PRIVACY NOTICE FOR PAY DATA PLATFORM

Allshares Oy and Allshares AB (”Allshares” or “us”) respect your privacy and are committed to protecting your privacy and personal data.

We process your personal data for our purposes as joint controllers when you use the remuneration benchmarking service (”Pay Data Platform”) or your personal data is used in the said service, a SaaS-service we offer to our customers, typically your employer.

When acting as joint controllers, Allshares Oy and Allshares AB jointlydetermine the purposes and means of the processing of your personal data aswell as have access to the data. They also share responsibility for protectingyour data and ensuring your rights under data protection laws.

We may also process some personal data as separate controllers for each controller’s own purposes for which this notice shall not apply. For example, if you are a contact person of our customer, you can find more information on how we process your personal data in our customer privacy notice on www.allshares.com.

This privacy notice has been drafted in a layered format. By clicking the headlines below, you can move to the different parts of this notice.

CONTENTS

1 CONTROLLERS
2 COLLECTED PERSONAL DATA AND SOURCES
3 COOKIES
4 PROCESSING PURPOSES, LEGAL BASES, AND RETENTION TIMES FOR PROCESSED PERSONAL DATA
5 RECIPIENTS OF PERSONAL DATA
6 INTERNATIONAL TRANSFERS OF PERSONAL DATA
7 DATA SUBJECTS’ RIGHTS
8 CHANGES TO THIS PRIVACY NOTICE

1 CONTROLLERS

The controller for the personal data processing described herein is:
‍
‍AllsharesOy
‍BusinessID 1882491-3
Aleksanterinkatu 13, 00100 Helsinki, Finland 

‍Allshares AB
‍BusinessID 556731-4546
Sveavägen15, våning 16, 111 57 Stockholm, Sweden

If you have any questions regarding this privacy notice, please contact us at: privacy@allshares.com.

2 COLLECTED PERSONAL DATA AND SOURCES  

We only collect personal data from or about you that is essential and necessary for the purposes described in this privacy notice.
‍
In this section, we will tell you which personal data we collect about you and how the collection takes place. In section 4 you will find a table in which we have detailed the purposes of collecting your personal data and the legal basis for the processing of personal data as well as the relevant retention times foreach personal data processing purpose.

We may collect, use, store and transfer different types of your personal data, which we have grouped in the following way:·        
        Remuneration data means information about you and your remuneration we need for providing the Pay Data Platform,        which will be collected from your employer or publicly available sources.  
‍
‍Wecollect the personal data from the following sources:·        
          From your employer (please see below a description of how we ensure the confidentiality of such data).·
          From publicly available sources such as business information databases and websites of companies.

In order to ensure the confidentiality of the personal data sourced from your employer, the data in the Pay Data Platform is presented in an anonymous and statistical form so that the remuneration information cannot be connected to any individual and no individual can be identified from the data. Data aggregation and a minimum reporting threshold – set at seven (7) data points – are used to prevent the identification of any individual. The remuneration information displayed represents the middle range of the data collected, excluding the lowest 25% and the highest 25%. If there are less than seven (7) data points, no data is displayed. The compensation ranges are visible per component, including base salary, bonuses, equity, pensions, and benefits. Users can then refine their view using pre-set filters for company metrics such as revenue, market capitalization, total assets, and employee count, as well as by region and role. Selections are limited top redefined ranges, ensuring the user cannot modify the ranges. The Pay Data Platform does not permit users to alter the composition of this collective dataset by adding or removing companies.

3. COOKIES

We use essential cookies to ensure the proper functioning of the website. These cookies are necessary for the website to work and do not track you or collect your personal data for any other purposes. We do not use non-essential cookies.

4. PROCESSING PURPOSES, LEGAL BASES, AND RETENTION TIMES FOR PROCESSED PERSONAL DATA

We process your personal data only within the limits permitted by law. We usually process your personal data based on the following legal basis of processing:·        
          The processing is necessary for the purposes of the legitimate interests according to Article 6(1)(f) of GDPR, pursued            by us or by a third party, except where such interests are overridden by your interests or fundamental rights and            freedoms.

In the table below, we have described the personal data we are going to process together with the purposes for which we are going to process this data as well as our legal bases for such processing and the retention times for different sets of data.

• Processed personal data
• Processing purposes
• Legal basis for processing (GDPR Art. 6)
• Retention time for
  personal data
• Remuneration data, such as company name, companymetrics and job title, years of relevant work experience/starting year ofemployment, salary, earning opportunity from short-term and long-term incentiveplans and paid out incentives as well as other remuneration components, placeof business, age, and gender.
• Providing the remuneration benchmarking service forcustomers which have purchased a subscription to the Pay Data Platform.
• Legitimate interest GDPR Art. 6(1)(f)
• Five (5) years

We may retain your personal data longer than stated above, if it is necessary to fulfil the obligations set by law or to prepare, present or defend against legal claims or to resolve disagreements. After we no longer have any purposes to retain your data, it is deleted or anonymized.

To the extent that the processing of personal data is based on our legitimate interest, we have carried out a legitimate interest balance test. The purpose of the balance test is to ensure that our legitimate interest is properly balanced with your interests or fundamental rights or freedom. If you want to get more information about the balance tests we have performed, you can contact us by email at privacy@allshares.com.

5. RECIPIENTS OF PERSONAL DATA

We may share your personal data with third party recipients in the following situations:·

• When it is necessary for the purposes listed in section 4.
• If required by law, we may disclose your personal data to public authorities
• Your information may be shared with a person or entity that acquires all or most of our company, shares, or assets, or with which we are in the process of merging
• We may also disclose your information when we believe in good faith that its disclosure is necessary to exercise our rights or defend against a legal claim, to ensure your or others' safety, to investigate fraud, or to respond to a government request.