Whistleblowing Policy
Approved by the Board of Directors of F-Secure Corporation on 31 May 2022
GeneralAt F-Secure we are committed to a high level of ethics and integrity in conducting our businessoperations. We understand that this is crucial to our continued success and reputation. Ourvalues, principles and policies guide our everyday business operations. We have a professional
responsibility to speak up, report any possible corrupt, illegal or other undesirable conduct andtake required actions after such conduct is discovered. This F-Secure’s Whistleblowing Policy(Policy) is an important tool in discovering such conduct. F-Secure strongly encourages you to
speak up if you suspect or witness any such behavior, activities or conduct. F-Secure will takeall reports made under this Policy seriously.
If you make a whistleblowing report in accordance with this Policy, we have a responsibility toprotect you, including not disclosing your identity and ensuring you are not subject to any
retaliation.
This Policy sets out how F-Secure provides you with an effective, objective, confidential andsecure reporting channel, Whistleblowing-channel (Whistleblowing Channel), allowing you toexpress your concerns or suspicions openly and safely. On the Whistleblowing Channel you arealso advised how to make a report, how you are informed on the follow-up actions and how you
are protected. F-Secure reviews the Policy and the Whistleblowing Channel from time to time inorder to ensure their accuracy and proper and reliable functioning.
The Whistleblowing Channel is not for reporting your personal work-related grievances such as
grievances that relate to your employment contract or to occupational safety and health. Other
F-Secure policies and ways to report apply to such. Accordingly, the Whistleblowing Channel is
not to be used for giving general feedback to F-Secure.
Concerns and Suspicions to be Reported
The breaches to be reported through the Whistleblowing Channel include actual or potential
crimes, serious omissions or misconduct, as well as other breaches of the applicable laws andregulations. All such infringements are later referred to as Breach(es).
When you have information or reasonable suspicion about an actual or potential Breach andsuch Breach has occurred or is very likely to occur in F-Secure or about an attempt to conceal
such Breach, kindly report this through the Whistleblowing Channel. Through theWhistleblowing Channel you can also request a separate meeting where you can provide
information on such Breach.
If you are uncertain, you can also send first a question through the Whistleblowing Channel to
ask whether the type of information you intend to disclose falls within the scope of the regulationand can be disclosed through the Whistleblowing Channel. In such case kindly remember toprovide at least your email address in connection with the filing so that the person handling yourrequest is able to answer to you through the Whistleblowing Channel.

The Whistleblowing Channel is available to you 24/7 at https://lantero.report/new/hhpartners.
The questions presented in the Whistleblowing Channel in connection with filing of your reportwill guide you to give information that is necessary for investigating and handling your report.
Kindly answer to all questions as accurately as possible.
Eligible Whistleblower
Persons who are eligible to act as a whistleblower and file a report concerning F-Secure include
all persons who by virtue of their work-related activities, irrespective of the nature of suchactivities and of whether they are paid or not, have access to information on Breaches, including
but without limitation, F-Secure’s all current and former partners, directors, officers, freelancers,
employees, secondees, contractors, suppliers (or their employees or subcontractors), agency
workers, job applicants, volunteers and trainees as well as shareholders (who have an activerole within F-Secure) and persons belonging to the administrative, management or supervisory
body of an undertaking, including non-executive members.
Your right to report on the Breaches is unlimited and cannot be, for instance, restricted orwaived by any agreement, policy or form or conditions of your employment.
Anonymity
You can file a report on suspected Breach and its potential perpetrator anonymously throughour Whistleblowing Channel. All reports coming through the Whistleblowing Channel are
confidential, meaning that F-Secure has the obligation to protect and keep your identity and theidentity of any third party possibly mentioned in your report confidential. The reporting service isentirely independent of the organization to ensure that it is impossible to find out who is behinda report, for example by tracking IP addresses.
Levels of Anonymity
When submitting a report to the Whistleblowing Channel, you must first choose whether you
want to do so anonymously or whether you want to disclose your identity fully to the ones
authorized to receive and handle your report.
Submitting a report anonymously
When you submit a report in the Whistleblowing Channel, you will always receive a unique
report-specific link to see the status of your report or any follow-up questions the ones
authorized to receive and handle your report may have had. You cannot be identified throughthis link. It is only for the purposes to contact you anonymously when needed. If you havechosen to submit a report to the Whistleblowing Channel anonymously, you must choose
between the following two levels of anonymity:
1. Providing an e-mail address to receive notifications of new questions or information
When submitting your report, you can choose to provide your email address to theWhistleblowing Channel through which you will receive an email notification if a question
or a notification has been left for you in relation to your report. Your email address is onlyused by the technical platform of the Whistleblowing Channel and will serve as atechnical tool to notify you of new events. F-Secure and the ones authorized to receiveand handle your report do not see or receive information on your email address. All
information related to a report is erased from the Whistleblowing Channel when thereport has been processed, so that no sensitive information is stored unnecessarily. This
normally takes a maximum of three months.
2. Full anonymity
You may also leave a report in the Whistleblowing Channel without disclosing yourname, identity or providing your email address at all. In this case, the ones authorized toreceive and handle your report will still be able to contact you through the link you
received after submitting the report, but you yourself are responsible for remembering
the link and reviewing it from time to time to see if there are any updates or follow-up
questions to your report. You will not be notified of these through your email. If you
choose not to disclose your name/identity and provide email address to the person(s)authorized to receive and handle the report, this may prevent the handling of your reportand performing follow-up actions as effectively as F-Secure would like to.
Correspondingly, this may prevent ensuring that there exists no conflict of interest
between you and the representatives chosen to review the report.
Submitting a report by fully disclosing your identity
When you provide your name/identity in addition to your email address in the Whistleblowing
Channel, only the ones authorized to receive and handle your report will receive thisinformation. The ones authorized to receive and handle your report are obliged to keep yourname and identity confidential unless you give an explicit consent to reveal your name andidentity. In this case information on your name and identity and your email address are alsodeleted from the technical platform of the Whistleblowing Channel permanently after thehandling of your report in the Whistleblowing Channel is concluded.
Offered Protection
In case you have reasonable grounds to believe, in light of the circumstances and theinformation available to you at the time of reporting, that the matters reported by you are trueand fall within the scope of Breaches, you will be given protection against retaliation i.e. any
negative consequences or threats and attempts of retaliation due to your report.
In order to receive protection, you shall primarily use our Whistleblowing Channel to file yourreport. Further, if you are employed by F-Secure, please note that, in order to comply with yourstatutory duty of loyalty towards your employer under the law, you should primarily use ourWhistleblowing Channel to file the reports.
However, you do not need to use our Whistleblowing Channel in order to receive protection if
you have reasonable grounds to believe that:•••

