SEB AB Privacy Notice Corporates and Institutional business Helsinki Branch

This Privacy Notice reflects our processing of Personal Data that may be provided by you, separated out into different categories below. You as an individual may interact with us in different capacities, e.g. as both an individual client as a representative of a company you work for and we will, unless noted otherwise below, interact with you differently for each capacity or data subject role which you perform in providing us with your Personal Data. Except as noted below, and only when required by law or to manage credit, security, fraud or similar risks and in accordance with applicable Banking secrecy standards, we will not combine Personal Data collected about you in the different capacities in which you interact with us. This also means that should you request copies of your Personal Data or request to correct personal data about you, we ask that you are as specific as possible in relation to the information that you wish to have corrected and in relation to which service and client this Personal Data is coupled with.

Personal Data will be collected directly from you, from publicly available sources, from our immediate client or from third parties providing services to us. This information is processed for the purposes of delivering or obtaining the products and services that are contracted with us. We will only use your Personal Data where we have a lawful reason to do so – these lawful reasons include: where you have consent to provide us with your Personal Data; where we are required by law or regulation; if we need to pursue our legitimate interests; where we believe it is in the public interest for us to do so (e.g. to help prevent or detect crime);, or as a consequence of our contractual relationship with you or our clients. Failure to provide this information may prevent or delay the fulfilment of these obligations and we may not be able to provide you with certain products and services.

You are responsible for making sure that any information you give us is accurate and up to date. If anything is
wrong or your information changes, you must tell us as soon as possible. If you believe that the information we
hold about you is wrong, incomplete or out of date, you can contact us using the contact details in the end of
this Privacy Notice.

We may share your Personal Data with:

• service providers that act as data processors to us, i.e. other companies that process your data on our behalf and pursuant to our instructions. This is relevant where e.g. we ask printers to produce and distribute account statements or when we purchase storage, hosting or support services from vendors;
• third parties who you make payments to and receive payments from;
• other financial institutions, brokers, lenders and holders of security over any property you charge to us,
  authorities, trade associations, industry bodies, fraud prevention agencies or risk management
  companies;;
• law enforcement agencies, government regulators, courts, dispute resolution bodies and tribunals under the applicable laws of the relevant jurisdiction and parties appointed by the relevant regulator to carry out investigations and audits of our activities;
• other SEB Group companies and any sub-contractors;
• agents or service providers who work for us or provide services to us or other SEB Group companies;
• any people or companies in connection with potential or actual corporate restricting, merger, acquisition or takeover, including any transfer or potential transfer of any of our rights or duties under our agreement with you.

In all such instances, we take steps to ensure that there are Data Processing Agreements in place to protect your Personal Data and to limit access and use of that Personal Data strictly for the purposes and to the extent needed for those services to be performed. When a service provider relationship is terminated, we impose requirements that any Personal Data stored outside of SEB is returned to us or destroyed.

If you register to use our online services, we will ask you to provide Personal Data for identification and authentication purposes. This information may also be provided to us by a colleague, co-worker or other associate or representative of the organization with which you are affiliated.

This Notice is sectioned according to the role / capacity in for which we process your Personal Data.

Why we process your Personal Data

1. Identification of Beneficial owners is a legal requirement in all jurisdictions where we are present for the purposes of anti-money laundering (“AML”) legislation. The definition of who is a beneficial owner varies in different jurisdictions, as well as who should be identified in lieu of a beneficial owner when no such person can be identified. The legal requirement will normally apply jointly and separately in each jurisdiction where our client has business with us. E.g. where a client has accounts at multiple SEB locations, each such location has a separate requirement to identify the client’s beneficial owner.
2. In addition to AML requirements, many other regulations make references to the person identified as the beneficial owner, e.g. some of the tax reporting rules that apply and where we have multiple legal requirements to obtain the same or complementary information regarding Beneficial Owners.

Sources of personal data

1. We routinely collect and update information about you as a beneficial owner, as defined in relevant legislation in force where we are required to identify you as such. The information is provided to us from our immediate client or its representative on its behalf or from you directly.
2. We may complement this information with information from public sources and registers.

Types of Personal Data we collect from you

1. Beneficial owner information that we collect includes identity and identifiers such as name, address, date and place of birth, passport copy, signature specimen, tax identification number.
2. We also collect contact details such as registered address.
3. Additionally, we will collect information regarding affiliations, status as a politically exposed person and close family members.

Processing activities

1. We will collect and store your Personal Data and connect it to the clients for which you are identified as a beneficial owner.
2. On initial identification and during subsequent reviews, we will also screen you against external sanction lists, for adverse media and for verification against other third party resources that we have access to in order for us to comply with our legal and regulatory obligations.
3. Where required, we will include your details in reports to or during reviews by supervisory authorities as a beneficial owner of a client for which we are required to provide details.
4. Where you are also a client of SEB in a personal capacity, we will combine information about you in your capacity as a client with information about you in your capacity as a beneficial owner.

