INFORMATION ABOUT PROCESSING OF PERSONAL DATA

Probi AB (“Probi” or “we”) are committed to protecting your personal data. The purpose of this privacy notice is to provide information on how we process your personal data when you visit our website or if you represent a company that we have an actual or potential business relationship with. For that reason it is divided into two parts, Part A and Part B.

Part A includes information on what types of personal data we process and why, what legal bases we have identified and for how long the personal data is stored. As this information is different depending on whether you come into contact with us as a website visitor or as a business representative, Part A is divided accordingly to make it easy for you to identify the information applicable to you.

Part B includes information which applies to both website visitors and business representatives, such as transfers of personal data and your rights.

- PART A -

1. Website visitors

When you visit our website, probi.com, we collect and process personal data about you, as described below. One type of personal data that is collected is cookies. For more information about the specific cookies we use, please see our separate cookie page.

Furthermore, our website can make use of widgets for social media which allows users access to content from Probi’s website on different social media platforms (among others; Facebook, YouTube, Twitter, LinkedIn). To better understand how and what information is collected via social media and what cookies are used by such third party on their respective platforms, we refer to the current privacy policy for each of the social platforms respectively.

1.1 What personal data is processed?

When you visit our website we process your Internet Protocol address, browser language, geographical location data, date and time, and information about webpages accessed by you.

If you:

• subscribe to our financial reports and/or press releases, we process your name and e-mail address.
• request information about our products or otherwise contact us via our contact form we process your name, e-mail address, company, country, and any personal data you include in your message.
• voluntarily provide your telephone number, we process this as well.

Information about your name, e-mail address, company, and country are mandatory to provide in order to use the contact form. If you do not provide such personal data to us, you will not be able to submit your message via our website contact form. However, you may email us at info@probi.com.

1.2 For what purpose is the personal data processed?

We process your personal data:

• to make the website available to you and to improve, develop, and enhance the usability of the website.
• to be able to provide you with the financial reports and/or press releases you have requested.
• to be able to administrate, follow up and respond to any messages and questions you send us, and to take necessary actions in relation to such messages and questions.

1.3 What are the legal grounds for processing of personal data?

We base our processing on our legitimate interest to:

• (a) ensure that you are given access to a well-functioning website which is up to date and provides you and other website visitors with easy access to the functions and information you seek.
• (b) provide you with the financial reports and/or press releases you have requested.
• (c) administrate, follow up and respond to messages and questions and to take necessary actions.

The amount of personal data being processed as described in (a) is fairly limited and is generally analysed on an aggregated basis. The processing activities are not deemed to affect personal integrity to a large extent and are proportionate in relation to their purpose.

The processing described in (b) is initiated by your subscription and the personal data collected is limited to such information which is absolutely necessary in order for us to provide the requested documentation. In our opinion, our processing of such personal data is to some extent also a shared interest between us as it lies within your interest that your personal data is used to provide the documentation you have requested.

The processing described in (c) is initiated by your contact and the personal data collected is limited to such information which is absolutely necessary in order for us to administrate, follow up and respond to such contact and take action if needed. In our opinion, our processing of such personal data is to some extent also a shared interest between us as it lies within your interest that your personal data is used to provide you with the services you have requested.

Based on the factors mentioned above, we have conducted a balance of interest assessment and have concluded that our legitimate interest outweighs your potential interest in not having your personal data processed for this purpose.

You are always entitled to object to this assessment. You can read further about your rights below.

1.4 For how long is the personal data stored?

Your personal data is stored:

• until you leave our website and close your browser. Thereafter, your personal data is only processed as aggregated statistics and may not be traced back to you. However, some of your personal data is collected via the use of cookies and may be stored for a longer period of time as each cookie has a specific storage period. These individual storage periods relating to specific cookies are available on our cookie page.
• until you no longer wish to receive our financial reports and/or press releases. Once you have unsubscribed, we will delete your personal data as soon as possible and in any case within thirty (30) days. Statistics which have been anonymised may be saved thereafter. You are given the opportunity to unsubscribe in connection with each distribution of a financial report and/or press release. You may also unsubscribe by sending an email to info@probi.com.
• for the duration of our correspondence and contact. It is also stored for one year thereafter to enable any follow up of our correspondence and contact if needed.

2. Business representatives

If you are a representative of one of our existing or potential customers or suppliers or a representative of company that we interact with (or wish to interact with) as part of our business, we collect and process your personal data as described below.

We will collect this personal data directly from you or from the company you represent.

2.1 What personal data is processed?

We will process your contact information (name, email address and phone number), name of the company you represent and your function or role at that company.

2.2 For what purpose is the personal data processed?

We process your personal data:

• to maintain or initiate a business relationship with the company you represent.
• to provide you with marketing material via mail, email and text messages.

