Privacy & Cookie Policy Swedish Match applies the prevailing regulatory framework pertaining to the processing of personal data and continuously strives to provide you with optimal integrity protection. This Privacy Notice is directed to visitors of www.swedishmatch.com (the “Site”) and also to others who have a relationship with Swedish Match. For other sites belonging to companies in the Swedish Match Group (e.g. certain brands or e-commerce), separate information on personal data applies in accordance with what is indicated on the respective sites. For what purposes does Swedish Match process your personal data? For visitors to the site When you visit the Site, Swedish Match collects information about your IP address (see also Swedish Match’s Information about cookies). Note that certain other companies besides Swedish Match also collect your IP address when you visit the Site, in connection with the use of third-party cookies. How this occurs, and how you can go about limiting or turning off cookies in your Web browser, are described in Swedish Match’s Information about cookies. We use your IP address to prevent infringements, incidents and other misuse of our services on the Site, to run statistics on visitors to the Site, and to update and improve the Site. The legal basis for this processing is our legitimate interest in preventing misuse and in having a properly functioning Site. For subscribers to information from Swedish Match When a user wishes to subscribe to information from Swedish Match, we request the contact information, such as an e-mail address, needed to provide the subscription service. If you do not submit the information we request, we cannot offer you the subscription service. The legal basis for this processing is our, and your, legitimate interest in administering your subscription. To cancel your subscription to financial information you can contact us at any time, most easily at investorrelations@swedishmatch.com or by writing to Swedish Match AB, Investor Relations, SE-118 85 Stockholm, Sweden. To cancel your subscription to “Vacant positions” you can contact Jobylon, which manages the distribution of information on our behalf, at info@jobylon.com at any time. You can also unsubscribe via the link in the e-mails that are sent out. We will delete your e-mail address the moment you cancel your subscription or in any other way object to receiving information from us. For analysts or potential stakeholders Swedish Match processes your personal data, including your name and contact details, to communicate with you, for example in distributing invitations to presentations of information about Swedish Match’s results, operations and activities. The legal basis for this processing is our legitimate interest in communicating with you. If you do not provide the information necessary to contact you, Swedish Match cannot perform the aforementioned actions. We may also process your personal data if you have chosen to subscribe to financial information from us. For more information about how we process your personal data within the scope of our subscription service, see above. Information processed in order to communicate with you is kept for as long as necessary for this purpose. For shareholders, and shareholder representatives, advisors and proxies Swedish Match processes your personal data, including your name, personal identity number and contact details, in order to conduct general meetings and to fulfil our legal obligations in connection with managing the share register. We may also process your contact details when communicating with you, for example in distributing invitations to presentations of information about Swedish Match’s results, operations and activities. We may also process the personal data provided by you, for example if you contact us for any reason or if you have chosen to subscribe to financial information from us. For more information about how we process your personal data within the scope of our subscription service, see above. The legal basis for this processing is to allow us to fulfil our legal obligation to conduct general meetings, to manage the share register and to handle share ownership in general, as well as our legitimate interest in communicating with you. If you do not provide the information necessary to contact you, Swedish Match cannot perform the aforementioned actions. We obtain your personal data from Euroclear Sweden AB, which is responsible for maintaining our share register, directly from you and/or from shareholders. By law, we store personal data related to your ownership for at least ten years after your ownership ends. Information processed in order to communicate with you is kept for as long as necessary for this purpose. Who is controller of your personal data? Swedish Match AB (publ), SE-118 85 Stockholm, Sweden; corp. reg. no. 556015-0756, tel: +46 (0)200 113 114, is the controller for processing the personal data you submit to us. If you have questions about Swedish Match’s processing of your personal data, please contact us, most easily at customerservice@swedishmatch.com. Who do we share your personal data with? Swedish Match may share your personal data with other companies within the Swedish Match Group, as well as with collaborating partners, for example when providing IT and subscription services. These recipients only process your personal data on our behalf and in accordance with our instructions. Swedish Match takes all appropriate legal, technological and organizational measures to ensure that your personal data is processed securely, and with an adequate level of security when transferring to, or sharing