STROMMA’S PRIVACY POLICY
1.
1.1

GENERAL
STROMMA Suomi Oy Ab (“Stromma”) respects and cares about your personal
integrity. We want you to feel safe when we process your personal data. By way of thisprivacy policy (“Privacy Policy”), we want to inform you about how we ensure thatyour personal data is processed in the right way.

1.2

We must process personal data about you to be able to provide our products andservices to you as a user. This Privacy Policy applies to you who order experiences from
us.

2.
2.1

DATA CONTROLLER AND DATA PROTECTION OFFICER
Stromma is the data controller for the processing of your personal data and is
responsible for ensuring that the processing is made in compliance with applicable law.
You find our contact details on the last page of this Privacy Policy.

2.2

We have appointed a data protection officer (the "Data Protection Officer"). The Data
Protection Officer has the task of overseeing that our use of personal data is inaccordance with applicable law. The Data Protection Officer's contact details are
privacy@stromma.com.

3.

OUR PROCESSING OF YOUR PERSONAL DATA
At Stromma, we process your personal data to provide you with the products andservices we offer in the best way possible. That’s why we use your personal data for thefollowing purposes:- Administer and carry out contracts, and to safeguard both parties’ legal interests,- Marketing, including customised offers,- Method and business development.
In the tables below, you are provided with more information about e.g. why we process
your personal data, which personal data we keep to achieve the purposes of theprocessing and for how long we store your personal data.

Purpose: Manage and carry out our contractual obligations with you and to safeguard the legal interestsof both parties in case of any dispute.
Personal data:
Contact information;
Orders and payment information;
Sensitive personal data such as health and allergy information may in some cases need to be collected.
What we do: We process your personal data to beable to provide, manage and adapt our product andservices and provide customer services to you as auser. Should a dispute arise regarding e.g. payment, weare entitled to process your personal data to establish,
exercise or defend the legal claim.

Legalbasis:
Performanceofacontract. Should adispute arise, we areentitled to process
your personal data withlegitimate interest as
legal basis. Informationthat by law must be
submitted
toauthorities, we have theright to collect throughlegal obligation.

Retention period:Your personal data is
kept during the entire
contract period and up
to24
monthsthereafter. We may
keep your personal
data for a longer time
period if necessary toestablish, exercise or
defend a legal claim incase of a dispute
regarding e.g. payment.

Your rights: You have the right to object to processing of your personal data based upon a legitimate
interest as legal basis. See section 9 if you want to read more about your rights.

Purpose: Marketing, including customised direct offers.
Personal data:
Contact information;
Browsing behaviour and web browsing history;
Orders and payment information;
Demographic data.
What we do: We use yourpersonal data within the scope ofourmarketingandmarketsegmentation.
Withmarketsegmentation, we mean that we
categorise our customers based on
demographic selection criteria suchas age, gender, marital status orplace of residence to send directadvertisement and information that

Legal basis: Legitimate interest (for mail,phone and social media marketing - and foremail, SMS, MMS and other automatedmarketing systems if the requirements of theMarketing Act are met).
Consent (for marketing third party products
and services via email, SMS and MMS and otherautomated systems).

Retention
period: If you area customer of ours:
The data is stored
and used during theentirecontract
period and up to 12
months thereafter,
provided that you
have not objectedis not customised about offers,
services, news and competitions toyou.
If you wish to receive customised
offers and information about news
andcompetitions
specificallyformed for you, such as offers on
specially-priced service packages,
we need your consent. Then we will
analyse, for example, during whichmonths of the year you use ourvarious services and the frequency
you choose to use the services. We
will also analyse your browsing
behaviour on our website as well as
your purchase and transaction
history in respect of our products
and services, but also your name,age, gender, civil status and address
to provide you with relevant
information.

to direct marketing
during that time.

Consent

If you are not yet acustomer of ours:
We have the rightto retain yourinformation for the
purpose of sending
you marketing for
12 months fromreceivingyourcontact
information. Thisrequires, of course,that you have notobjected to direct
marketing. If you
choose to become
our customer, we
refer you to theheading "If you area customer ofours".

Your rights: You always have the right to demand us to stop using your personal data for direct marketing.
You also have the right to withdraw your consent at any time. If you revoke your consent, you will nolonger be able to find information and offers that are customised for you. See section 9 for more information
about your rights.

