PRIVACY POLICY

1 GENERAL

1.1 Treebula is a trademark operated by Nordiska Virkesbörsen AB, org.nr 559081-6756, ("we", "our", “ours” or "us").

1.2 This privacy policy (the "Policy") describes how we processes personal data in connection with the provision of our services (the "Service") and otherwise when you interact with us.

1.3 The Policy describes, among other things, how we collect, disclose and store personal data and how we work to ensure that such personal data is processed in accordance with applicable data protection legislation.

1.4 Unless otherwise stated below, we are the data controller in relation to the personal data processing described in the Policy. It is therefore our responsibility to ensure that the processing of personal data for which we are the data controller takes place in accordance with applicable data protection legislation.

1.5 Terms used in the Policy shall have the same meaning as in Regulation (EU) 2016/679 ("GDPR").

2 CATEGORIES OF PERSONAL DATA

2.1 Within the framework of the provision of the Service, we process the following categories of personal data:

a) First and last name,

b) Address,

c) Social security number,

d) Telephone number,

e) E-mail address,

f) Property designation,

g) IP-address,

h) Search history,

i) Geographical information, and

j) Employment information (position or similar)

2

2.2 Other categories of personal data than those listed above may also be processed by us, e.g. in connection with support cases. Exactly what personal data we will process also depends on what you choose to share with us.

2.3 The personal data we process is collected directly from you as a user or, where applicable, from other actors.

3 PURPOSES OF THE PROCESSING OF PERSONAL DATA

We process personal data for the following purposes:

3.1 To provide the Service

3.1.1 We process personal data to provide the Service to our users, e.g. to create user accounts, provide functionality, etc. The personal data processed for this purpose is name, email, phone number and professional role.

3.1.2 The legal basis for the processing of personal data for the purpose set out above is the contract between us and our users. The processing of personal data that takes place for this purpose is necessary for us to be able to fulfil the agreements we enter into with our users aimed at providing the Service.

3.1.3 The personal data processed for this purpose is collected from our users.

3.1.4 We store the personal data listed above during the time you use the Service or until you terminate your user account, and three (3) years thereafter. However, we may store the personal data for a longer period of time if this is necessary for us to be able to defend ourselves against any legal claims from users or third parties.

3.2 To manage invoices etc.

3.2.1 Where applicable, we process personal data for the purpose of managing invoices and receipts. The personal data processed for this purpose is business name, VAT no., address and email.

3.2.2 The legal basis for the processing of personal data for the purpose set out above is the agreement between us and our users, e.g. for processing payments within the Service. The processing of personal data that takes place for this purpose is necessary for us to be able to fulfil the agreements we enter into with our users aimed at providing the Service.

3.2.3 The personal data processed for this purpose is collected from our users.

3.2.4 We store the personal data listed above for seven (7) years from the time we received it. However, we may store the personal data for a longer period of time if necessary for us to be able to defend ourselves against any legal claims from users or others.

3

3.3 To manage and administer the conclusion of agreements within the framework of the Service

3.3.1 Where applicable, we process personal data to manage and administer contractual information for our users. The personal data processed for this purpose is name, email, phone number and professional role.

3.3.2 The legal basis for the processing of personal data for the purpose set out above is the agreement between us and our users, which imposes on us an obligation to provide means for our users to enter into contracts within the framework of the Service. The processing of personal data that takes place for this purpose is necessary for us to be able to fulfil the agreements we enter into with our users aimed at providing the Service.

3.3.3 The personal data processed for this purpose is collected directly from the user of the Service. We store the personal data during the time under which you have an active user account and for a period of twelve (12) months thereafter.

3.4 To develop and improve the Service

3.4.1 We process personal data for the purpose of developing and improving the Service in connection with your use of the Service or otherwise interacting with us. The personal data processed for this purpose is name, email, phone number and professional role.

3.4.2 The legal basis for the processing of personal data for the purpose set out above is our legitimate interest in developing and improving the Service.

3.4.3 The personal data processed for this purpose is collected directly from the person who uses the Service or otherwise interacts with us. We store the personal data during the time under which you have an active user account and for a period of twelve (12) months thereafter.

3.5 To provide support

3.5.1 We process personal data for the purpose of providing support to our users and others. This can be done by contacting us, or by us contacting you. The type of personal data processed for this purpose depends on what the specific case concerns, as well as what personal data you choose to share with us.

3.5.2 The legal basis for the processing of personal data for the purpose set out above is our legitimate interest in providing support linked to the Service.

3.5.3 The personal data processed for this purpose is collected directly from the data subject. We process personal data for this purpose for such a period as is necessary to handle the case in question, however, we strive to delete the personal data when the case is closed.

4

3.6 For marketing and communication

3.6.1 We process personal data to market the Service and ourselves; either through newsletters, SMS and other communications (e.g. telemarketing) or through various marketing campaigns. The personal data processed for this purpose are name, email, phone number and professional role.

3.6.2 The legal basis for the processing of personal data for the purpose set out above is our legitimate interest in marketing the Service. You can unsubscribe from our mailings directly in the e-mail you receive from us. Otherwise, feel free to contact us and we will help you with the deregistration.