Data retention

We will keep Personal Data about you as long as it is accurate and relied upon for purposes of complying with relevant legislation, including for the duration of any record keeping requirement we are subject to.

Personal Data sharing and data transfers

1. We will share information collected about you as a beneficial owner with other parts the SEB Group on a need to know basis and pursuant to internal data sharing agreements.
2. We will share personal data about you as a beneficial owner with supervisory authorities where there is a legal requirement for us to disclose such information.
3. We will share personal data about you as a beneficial owner with third parties when instructed to do so by the client of which you are a beneficial owner.

Why we process your Personal Data

1. Client, vendor and partner representatives
   Where our products and services are contracted with a legal person, we engage with our clients, suppliers and partners at various levels in order to deliver those products and services. We do so to fulfil our contractual obligations or rights, to prevent fraud and manage various kinds of risks and to pursue our legitimate interest to market our products and services towards the entities you represent.
2. Signatories and authorised representatives
   Where you are an authorised signatory or similar representative of a client, we may collect information for the purposes of enabling the client to enter into transactions and arrangements with us and to prevent fraud. We also process information in order to comply with preparedness
   legislation.
3. Payees
   Where you are the designated payee of a payment we process; we will collect personal information for purposes of settling such payment to your account and to comply with Anti-Money Laundering and Terrorist Financing legislation.

Sources of Personal Data

1. Client, vendor and partner representatives
   We collect information directly from you or from the client you represent. The information may be collected from agreements our client has entered into, through ongoing dialogue, or through correspondence and conversations. We routine record all incoming and outgoing calls for many categories of our staff in order to record and track conversations you have with us to confirm your instructions to us, to assess, analyse and improve our services, to train our staff and to manage risks or prevent and detect fraud and other crimes.
2. Authorised signatory or power of attorney holder
   Information about you is gathered from our client and where applicable, external public registers. Where our client registers an electronic power of attorney in our systems, initial Personal Data is provided by our client’s administrator and additional information is gathered from you as a user through our portal.
3. Payees
   Personal Data is obtained through payment instructions sent to us through one of the financial messaging services we participate in.

Types of Personal Data we collect from you

1. Client, vendor and partner representatives
   We will routinely collect professional contact details such as phone, email, office address, title, role and the client you represent. In addition, for particular roles we will collect information about your knowledge, experience and understanding of financial products. In interacting with recorded SEB staff, your voice may also be recorded. Finally, where we invite you events we may collect information about your dietary preferences.
2. Authorised signatory or power of attorney holder
   We keep Personal Data about you including your name, personal identifiers such as social security number or other unique identifier, registered address, associate client and any restrictions relating to signatory or power of attorney rights. We also keep records of arrangements and transactions that you have entered into in such capacity.
3. Payees
   Payment instructions will routinely contain information regarding name, account number, the purpose of the payment and the relevant account number.

Processing activities

1. Client, vendor and partner representatives
   We will process our information to reference and maintain day-to-day contacts concerning the relevant service that we provide to you.
2. Authorised signatory or power of attorney holder
   We will store the information and reference it to verify authorisation to enter into relevant contracts.
3. Payees
   We will process the information to screen to settle payment instructions and to screen against sanction lists. We will also pursuant to our anti-money laundering obligations analyse payment purposes against high-risk scenarios.

Data retention

1. Client, vendor and partner representatives
   We will keep your Personal Data as long as its current and relied upon for the stated purposes. Where we rely on such information for regulatory purposes, e.g. recorded conversations or information regarding knowledge and experience kept to check your suitability for the products or services we have provided to you, the information will be retained until expiration of applicable record keeping requirements in each jurisdiction where it is relied upon.
2. Authorised signatory or power of attorney holder
   We will keep Personal Data about you as long as it is accurate and relied upon for purposes of complying with relevant legislation, including for the duration of any record keeping requirement we are subject to.
3. Payees
   We will retain payment information in accordance with taxation and related requirements that we are subject to.

Personal Data sharing and data transfers

We will not share your personal data outside of SEB except in the following specific circumstances: i) where we are required to do so by law, e.g. for purposes of regulatory reporting; ii) where we act as a financial intermediary and are instructed by our immediate client to e.g. settle a payment in your name to an account that is not held with SEB; or iii) where we are acting in a capacity as agent and are instructed by our immediate client to share the information within e.g. within a syndicate.

