Privacy Notification

NOTIFICATION ON PROCESSING OF PERSONAL DATA

Data controller

For the purposes of the Agreement, Sorainen offices in Estonia, Latvia, Lithuania and Belarus (Sorainen) shall be the joint controllers of
personal data transferred by you.

The secure transfer of data outside the EU (to Belarus) shall be ensured by an arrangement between the Sorainen office in Belarus and other
Sorainen offices according to the standard contractual clauses approved by the European Commission.

Data Protection Officer
E-mail: privacy@sorainen.com

Purpose and legal basis of data processing

Personal data of the Client if the Client is a natural person and other natural persons (representatives, employees, etc) will be processed by
Sorainen for the following purposes and under the following legal grounds:

• Lawful processing of data for the purposes of conclusion and compliance with this Agreement shall be based on the necessity and
  legal duty to fulfil the Agreement duly, fairly and efficiently or the necessity for Sorainen to exercise the rights arising out of this
  Agreement. Article 6(1)(b) and (c) of the Regulation
• Legal basis of individual personal data processing operations may also be compliance with legal obligations to which Sorainen is
  subject (such as tax returns, avoidance of conflict of interests, the Client’s due diligence, sanction check in respect of the Client
  etc.). Article 6(1)(c) of the Regulation
• Lawful use of direct marketing tools (such as newsletters, invitations, notices) shall be based on legitimate interests of Sorainen to
  develop its business. Article 6(1)(f) of the Regulation
• Lawful preparation and analysis of statistics shall be based on legitimate interests of Sorainen to monitor and improve its business.
  Article 6(1)(f) of the Regulation

Categories of received and processed personal data

Sorainen can receive and process the following data:

• name, surname, date of birth, personal identification number, VAT number, including copies of identity documents;
• contact details (telephone, e-mail, address);
• position held, employer, contact details of the employer;
• details of authorisation (representation) including personal identification numbers and addresses of representatives, copies of
  documents;
• correspondence with Sorainen;
• data, provided in Forms for Anti-Money Laundering and International Sanctions purposes;
• other data collected or configured during the term of this Agreement with Sorainen depending on the nature of legal services
  provided (document signing, inquiry submission, entries in registers, marital status, etc);
• language;
• indications of political vulnerability and persona non grata.

Data processed by Sorainen can be received or accessed by:

• Sorainen representatives responsible for services provided to you, Sorainen staff providing services to these representatives;
• Third parties providing services to Sorainen including marketing companies, IT service providers, providers of information system
  support services, providers of business intelligence and business planning services, audit firms and others to the extent necessary for
  the exercise of such functions;
• State Tax Inspectorate;
• banks;
• other public authorities and entities to the extent necessary for the provision of services to you (exercise of legal claims);
• other data processors engaged by Sorainen and persons related to fulfilment of this Agreement;
• entities, assisting in exercise of Sorainen’s rights arising from the provisions of the Agreement (entities, providing debt collection
  and recovery services, consultants, courts, etc).

Data retention period

For the purposes of this Agreement and legal obligations, data shall be processed throughout the entire term of this Agreement and stored
for the statute of limitations period.

Data shall be processed for the purposes of direct marketing until you exercise your right to object to such data processing and in any event
no more than 2 years after your last interaction with Sorainen communications, ie opened the contents of the communications for review,
regardless of whether or not they used the information provided in the communications.

For the preparation and analysis of statistics data shall be processed for 5 years from the moment it was collected.

Rights of data subject

You are entitled to ask Sorainen to give access to your personal data and rectify or erase them or restrict processing as well as, where
applicable, enable to exercise the right to data portability and right to object. You can contact the Data Protection Officer of Sorainen for
matters related to the exercise of your rights.