes and direct marketing.

The data retention period and retention criteria may vary depending on the categories of personal data and on the purpose of each special category of personal data. SAF may also have a statutory obligation to retain certain personal data for a specific time period. Due to this, the exact time periods and procedures for data destruction vary by data category.

RIGHTS OF THE DATA SUBJECT

You have the following legal rights relating to your personal data which you may, as appropriate on a case-by-case basis and in accordance with the applicable data protection legislation, exercise.

Access to information

You have the right to know if SAF processes any personal data concerning you, which personal data SAF holds and to request access to such information.

Right to rectification, erasure and restriction

You have the right to request the rectification of personal data if the personal data is inaccurate or incomplete and the right to request SAF to erase your personal data if it is no longer needed for the purposes for which it was collected.

You also have the right to request SAF to restrict the processing of your personal data if the personal data is not accurate, the processing is illegal and you object to the deletion of the personal data and instead request for its use to be restricted, if the personal data is no longer needed for the purposes for it was collected but it is needed to establish, bring or defend yourself against legal claims, or if you object to the processing by SAF where SAF has collected personal data based on its legitimate interest and SAF is investigating whether the data subject’s privacy interest overrides the legitimate interest of SAF .

Right to object to processing

You have the right to object, on grounds relating to your particular situation, to the processing of personal data by SAF based on its legitimate interest, including profiling.

You have the right to object at any time to the processing of your personal data for direct marketing purposes.

Data portability

You have the right to request SAF to provide the personal data provided to SAF in a structured, commonly-used and machine-readable format and the right to transfer such personal data to another controller if the processing is based on a contract with the data subject and the processing takes place automatically.

Right to withdraw consent

You have the right to withdraw your consent, if we have the legal obligation to request your consent for data processing.

Right to lodge a complaint

You have the right to file a complaint with a relevant supervisory authority regarding the processing of personal data by SAF.

You may exercise the above stated rights by contacting SAF as per the contact information set out below under Contacting the Data Controller. We aim to reply as soon as possible and, where needed, provide you with additional instructions or ask additional questions based on the request. Please note that prior to fulfilling a request we have a right as well as an obligation to verify the requestor’s identity, due to which we must be able to recognize the requestor in an adequate manner. If the request is manifestly unfounded or excessive, we may charge a reasonable fee for administrative costs to carry out the request or refuse to act on such request.

FURTHER PROCESSING OF PERSONAL DATA

SAF does not process personal data for other purposes besides those described in this Privacy Policy.

Should SAF further process personal data for other purposes, SAF has a duty, in accordance with data protection legislation, to notify the data subject about this intent prior to further processing. In such case SAF will also give all additional information concerning the matter.

INFORMATION SECURITY

SAF takes appropriate technical and organisational measures against unauthorised or unlawful processing of the personal data and against accidental loss or destruction of, or damage to, the personal data in accordance with our internal security procedures covering the storage and destruction of personal data as well as access to personal data.

SAF regularly checks its security policies and procedures to ensure our systems are secure and protected. Information security measures include for example, where appropriate, encryption, firewalls, secure facilities and access right systems. Our security controls are designed to maintain an appropriate level of data confidentiality, integrity, availability, resilience and ability restore the data.

SAF will revise its processing operations and equipment on a regular basis and, inter alia, assess risks related to the processing of personal data for example when introducing a new technology.

COOKIES AND OTHER SIMILAR TRACKING TECHNOLOGIES

We use various technologies to collect and store analytics data and other information when you visit SAF website (svalneratlas.fi), including cookies.

Cookies are small text files sent and saved on your device that allow us to identify visitors of our website and facilitate its use and to create aggregate information of our visitors. This helps us to improve our website. The cookies will not harm the visitor’s device or files. We use cookies to tailor our website and the information we provide in accordance with the visitor’s individual interests.

GOOGLE ANALYTICS

Our website uses Google Analytics (Google Inc.). When visiting our site, the visitor’s browser automatically sends certain information to Google. Google Analytics generates anonymous reports from data obtained through cookies, such as the number of visitors, the website from which the visitor arrives to our website, the keyword used in the Google search engine with the help of which the user has been redirected to the website, the duration of the website visit, whether or not the user has visited the website before, and which pages of the website the visitor visits. Google Inc. is incorporated in the US due to which the personal data may be transferred outside the European Economic Area. However, Google Inc. is a certified corporation listed under the Data Privacy Framework between the EU and the US. For further information on this, please consult the Google website.

HUBSPOT

We use Hubspot as an email marketing platform. Hubspot uses cookies and similar technologies to gather information from the users, such as the devices and the browsers of the users, numbers of visitors on sites, time used on the sites and the preferences of the users. The gathered information may be used for, e.g. the following purposes: functionality of the services, delivery and targeting of advertisements, improving the users’ experience and keeping the services secure. Hubspot, Inc. is incorporated in the US due to which the personal data may be transferred outside the European Economic Area. However, Hubspot, Inc. is a certified corporation listed under the Data Privacy Framework between the EU and the US. For further information on this, please consult the Hubspot website.

With the help of website traffic monitoring, we develop our website in order to make it better than before and to deliver a better user experience. If you wish, you can prevent the cookies from gathering information about you.

Furthermore, we use other third-party services and cookies on our website, too, to enable the content of our website to be shared on social media. These service providers include LinkedIn, Facebook, Twitter and Instagram.

At all times, you are able to disable, manage, and delete cookies, or to set an alert when cookies are being sent, through your browser or mobile device settings. However, certain essential cookies are necessary for the proper function of our website and cannot be disabled.

CONTACTING THE DATA CONTROLLER

If you have any questions concerning the way we process your personal data or want to contact SAF for any other reason relating to your personal data, you may contact SAF by email at finland@svalneratlas.com, or phone +358 10 219 3890.

CHANGES TO THIS PRIVACY POLICY

This Privacy Policy has been last updated on 25 September 2025.

SAF recommends that you revisit this page periodically to stay aware of any changes to this Privacy Policy, which SAF may update from time to time. If the Privacy Policy is modified, it will be made available through the SAF website. Your continued use of the Services after the revised Privacy Policy has become effective indicates that you have read and understood the current version of the Privacy Policy.