Where we engage in financial intermediation activities, we will transfer your information to a recipient in the relevant market when instructed to do so in order to provide you with the relevant product or service. This may be e.g. a bank, exchange, custodian or issuer in third country.

Why we process your Personal Data

SEB is required to maintain records concerning who has given access to insider information, participated in market soundings or otherwise given access to information of a market sensitive nature (“sensitive information”). These are legal requirements to prevent market abuse and manipulation. We collect the information to inform you of your status as a person that has access to sensitive information and to notify you of changes to such status.

Sources of Personal Data

Personal Data is collected from you directly, our immediate client or the concerned issuer.

Types of Personal Data we collect from you

We will collect your name, national identifier, the issuer in relation to which you have been given information, the date when such information was made available to you and your contact details.

Processing activities

We process your Personal Data through collecting and storing it for the above purposes and in order to fulfil our legal and regulatory requirements set out above.

Data retention

We will retain your Personal Data for the duration that the information continues to be sensitive and for the duration of regulatory record keeping requirements. The information will no longer be sensitive when it is made public or otherwise becomes obsolete.

Personal data sharing and data transfers

We will share your information with the issuer at their request. We will share the information with supervisory authorities at their request and in accordance with their jurisdiction in the matter.

Why we process your Personal Data

SEB provides products and services to a number of financial intermediaries for them to provide their underlying clients with products and services in markets where SEB is present. The nature of these arrangements varies but in some instances, we are required to collect and retain Personal Data about the underlying clients as if they were direct clients of ours.

Sources of Personal Data

We will collect personal data from our immediate client to fulfil contractual obligations to them, where they in turn are fulfilling contractual obligations to you or the party you represent and on whose instruction our client is acting.

Types of Personal Data we collect from you

We will collect name, contact details, financial and tax details and instructions relevant to the service we provide. E.g. where we safekeep financial instruments for which you are the beneficial owner or the representative thereof we collect your instructions concerning corporate actions we process.

Processing activities

We will store and reference the Personal Data in order to fulfil regulatory requirements, provide contracted services and billing.

Data retention

We will retain your Personal Data for the duration of providing the service, as long as it is current and relied upon for purposes of fulfilling our recoding and tax or financial reporting obligations.

Personal Data sharing and data transfers

We may share Personal Data related to the service we provide back to our immediate client. We may also be required to share details with external authorities such as tax authorities or Financial Crime Prevention authorities as well as statistical agencies.

We protect your Personal Data from unintentional and illegal theft, loss, modification and other breaches by organisational as well as technical means. Where we engage external parties to process Personal Data on our behalf, we require them to afford your Personal Data the same level of protection we do and to inform us of any incidents so that we can inform you.

Your information may be transferred to and stored in locations outside the European Economic Area (EEA), including countries that may not have the same level of protection for Personal Data. When we do this, we will ensure that it has an appropriate level of protection and that the transfer is in line with applicable legal requirements – for example entering into standard contractual clauses with the receiving party. We may need to transfer your information in this way to carry out our contractual obligations to you, to fulfil a legal obligation, to protect the public interest and/or for our legitimate interests. In some countries, we may be required by law to share certain information, such as with the local tax authorities. In such circumstances, we will ensure that we will only share your information with those who have a legal right to receive it.

We respect your rights to request access, modify, delete and port your personal data. In addition, you have the right to object to our processing of your personal data when it’s related to direct marketing purposes. You will be required to provide proof of identity. Please contact your SEB client representative to exercise your rights. If you are an indirect client of SEB, you may also direct your request to your immediate service provider who in turn will contact SEB.

In some instances, your rights are subject to limitations e.g. we are unable to delete your Personal Data due to regulatory requirements and where we are required to retain your Personal Data for a longer period to comply with a regulatory or legal obligation.

Where applicable, you have the right to make a complaint to the competent supervisory authority or the applicable data privacy commission in your jurisdiction, as is set out in the Contact Details below.

Please address any data protection correspondence to the following SEB offices:

Data Protection Officer
SEB, Data Protection Officer
SE-106 40 Stockholm
Sweden

SEB AB, Head Office
SEB, Data Protection
SE-106 40 Stockholm
Sweden

SEB AB, Copenhagen branch
Bernstorffsgade 50
1577 Copenhagen V
Denmark

SEB AB, Oslo branch
Filipstad Brygge 1
N-0252 Olso
Norway

SEB AB, Helsinki branch
Eteläesplanadi 18
00130 Helsinki
Finland

SEB AB, Frankfurt branch
Stephanstraße 14–16
60313 Frankfurt am Main
Germany

SEB AB, London branch
One Carter Lane
London EC4V 5AN
UK

SEB AB, Warsaw branch
ul. Żelazna 51/53
00-841 Warsaw
Poland