our Whistleblowing Channel and handling of reports are not credible wherefore there
may be retaliation against you e.g. due to breach of confidentiality;
the Breach or related evidence could be destroyed when using our Whistleblowing
Channel; or
the Breach requires urgent actions to safeguard e.g. the life, health or safety of persons
or to protect the environment.

In such situations you are entitled to file your report also through the public channel (in Finland
to the Chancellor of Justice, once such channel becomes available) and still receive protection.
When using the public channel, you cannot file your report anonymously. Note that thisreference to public means this specific public channel, not revealing the information to thegeneral public.
In practice the protection provided to you includes:••••

identity protection;
protection from retaliation;
possible compensation and remedies e.g. due to retaliation; andcivil, criminal and administrative liability protection.

Please note that you do not need to prove your suspicions or allegations correct. If you have
had reasonable grounds to believe that the matters reported by you are true and fall in within
the scope of Breaches, you are entitled to protection even if your disclosure later turns out to beincorrect. Please note that a mere allegation or hearsay with no supporting information isunlikely to meet the required standard of reasonable grounds.
Filing a knowingly false report may constitute a breach of the whistleblowing legislation and ourCode of Conduct and may result in disciplinary action. There may also be other legal
consequences if you make a knowingly false report.
In addition to protection provided to the whistleblower, F-Secure provides protection also toperson(s) who are suspected of having committed the Breach. Such protection includes, forinstance, that such person is treated in an equal and non-discriminating manner and theconsequences of the Breach are based on F-Secure’s policies and the applicable laws. Suchperson is also granted a possibility to review and comment the alleged Breach and the relevantmaterial.
Receiving and Initial Handling of a Report
Our Whistleblowing Channel is designed, established and operated in a secure manner thatensures confidentiality of your identity and any third party possibly mentioned in your report.
Access to your report is prevented from persons who are not authorized to receive and handle
the reports.
In order to create a credible channel for filing whistleblowing reports, to ensure objectivity ofhandling of reports and to avoid the possibility that the report would be handled by a person
somehow connected to the reported Breach, F-Secure has chosen to use the following thirdparty service providers to provide and maintain the Whistleblowing Channel:(a) Lantero AB, a professional provider of whistleblower systems; and(b) HH Partners Attorneys-at-law Ltd. acting as initial handler of the whistleblowing reports(jointly Service Provider).