3.6.3 The personal data is generally collected from you or from actors from whom we buy address lists. We store the personal data processed for the purpose of sending out newsletters and conducting other communications with you for a period of 36 months from the time you last interacted with the Service, or otherwise were in contact with us.

3.7 To troubleshoot the Service

3.7.1 We process personal data to troubleshoot the Service. The personal data processed for this purpose is IP-address, name, email, phone number and professional role.

3.7.2 The legal basis for the processing of personal data for the purpose set out above is our legitimate interest in preventing and remedying errors in the Service, as well as making the use of the Service as error-free as possible.

3.7.3 The personal data is generally collected from you. We process personal data for this purpose for you for a period of twelve (12) months from the time you last interacted with the Service.

4 TRANSFER OF PERSONAL DATA

4.1 We may transfer personal data to our partners and other companies in the same group within the framework of the purposes stated in the Policy. Currently, we disclose personal data to the following parties:

a) Telemarketing

b) Mixpanel

c) Bing

d) Google Analytics

e) Facebook (Meta)

f) Mailchimp

g) SendinBlue

h) Tawk.to

i) AWS

j) Buying organisations (i.e. timber buyers)

k) Slack

l) G-mail

m) Getaccept

n) Klarna

o) Clicksend

p) Telia

4.2 When we share personal data with our partners, they are either acting in the capacity of personal data processors or as independent personal data controllers in relation to us. The partners who are our data processors process personal data on our behalf and in accordance with our instructions. We enter into special agreements with our data processors in order to ensure that their processing of personal data takes place in accordance with our instructions and applicable data protection legislation.

4.3 We only transfer personal data to third countries (i.e. outside the EU/EEA) in the event that (i) the European Commission has decided that the country in question has an adequate level of protection, (ii) the recipient of personal data has signed a binding and enforceable agreement that provides sufficient guarantees regarding the protection of the personal data transferred, or (iii) if there is another legal basis under applicable data protection legislation for such transfer.

4.4 We may also disclose personal data to authorities or other public actors in the event that such disclosure is required by law.

5 SAFETY

5.1 We have taken technical and organizational measures in relation to the personal data processed in accordance with the Policy. When necessary, we carry out, among other things, anonymization and pseudonymization of personal data.

5.2 We also take technical and organizational measures to prevent the intentional or unlawful destruction, loss, alteration or unauthorized disclosure of or unauthorized access to the personal data transmitted, stored or otherwise processed.

6 SHELF LIFE

6.1 Notwithstanding what is stated above, we always strive to only process personal data as long as it is needed to fulfil the purpose of the personal data processing. We do not store personal data for a longer period than permitted by applicable data protection legislation, including the GDPR.

7 COOKIES

7.1 We collect information using technology such as cookies, pixels and local storage on your browser or device (e.g. mobile phone, computer or tablet). We do this in order to learn more about who uses the Service so that we can improve user experience. You decide which types of cookies you want to allow. Please note, however, that some cookies are necessary for us to provide the Service. Such necessary cookies cannot be opted out.

7.2 The data collected through our use of cookies, etc. is technical information about the device used (e.g. computer, smartphone or tablet).

7.3 You can control how you use and manage cookies when you enter different web pages. Most browsers allow you to delete all saved cookies or for cookies to be blocked from being saved on your computer. Since cookies are used to optimize your experience on web pages, deleting or blocking these may result in limited functionality and/or degraded performance of the web pages you visit. (i) For more detailed information on the management of cookies, you can go to: https://pts.se/sv/privat/internet/integritet/kakor-cookies/ (ii) For information about behavioural advertising, you can go to: http://www.youronlinechoices.com/se/ (iii) For more info on online marketing: https://www.networkadvertising.org/faq

8 YOUR RIGHTS

8.1 Under applicable data protection legislation, you have the following rights:

-Right to information,

-Right to register extracts,

-Right to rectification,

-Right to erasure,

-Right to restriction of processing,

-Right to data portability,

-Right to object, and

-Rights in relation to automated decision-making and profiling.

8.2 You can contact us via the contact details below in case you have questions or complaints regarding our processing of personal data, or if you wish to exercise any of the above rights. Please note that some rights are limited by law. This means that in certain circumstances we are not obliged to comply with a request to exercise a certain right.

8.3 In the event that you wish to lodge a complaint regarding our processing of personal data, you can contact the Swedish Authority for Privacy Protection on www.imy.se/kontakta-oss/.

9 CHANGES TO THE POLICY

9.1 We reserve the right to make changes to the Policy from time to time. The date of the last modification is given below. All changes to the Policy will be published on our website and/or in the application. We recommend that you keep up to date with the content of the Policy to keep track of any changes to it.

9.2 If we change the Policy in a manner that represents a material change, we will inform interested parties and, if applicable, request that such parties read through and re- accept the Policy.

9.3 The last update to the Policy was made on 1 June 2022.

10 CONTACT

If you have questions about the Policy or our processing of personal data, you can contact us at: E-mail: info@virkesborsen.se