PRIVACY POLICY / DESCRIPTION OF DATA FILE

1. NAME OF THE REGISTER Resaco Oy’s customer database

2. CONTROLLER Resaco Oy

Business ID: 3259870-5

Tel. +358 45 6717 116

3. PERSON IN CHARGE OF REGISTER MATTERS CEO Olli Junes

Tel. +358 45 6717 116

Email: olli.junes@resaco.fi

4. PURPOSE OF PROCESSING PERSONAL DATA / PURPOSE OF THE REGISTER The purpose of processing is the management and administration of customer relationships, the fulfillment of the rights and obligations of both the customer and the controller, and the processing of personal data in accordance with the Personal Data Act for purposes related to online services. Furthermore, personal data is processed for marketing purposes by the controller and companies belonging to the same group at any given time, including direct marketing. Direct marketing may also be carried out electronically.

5. DATA CONTENT OF THE REGISTER * Basic information: Name, address, email address

• Product information recorded in requests for quotations and/or offers
• Invoicing and collection information, financial data
• Transaction data (Resaco Oy Privacy Policy)
• Information related to the customer relationship and contractual relationship
• Information provided by the data subject themselves

6. REGULAR SOURCES OF INFORMATION Information provided by the customer and any additional information recorded by Resaco Oy during customer service situations.

7. NECESSITY OF DATA Data is required to enable the services provided to customers, to maintain and manage customer relationships, for direct marketing across various channels, and for the organization’s own operational planning, statistics, and monitoring.

8. DISCLOSURE OF DATA Resaco Oy discloses customer data within the limits permitted by valid legislation. Data is not transferred outside the European Economic Area (EEA) or the European Union (EU).

9. PROTECTION OF THE REGISTER The register is used only by Resaco Oy employees. Data is collected into electronic databases that require a username and password. The network and hardware of Resaco Oy’s IT system and the service provider where the register is located are protected by firewalls and other technical measures. Data is protected by access rights defined based on the employee’s duties. Internal instructions have been established for the use of registers. Manual material printed from the database is stored in the company’s monitored premises as required by law and disposed of securely when necessary.

10. RIGHT OF ACCESS (ACCORDING TO SECTION 26 OF THE PERSONAL DATA ACT) The data subject has the right to inspect the data recorded about them in the register, the right to demand the rectification of erroneous data, and to otherwise exercise their rights guaranteed by the Personal Data Act. A written request for inspection and rectification must be addressed to the person in charge of register matters (see section 3).

11. OTHER RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA The data subject has the right to prohibit the processing of data concerning themselves for the purposes of direct advertising, distance selling, other forms of direct marketing, as well as market and opinion research. The prohibition will be recorded in the register.

12. PROCESSING OF CUSTOMER DATA, AI TOOLS, SECURITY, AND GDPR We use ChatGPT and other AI tools in our daily work, such as content creation. At Resaco, customer data is not processed anywhere other than in a separate, GDPR-compliant, closed environment. This ensures that the protection of customer data complies with EU data protection laws and that information security remains at a high level throughout all stages of our operations.