Due to this chosen third party service provider arrangement the persons who are authorized toreceive and perform the initial handling of your report are impartial, independent andprofessional.
All whistleblowers will receive confirmation of receipt of their reports as soon as their reports
have been received and at the latest within seven (7) days of delivery of their reports. Please
note that only those who have provided their email address when submitting the report will
receive a notification of this by email. Others are responsible for checking the status of theirreport via the link provided when submitting the report.
The persons authorized to receive and handle the reports may also request further informationfrom whistleblowers through the Whistleblowing Channel. You as whistleblower are not obliged
to provide further information, however, this would be highly appreciated. Please note that only
those who have provided their email address when submitting the report will receive anotification of this by email. Others are responsible for checking the status of their report via thelink provided when submitting the report.
Whistleblowers will receive feedback concerning their reports within three (3) months from theconfirmation of receipt. Feedback means information on the follow-up actions envisaged or
taken by F-Secure and the grounds for the choice of those follow-up actions. Please note that FSecure may be unable to disclose details in its feedback, especially due to possibly applicablemandatory legal requirements. Again, please note that only those who have provided their email
address when submitting the report will receive a notification of this by email. Others areresponsible for checking the status of their report via the link provided when submitting thereport.
Internal Handling of Report
After your report has been initially received and handled by the Service Provider, the Service
Provider may further report the case to at least one of the chosen representatives of F-Secure.
The report will be treated as confidential in accordance with this Policy. The chosenrepresentatives are:•••

Chief People Officer;
Chief Financial Officer;
General Counsel (once appointed);••

Chief Executive Officer; andChairman of Board of Directors and/or other member of Board of Directors, if necessary.

The Service Provider will make the decision whether the report is further investigated and towhom such report is then delivered with the objective that there cannot exist any conflict ofinterest between the chosen representative of F-Secure, you and the person(s) mentioned inyour report or related the possible Breaches mentioned in your report.
The chosen representative(s) of F-Secure will decide on the required further investigations andactions to be taken by F-Secure. All such investigations and possible follow-up actions will be
performed diligently and by preserving confidentiality. In case criminal activity is revealed, FSecure will report it to the police.

The Audit Committee will also receive regular reports on the whistleblowing process, including
statistics and information on a general level on the reported topics, and depending on the case,may be involved in reviewing individual cases when it is deemed necessary.
Data Protection
Data protection legislation is applied in relation to our Whistleblowing Channel.
The collected data depends on the information you have chosen to provide in connection withfiling of your report. The collected data can be divided to content data, system data, your nameand email address. The content data includes the content of your report and timing of yourreport, excluding your name and email address. The system data includes technical logs on theusage of the Whistleblowing Channel, excluding your name and email address.
Data is handled for the purposes of managing the Whistleblowing Channel, processing reports
and proving fulfilment of legal requirements. In case a report leads to further inquiry, the related
content data is passed on to the inquiry. The legal basis for processing the data is law and ourlegitimate interests.
The content data is recorded. Content data shall be stored for no longer than it is necessary andproportionate in order for F-Secure to comply with its applicable legal requirements. The
retention period is based on whether the applicable legal grounds persist. The applicable legalgrounds are: proving compliance until the relevant limitation of time has passed, submitting
complaints/information to relevant authorities and managing possibly arising legal processes. Incase there is an on-going inquiry or legal case when the retention period would be exceeded,
the retention period will be prolonged to the end of the inquiry and any legal case.
The system data will not be part of the stored content data, and system data will be deleted
when the processing of your report in the Whistleblowing Channel system ends. Typically, thishappens when you are informed of the follow-up actions taken by F-Secure, which normallyhappens within three (3) months of your initial report.
Your name and email address, if you have disclosed your identity, will be deleted together withthe system data, which normally happens within three (3) months of your initial report. In othercases, your name and email address are deleted once there is no longer any need to process
the name or email address. That may be in connection with deleting the system data, or later,
depending on case-by-case appraisal on a need to process basis. At the latest, your name andemail address will be deleted when content data is deleted.
See our internal data protection policy at [url link to intranet to be added]. F-Secure has
conducted a data protection impact assessment as required by the applicable whistleblowing
legislation.
Raising concerns about Actions taken by F-Secure
If you are concerned that:••you may be, are being, or have been subjected to retaliation;
there has been a disclosure of your identity contrary to this Policy; or•

your report has not been handled in compliance with this Policy;

we kindly ask you to proceed as follows:
Kindly send a new report to Whistleblowing Channel with a clear reference “Concerns about
Actions taken”. The Service Provider will after receiving such report make the decision to whom
the report is delivered with the objective that there cannot exist any conflict of interest between
the chosen representative of F-Secure and you. The chosen representatives are defined abovein this Policy. Also, as explained in section “Offered Protection”, you have in certain situations
also right to report the matter using other external channels besides F-Secure’s Whistleblowing
Channel.
Please note that by choosing to keep your identity confidential in the situation where you areconcerned that you may be, are being, or have been subject to retaliation, F-Secure may not beable to investigate and respond to the suspected retaliation against you as effectively as FSecure would like to.