2.3 What are the legal grounds for processing of personal data?

Our processing is based on:

• our legitimate interest to maintain our current business relationships as well as cultivating new business relationships. To process personal data of individuals representing companies which we do (or wish to do) business with is fundamental and absolutely necessary in order for us to conduct our business. Furthermore, the personal data is limited to personal data that is related to your professional role and therefore considered less sensitive from a personal integrity perspective.
• our legitimate interest to provide you, in your professional role, with marketing material to promote our business and our products. Marketing is a crucial part of our business and we always strive to provide you with marketing information that is relevant for you in your professional role. The personal data we process for this purpose is limited and relates to professional information which is considered less sensitive from a personal integrity perspective.

Based on the factors mentioned above, we have conducted a balance of interest assessment and have concluded that our legitimate interest outweighs your potential interest in not having your personal data processed for this purpose.

You are always entitled to object to this assessment. You can read further about your rights below.

2.4 For how long is the personal data stored?

Your personal data is stored for as long as we have a (actual or potential) business relationship with the company you represent.

We will:

• delete your personal data, without undue delay, when we no longer have a (actual or potential) business relationship with the company you represent.
• delete your personal data without undue delay after being informed that you no longer are a representative of the company in question, or that you have a different function or role whereby we no longer have the need to contact you with any business related matters.
• delete your personal data without undue delay after being informed that you no longer are a representative of the company in question, or that you have a different function or role whereby we no longer have the need to provide you with marketing material.

Finally, if you inform us that you no longer wish to receive marketing material from us, we will stop processing your personal data for this purpose.

- PART B -

1. Who has access to your personal data?

We have implemented appropriate technical and organisational measures to protect your personal data against loss, accidental and unlawful access and unauthorised disclosure. The number of persons with access to your personal data is limited. Only individuals associated with us that need to process your personal data in accordance with the purposes above have access to your personal data.

We may share your personal data with other companies within the Probi group if necessary in order to achieve the purposes described in Part A above.

We may also share your personal data with suppliers and partners that carry out services on our behalf or in other ways collaborate with us, such as IT service provider(s) which hosts, develops and offers support for our website, probi.com, IT service providers supplying our internal systems (e.g. our CRM system and our email system), marketing firms and providers of PR and communication services. Your personal data is only shared to the extent it is necessary in order to achieve the purposes described in Part A above.

2. Transfers outside the EU/EEA

Your personal data will be transferred to countries outside of EU/EEA, including (but not limited to) the United States and Singapore, which may have a lower level of protection of personal data than within the EU/EEA. The transfers are based on our legitimate interests described above in Part A and are needed to achieve such purposes. When transferring Personal Data to countries outside the EU/EEA that do not have an adequate level of protection according to the European Commission, we use standard contractual clauses approved by the European Commission to ensure a sufficient level of protection for your personal data. The standard contractual clauses can be found via the following link: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en. You may also contact us using the contact information below to obtain a copy.

3. What are your rights?

Probi AB, reg. no. 556417-7540, with address Ideongatan 1A, 223 70 Lund, email address info@probi.com, and phone number +46 462868920, is the data controller of the processing of your personal data. This means that we are responsible for your personal data being processed correctly and in accordance with applicable laws.

• Right to access: You are entitled to know what personal data we are processing about you, for which purposes we are processing the personal data and who we share your personal data with etc. You also have the right to gain access to the personal data and request a copy of such data.
• Right to rectification: If you notice that we have incorrect or incomplete personal data about you, you can always request that we correct or complete such personal data.
• Right to erasure and restriction: In some cases, you may request that we delete your personal data or that we restrict our processing for a certain period of time. Please note that deletion or restriction of your personal data may result in us not being able to provide you with access to our website or all its services, provide you with information, annual reports or press releases, respond to your messages and questions, or contact you in your professional role.
• Right to object: In certain cases, you have the right to object to the processing, for example you may object to the processing that we perform based on our legitimate interest or for direct marketing purposes.
• Right to data portability: In cases when we base our processing on your consent or the fulfilment of an agreement with you, you are entitled to extract your personal data in a structured, commonly used and machine-readable format and to transfer the personal data to another controller.

If you have questions regarding how we process personal data about you, you are most welcome to contact us at the contact information stated above. If you have any objections or complaints about the way we process your personal data, you also have the right to file a complaint with the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten).

4. Changes

If any changes are made concerning the processing of your personal data, we will inform you of the changes by publishing an updated version of this privacy notice on our website, probi.com. In relation to changes concerning processing of business representatives’ personal data, we may also notify you via email if motivated due to the type of change.

5. Version

This privacy notice was last updated on 23 February 2021.