Business Relations and External stakeholders Privacy notice

Scope of this Privacy notice

The purpose of this privacy notice is to provide you with information regarding how Tietoevry Tech Services collects and process your personal data, as well as to inform you about your privacy rights and the legal protections in place when:

1. Your personal data is utilized to manage our relationship with our customers.
2. Your personal data is utilized to manage our relationship with our vendors or partners.
3. Your personal data is utilized to execute our sales opportunities.
4. Your personal data is utilized in the context of delivering our offerings for our own business purposes.
5. If you are an external stakeholder, and you are in a role where there is another legitimate business purpose for processing your data (e.g., working for press and media), your personal data may be used for our external communication needs.

What data do we collect about you?

Personal data, also referred to as personal information, means any information that can identify an individual. This definition excludes anonymous data, where the identity has been removed. We collect, use, store, and transfer various categories of personal data about you, which we have classified as follows:

• Identity Data such as first name, last name, username or similar identifier.

• Contact Data such as an address, email address and telephone numbers.

• Employment Data such as job title, company name, department name, role classification.

• Profile Data such as your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.

• Usage Data such as information about how you use our website, products and services.

• Marketing and Communications Data such as your preferences in receiving marketing from us and our third parties and your communication preferences.

• Sales and Customer Relationship Data such as a role in the company, access rights, offering details and activity.

• Project management and Continuous services related Data such as allocations, hour bookings and role.

• Customer feedback Data such as customer responses to relationship and delivery experience surveys.

Additionally, we collect, utilize, and share Aggregated Data, such as statistical or demographic information, for various purposes. Although Aggregated Data may be derived from personal data, it is not considered personal data under the law as it does not directly or indirectly disclose your identity.

For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

As a general practice, we do not typically collect any special categories of personal data concerning you, which includes details about your racial or ethnic origin, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, or genetic and biometric data. Furthermore, we do not process any information pertaining to criminal convictions and offenses. In the rare cases when we do process such data, we ensure compliance with the applicable legislation.

How is your personal information collected?

We employ various approaches to collect data from you or about you, such as:

Direct interactions: You may provide us with your personal data through various means, including filling out forms or engaging in correspondence via mail, telephone, email, or any other channels of communication. Our team of professionals will then add this information to our Customer Relationship Management (CRM) or Vendor/Partner management databases, based on the interactions they have with you.

We may receive your personal information directly from a company we have a connection with. This is done to help facilitate the relationship between you and us.

We have the possibility to obtain personal information about you from different third parties and publicly accessible sources, as described below:

• Identity, Contact, and Employment Data can be obtained from third parties, such as data brokers or aggregators, or from publicly available sources (e.g., published articles, press releases, relevant public posts on social media platforms for business purposes).

For what purposes is your personal information processed?

We will only utilize your personal information in accordance with the relevant legal requirements. Below, we have outlined a comprehensive list in a tabular format, detailing the various purposes for which we intend to use your personal data, along with the corresponding legal bases we rely on to carry out such processing. When applicable, we have also identified our legitimate interests.

Please note that we may process your personal data based on more than one legal ground, depending on the specific purpose for which your data is being used. If you require further information regarding the specific legal grounds we rely on, especially in cases where multiple grounds are mentioned in the table below, please reach out to us at privacy.techservices@tietoevry.com.

MARKETING COMMUNICATION AND CHOICE TO OPT OUT

Our mission is to offer you options regarding specific uses of your personal data, particularly in relation to marketing and advertising. You have the freedom to request the cessation of marketing messages from us or third parties whenever you wish. This can be done by adjusting your marketing preferences through checking or unchecking the relevant boxes, following the opt-out links provided in any marketing message, or contacting us directly at privacy.techservices@tietoevry.com. In such instances, we will retain minimal personal data solely for the purpose of recording your opt-out

decision and ensuring that you are not contacted again. It is important to note that opting out of marketing messages does not apply to personal data provided to us as a result of purchasing a product/service, registering for a warranty, having a product/service experience, or engaging in other transactions.

OFFERS OF PROMOTION FROM US

By analyzing your personal information, we aim to understand your preferences and interests, allowing us to determine relevant products, services, and offers that may appeal to you (referred to as marketing). You will receive marketing communications from us if you have provided consent for such communication or if you (or the company you represent) have obtained goods or services from us and have not chosen to opt out of receiving marketing materials.

MARKETING BY EXTERNAL PARTIES

Before sharing your personal data with any company external to the Tietoevry Tech Services group of companies for marketing intentions, we will request your explicit opt-in consent.

PERSONALIZED EMAILS

We send promotional emails that typically include technologies (such as web beacons, cookies, or similar) which enable us to track your interaction with the message, including whether you open, read, or delete it, as well as the links you click. When you click a link in a marketing email, even without being registered or signed in to our site, we utilize a cookie to record the pages you view and the content you download from our websites. To enhance your experience with TietoEVRY and carry out the tasks described in our privacy notice, we may combine data gathered from publicly available sources with information obtained from various email, website, and personal interactions with you.

DATA COMBINATION AND ANALYSIS

We may combine data collected about you from publicly available sources, as well as from various email, website, and personal interactions. This data combination allows us to better understand your experience with Tietoevry Tech Services and perform other activities outlined in our privacy notice.