1. General

The purpose of this statement is to provide information required by the EU General Data Protection Regulation 2016/679 (hereinafter “GDPR”) to the data subject, in particular how we collect, store and process personal data of our customers and suppliers.

2. Data controller and contact details

Evac Group Oy (hereinafter referred to as ‘’Evac’’, including its affiliates, ‘’we’’ or ‘’us’’) and each of its affiliates with respect to their own current or potential customers or suppliers act as the data controller in accordance with this Data Privacy Statement. The contact person of the controller and contact details in relation to customer and supplier data matters: Sampo Kättö (General Counsel): sampo.katto@evac.com

3. Personal data processed by Evac

This statement covers personal data processing relating to our customers or potential customers (hereinafter collectively referred to as ‘’customers’’), our current or potential suppliers, contractors and partners who have a contractual or other relationship with us (hereinafter collectively referred to as ‘’suppliers’’). Data subjects with regard to this processing are Evac’s customer’s or supplier’s contact persons.

4. Purpose of processing and applicable legal basis for processing

The following table provides a summary of the purposes of use and the applicable legal basis as well as the categories of personal data being processed.

Purpose of Use	Legal Basis	Categories of Personal Data
To manage and develop the customer or supplier relationship and to manage marketing-related activities	Legitimate interests of the data controller	Contact information (such as phone number, address and email address) and job title/position of Evac’s customer’s or supplier’s contact persons
To manage sales and delivery of services and products	The legitimate interest of the data controller	Contact information
To fulfil statutory obligations	Legal obligation of the data controller	Contact information, information concerning customer communications (such as information related to sales, projects, meetings and customer feedback)

5. Retention period of Personal data

Personal data is stored and processed in accordance with applicable laws and regulations. Mainly, personal data will be processed for the duration of the customer or supplier relationship or for as long as the contact person acts in a relevant position in Evac’s customer’s or supplier’s company. Personal data may, however, be processed for longer periods if it is necessary in individual cases due to e.g. claims, warranty or applicable laws.

6. Recipients or categories of recipients of Personal data

Subject to applicable laws, personal data may be transferred or disclosed within Evac Group to other group companies, some of which may be located outside the European Economic Area (“EEA”). Evac group companies have concluded a data transfer agreement incorporating the EU Commission Standard Contractual Clauses (see further information at EU Commission’s website). Additionally, Evac may transfer or disclose personal data to authorities, where required to do so by applicable laws. If we sell, buy, merge or otherwise organise our business, we or a party acting on our behalf may disclose your personal data to buyers and their advisors in accordance with currently applicable legislation.

7. Transfers of Personal data

We may transfer a data subject’s personal data to third parties for the purposes described in this privacy statement. When transferring personal data to a processor, we ensure, for example through contractual arrangements, that the processor processes such data only in accordance with the written instructions issued by us and exclusively for the purposes indicated in this privacy statement. Data will not be transferred or disclosed outside the European Union or the EEA without a transfer basis in accordance with the legislation currently applicable. When transferring personal data outside the EU or EEA, we ensure through agreements (e.g. by incorporating the EU Commission Standard Contractual Clauses) or otherwise that the transfers are carried out as required by applicable law. Further information on data transfers may be requested by using the contact details above.

8. Sources of collecting Personal data

Personal data is collected from Evac’s customers and suppliers and from the data subjects themselves. Personal data may also be collected from public sources, such as Evac’s customer’s or supplier’s (or potential customer’s or supplier’s) websites and similar public sources.

9. Rights of the data subject

Right to inspect one’s own data: A person has the right to inspect data related to themselves. Right to request correction of data: A person has the right to demand Evac to correct any inaccurate and erroneous data related to themselves. The correction must be made without unnecessary delay. A person also has the right to supplement incomplete personal data in the form of a supplementary report, for example. Right to request deletion of data or restriction of processing or to object to the processing of data in certain situations. In addition, a data subject has the right to file a complaint about the processing of personal data to a supervisory authority. All the requests mentioned here shall be provided to the above-mentioned contact person of the controller. We will respond to your request within one month of receipt of the request, unless a longer period is required and lawful.

10. Security of processing

Only persons within the Evac Group, whose employment tasks include responsibilities relating to the personal data, have access to the data and user rights for adding and modifying the information. Appropriate access control is arranged in the business premises. IT systems and work equipment, such as the computers are protected with, inter alia, password, firewall, regular security updates and encrypted connections. The storage of documentation containing personal data is securely arranged.

This Data privacy statement was last updated on April 29^th 2024.