1. Privacy Policy TWIG customer and business partner register 25 May 2018 Twig Com Ltd follows policies and processes to protect Per sonal Data in compliance with Data Protection Laws, most notably Regulation 2016/679 of the EU (“GDPR”). 1. Controller Twig Com Ltd (”Twig Com”), Lairolantie 14, FI-24910 Halikko, Finland. ID 2380206-5 2. Register Twig Com Ltd customer and business partner register 3. Contact Person Jukka Nieminen, jukka.nieminen@twigcom.com, +358 40 51050 58 4. Purpose of Register and legal grounds for proces sing Personal Data Personal Data is stored and processed for legitimate busin ess purposes, including: Facilitating transactions and communication with actual and prospective customers and business partners One-on-one communication with contact persons of actual and prospective customers and business partners Group communication (“Newsletters”) to contact persons of a ctual and prospective customers and business partners Invoicing and payment of invoices Forwarding and delivery logistics Managing customer accounts, user access and billing for TWI G website, TWIG partner Area, TWIG Point services and TWIG WebFinder (“Service s”) Other purposes required for complying with legal requ irements 5. Classification and profiling Twig Com may classify or profile Registered Individuals, e ither manually or automatically, for the purpose of better targeting relevant communica tion to actual or prospective customers and business partners. 6. Rekisterin sisältämät tiedot Personal Data in the Register: Name Phone number Email address Employer name and address, as applicable Personal address, as applicable We may use cookies to improve and optimize our services by co llecting the following data of the website usage: Language and localization settings ; Information about the internet browser used, about the internet service provider, devi ce and operating system. For logging purposes, we may also store the IP-address fro m which the Service accessed. 7. Data sources Personal Data in the Register is collected from the Regi stered Individual. 8. Storing period of Personal Data Personal Data is stored for the duration of the business relationship or the prospective business relationship. Some Personal Data may be required to be stored for a given period to comply with relevant legislation. 9. Transmitting or disclosing Personal Data

2. Personal Data may be transmitted to Sub-Processors, such as c loud service providers, business cloud software providers and telecommunication p roviders. Sub-Processors may operate or store Personal Data inside or outside EU. Twig Com as the Controller has agreements with Sub-Processors so as to comply with Data Pro tection Laws. 10. Processing Personal Data and general data secur ity principles The Personal Data Register is secured by technical and o rganisational means. Personal Data is stored on servers and systems protected by firewalls, passwords and other means. Access to Personal Data is granted only if necessary for proc essing. All Processors of Personal Data are under appropriate obligation of con fidentiality. 11. Contact us For any questions regarding processing of Personal Data p lease contact the Contact Person, see section 3 above. RIGHTS OF THE REGISTERED INDIVIDUAL Specific rights of the Registered Individual under the Data Protection Laws include: Right to access information Processing Personal Data is required to be transparent. T he Controller is obliged to inform you of Processing practices when collecting and processing Personal Data. You must be informed of Controller, its representative, purpose of Processing Personal Data, disclosure of Personal Data, and rights of Registered Individuals. Privacy Policy shall be available of every Personal Data Register, containing name of Control ler, which Personal Data is stored and what are they used for. Right to review On request you have the right to know which Personal Data of you, if anything, is in the Register. You have the right to know where your Personal Data is acquired from for the Register, what is it used for and where is it disclosed. Excercising the right to review Address your request to the Contact Person in the Privacy Po licy. Should Controller refuse your request, are they required to provide you with a w ritten statement detailing reasons for refusal. Then you can turn to the Privacy Ombudsman, or to Controlling Authority. Right to revise your Personal Data You have the right to be appraised based on correct Per sonal Data. Only Personal Data required for the defined purpose of Processing may be stored in Register. Controller shall inform also disclosee and source of incorrect Personal Data of the revision. Address your request to revise Personal Data directly to Controller. If Controller refuses the revision they shall provide you with a written statement detailing reasons for refusal. Then you can turn to the Privacy Ombudsman, or to Controlling Authority. Right to refuse You have the right to refuse the Controller to Process yo ur Personal Data (“Opt-out”) for specific purposes, such as direct marketing, telesales or marke t research. To refuse, please use the Opt-out function of Services, or contact t he Contact Person in the Privacy Policy. If you cannot resolve the matter with Controller , you can contact the Privacy Ombudsman. If the matter may involve a criminal act unde r Data Protection Laws or criminal code, you can file a police report. Controlling Authority: Tietosuojavaltuutetun toimisto Rahapihantie 9, 6. krs. FI-00520 Helsinki, Finland P.O. Box 800, FI-00521 Helsinki, Finland