with, selected recipients of this kind. Swedish Match may also share your personal data with other companies who process your personal data independently, outside of our control, such as Euroclear Sweden AB. We only share your information with these companies in order to fulfill our commitments towards you. When your personal data is shared with these companies, which are independent controllers, your personal data is processed in accordance with what is outlined in these companies’ privacy notices. Swedish Match may also share your personal data with government agencies if we are obligated under the law to do so, or on suspicion of criminal activity. Where do we process your personal data? Your personal data will primarily be processed within the EU/EEA but may also be transferred to a country outside the EU/EEA, such as the United States, for example, if we share your information with other companies in the Swedish Match Group. Swedish Match will only transfer your personal data to a country outside the EU/EEA if there are legal grounds to do so and sufficient guarantees that your personal data will be handled in a lawful manner. In such cases, Swedish Match takes all appropriate legal, technological and organizational measures to ensure that your personal data is processed securely, and with an adequate level of security comparable to the level of protection offered within the EU/EEA. How long do we save your personal data? We save your personal data only as long as is necessary for the purpose for which you submitted your data. See more information under each purpose above. We may also save your personal data for a longer time if it is necessary to fulfill a legal obligation that requires processing in accordance with applicable laws, or so that we can establish, enforce, or defend legal claims. What are your rights? You have certain specific legal rights that you can enforce against us. A summary of these rights follows below. Right to access/extracts from the register. You have the right to know what personal data about you we are processing. Upon request from you, we will provide you with information in writing about our processing of your personal data, free of charge. Right to data portability. You have the right to request a copy of the personal data you have provided to us in a structured, commonly used and machine-readable format. Provided that it is technologically possible – which is determined by Swedish Match – you also have the right to request that we transfer this personal data to another controller. The right to data portability applies to personal data that is processed via automated means, and is based on an agreement with you. Correction of erroneous information. You have the right to request that we correct erroneous or incomplete information about yourself. Deletion of certain data. You have the right to request that we delete your personal data under certain conditions, for example if your personal data is no longer necessary for the purpose for which we collected the data, if you object to a weighing of legitimate interests we have carried out and support for our legitimate interest is lacking, if your personal data was processed in an unlawful manner or if your personal data has to be deleted in order to fullfill a legal obligation. In certain cases, we must save your personal data despite your request owing to legal requirements such as accounting and tax legislation, or for example if we need to retain certain data in order to establish, enforce or defend a legal claim. Right to restrict processing of your personal data. You have the right to demand a restriction on our processing of your personal data in certain cases. If, for example, you have contested the fact that your personal data is correct, you can request a restriction on processing for a period of time that will give us the opportunity to check if your personal data is correct. Right to object to our processing of personal data. You have the right, under certain conditions, to object to our processing of your personal data. You have the right to object to processing that is based on the legal grounds of our legitimate interest. However, we may continue processing your data despite your objection to the processing if we have compelling legitimate reasons for the processing that outweigh your privacy interests. Cookies We use cookies when you visit the Site. Read more about how we use cookies in our Information on cookies. Questions and complaints If you have any questions regarding our processing of your personal data, or if you would like to present a request about an excerpt from the registry, data portability, correction or deletion – or present an objection or a restriction – please contact us at customerservice@swedishmatch.com. If you have a complaint regarding Swedish Match’s processing of your personal data, you have the right to submit such complaints to the Swedish Data Inspection Board. How do we protect your personal data? Swedish Match takes the security measures needed to protect your personal data, for example, Secure Socket Layer (SSL) is a protocol for the secure transfer of data. Links to other websites The Site may contain links to other websites. This Privacy Notice applies only to the Site. Swedish Match is not responsible for the processing of personal data by other sites and you are therefore encouraged to check the privacy policy for the site in question. Changes to this Privacy Notice Swedish Match reserves the right to make changes to this Privacy Notice. Any such changes are to be published on the Site. Latest update to this Privacy Notice: June 28, 2018 (Version 1.1) English