Purpose: Method and business development
Personal data:
Contact information;
Purchasing patterns;
Orders and payment information;
Demographic data;
Browsing behaviour and web browsing history.
What we do: We use your personal data within
the scope of our market and customer analyses,
consisting mainly of statistics, data from completed
market segments and customer satisfaction

Legalbasis:
interest.

Legitimate

Retention
period: We save
and
use
your
personal data forassessments. The result of our analysis is then usedas the basis for improving, replacing or developing
new services, processes or working methods tomeet your and other customers' expectations andwishes. We may for example want to use personal
data to improve our customer service, offer new
package solutions, or customise our website and /or app to your and other customers' wishes.
However, we want to be clear that we always try toanonymise or pseudonymise your personal
information as far as possible to achieve thispurpose.

this purpose during
the entire contract
period and up to 12
months thereafter.

Your rights: You have the right to object to processing of your personal data based upon a legitimate
interest as legal basis. If you object to such processing, we will discontinue the processing or anonymise thedata. Please see section 9 if you want to read more about your rights.

4.
4.1

WHERE WE COLLECT YOUR PERSONAL DATA FROM
The personal data we process about you is the information you have provided us with.
You provide us with information such as contact information and, in some cases,
demographic information or health information when booking and when using ourservices. We do not obtain any information from other sources.

4.2

To be able to enter into contract and to enable us to offer you our experiences, youmust in some cases provide us with certain personal data. We may need such data tofulfil practical and legal requirements. If you do not provide us with information that weneed to offer you our experiences, we unfortunately cannot enter into contract withyou or provide you with our products or services.

5.

AUTOMATED DECISION-MAKING
We do not use any automated decision-making which has significant effects on you.

6.
6.1

FOR HOW LONG DO WE KEEP YOUR PERSONAL DATA?
We only keep your personal data for as long time as necessary to achieve the purposes
for which they were collected in accordance with this Privacy Policy. When we nolonger need to save your personal data, we remove the data from our systems,
databases and backups. In the tables above under section 3, you may read more
information about for how long time we keep your personal data for different purposes.

6.2

We may be required to keep your personal data for other reasons, such as to comply
with legal obligations or to safeguard the parties’ legal interest, or for any otherimportant public interest.

7.
7.1

WHO WILL PROCESS YOUR PERSONAL DATA?
Your personal data will only be processed within the Stromma Group, by Stromma’s
franchisees, its IT-suppliers and parties with which Stromma cooperate to provide ourservices. We may also in certain cases be required to share your personal data withpublic authorities or other third parties in connection with court proceedings or otherlegal proceedings.

7.2

We will not sell your personal data to any third party.

8.
8.1

WHERE DO WE PROCESS YOUR PERSONAL DATA?
We endeavor only to process your personal data within the EU/EEA. In some cases, we
may transfer your personal data to a country outside of the EU/EEA. If personal data istransferred to any such country, we will ensure that your personal data is protected andthat the transfer is carried out in accordance with applicable law.

8.2

When carrying out any transfer to a country that lacks an adequacy decision by theEuropean Commission, we will use the standard contractual clauses issued by theEuropean Commission as legal basis for the transfer. You find these here.

9.
9.1

YOUR RIGHTS
Our responsibility for your rights

9.1.1

Stromma acts as the data controller responsible for ensuring that your personal data isprocessed in accordance with applicable law and that your rights have an impact on theprocessing. You may at any time contact us to exercise your rights. You find our contact
details at the last page of this Privacy Policy.

9.1.2

Stromma is responsible for answering your request to exercise your rights within one
month from our receipt of your request. If your request is complicated or if we havereceived a large extent of requests, we are entitled to prolong our response period withanother two months. If we assess that we cannot perform the actions you haverequested, we will within one month explain why and inform you about your right tolodge a complaint with the data protection authority.

9.1.3

All information and communication, and all actions we carry out, is at no cost for you.
If the action you request is manifestly unfounded or excessive, we are entitled to charge
you an administrative fee to provide you with the requested information or carry out
the requested action or refuse to meet your request.

9.2

Your right to access, rectification and erasure of personal data andrestriction of processing

9.2.1

You have the right to request:a)

Access to your personal data. This means that you have the right to request an abstractfrom our data record regarding our use of your personal data. You also have the rightto request a copy of the personal information being processed at no cost. However, we
may charge you a reasonable administrative fee to provide you with additional copies ofthe personal data. If you make your access request by electronic means such as email,we will provide you with the information in a commonly used electronic format.

b)Rectification of your personal data. We will at your request, or at our own initiative,
rectify, anonymize, erase or complement personal data that we discover is inaccurate,incomplete or misleading. You also have the right to complement the personal data withadditional data if relevant information is missingc)Erasure of your personal data. You have the right to request that we erase your personal
data if we do no longer have an acceptable reason for processing the data. Given this,erasure shall be made by us if:(i)the personal data is no longer necessary for the purposes for which it was collected,(ii)

we use your personal data with your consent as legal basis, and you revoke the consent,(iii)

you object to such processing that is based on a legitimate interest, unless we have legal
and legitimate reasons for to continue the processing.

(iv)

the personal data has not been lawfully processed,(v)

we are required to erase the personal data due to a legal obligation, or(vi)

you are a child and we have collected the personal data in relation to the offer of
information society services.
However, there might be requirements under applicable law, or other weighty reasons,that entail in that we cannot immediately erase your personal data. In such case, we willstop using your personal data for any other reasons than to comply with the applicablelaw, or the relevant weighty reason.

d)Right to restrict processing. This means that we temporarily restrict the processing ofyour personal data. You have the right to request restriction of the processing when:(i)you believe your information is incorrect and you have requested rectification inaccordance with section 9.2.1 b) above during the time period we are verifying theaccuracy of the data,(ii)

the processing is unlawful and you do not want the personal data to be erased,(iii)

we, in capacity of data controller, do no longer need the personal data for the purposes
for which it was processed, but you need them for the establishment, exercise or
defence of legal claims, or(iv)

you have objected to the processing in accordance with section 9.3 below during thetime period we determine whether our interests override yours.

9.2.2

At Stromma, we will take all reasonable actions to notify any recipients of your personal
data as set out in section 7 above regarding any rectification, erasure or restrictions ofyour personal data after you request us to do so. At your request, we will also informyou of which third parties we have shared your personal data with.

9.3

Your right to object to the processing

9.3.1

You have the right to object to such processing of your personal data based upon ourlegitimate interest or public interest (please see section 3 above). If you object to suchprocessing, we will only continue with the processing if we have a legal and legitimate
reasons to continue the processing.

9.3.2

If you do not want Stromma to use your personal data for direct marketing, you arealways entitled to object to such use by contacting us. Once we have received yourobjection, we will discontinue using your personal data for this marketing purpose.

9.4

Your right to revoke your consent
For the processing where we use your consent as a legal basis (see section 3 above),
you may withdraw your consent at any time by contacting us. You can find our contact
information at the bottom of this Privacy Policy. If you revoke your consent, you may
not be able to use our services as intended.

9.5

Your right to portability
You have the right to portability. This means that you have the right to receive certainof your personal data in a structured, commonly used and machine-readable format andhave the right to transmit those data to another controller. You only have this rightwhen your personal data is processed by automated means and our legal basis for theprocessing is your consent or the performance of a contract between you and Stromma.
This means e.g. that you have the right to receive and transfer all personal data that you
have provided us with when booking.

9.6

Your right to lodge a complaint with the data protection authority
You have the right to lodge any complaints regarding our processing of your personal
data with the data protection authority.

10.

WE PROTECT YOUR PERSONAL DATA
You shall always feel safe when providing us with your personal data. Therefore,
Stromma has implemented appropriate security measures to protect your personal data
against unauthorized access, alteration and erasure. In the case of a security breach that
may significantly affect you or your personal data, e.g. when there is a risk of fraud or
identity theft, we will contact you and inform you of what you can do to reduce this
risk.

11.

COOKIESAt Stromma, we use cookies at our webpage and in our services to improve your user
experience. We use cookies to e.g. simplify and adjust our web and application services.
In our cookies policy, we provide you with more detailed information on how we use
cookies and which choices you may make regarding our cookies. You will find the policy
here.

12.

AMENDMENTS TO THIS PRIVACY POLICY
Stromma has the right to amend this Privacy Policy at any time. When we make any
amendments that are not only linguistic or editorial, you will be provided with clear
information of the amendments and which impact they will have on you before theamendments are effective. If we need your consent to fulfil our obligations to you andyou do not agree to the changed terms, you may terminate the contract with us before
the terms come into force.

13.

CONTACT INFORMATION
Do not hesitate to contact us at Stromma if you have any questions regarding thisPrivacy Policy, our processing of your personal data, or if you want to exercise yourrights.
STROMMA Suomi Oy Ab, Company registration no. 19 28 483-2
Email: privacy@stromma.com
Webpage: www.stromma.fi