Privacy

StrongPoint privacy statement

• 1. Introduction
  •  1.1 StrongPoint is committed to protecting the privacy and securityof your personal information.
  •  1.2 This privacy policy describes how we collect and use personalinformation related to customers or clients, in accordance with the General Data Protection Regulation (GDPR).
•  2. What personal data do we process?
  The type of personal data that StrongPont processes about you may be:

o Basic personal information such as name, address, telephone number, email and demographic information

o User and web traffic information such as login ID, username, and IP address

o Financial information such as invoice-related information o Content you have uploaded or provided such as photos, comments, articles and videos
o Statistics that show how the users use our software and consume content we offer
o Information provided through job applications
o For the purposes mentioned in the section “Why do we process personal data”, StrongPoint does not process sensitive personal data about you.

3. How is personal data collected
o In general, StrongPoint collects personal data directly from you

or other persons linked to our customers. If the customera you work for purchases StrongPoint products or services via a StrongPoint partner company, we may collect information about you from the partner company.

o We will also use cookies and other tracking technologies when you use StrongPoint websites and interact with us via email, in order to optimise your experience of StrongPoint, our products and our sites. Please see our cookie policy for more information.

o In some cases, we may also collect information about you from other sources. These sources may be third-party data aggregators, StrongPoint’s marketing partners, public sources or third-party social networks.

4. Why do we process personal data?

This StrongPoint Privacy Statement applies when StrongPoint and its subsidiaries process your personal data for various purposes when you interact with us, such as:

Buy and deliver

•  Facilitate customer orders, agreements, payments
•  Offer services directly to you, such as e-learning,webinars, reports, etc.
•  Provide requested offers on products and servicesto Customers
•  Create and facilitate accounts for users of ourservicesSupport and improve

•  Improve and develop the quality, functionality and user experience of our products, services and StrongPoint sites
•  Offer customer support of our products and services
•  Operate user communities to educate and enable interaction between users and StrongPointSecurity

Detect, mitigate and prevent security threats and abuse, and perform maintenance and debugging

Marketing

•  Manage and send marketing preferences and content
•  Create interest profiles in order to promote relevant products and services (profiling)

Recruiting

•  Manage recruitment processes and process job applications
•  Evaluate submitted documentation, conduct interviews and call referencesInformation regarding how personal data is processed in one of our many services is outlined in the respective data processing agreement for that service. StrongPoint does in such cases act as a data processor and processes the data on behalf of and according to instructions given by the Customer. For more information regarding this, please contact customer support for that specific service.

5. What is the legal basis for processing your personal data?

We process data based on several legal grounds.

Agreement with you

We process your personal data on the basis of a legal binding contract with you. This will typically be when you apply for a job in StrongPoint or enter into a customer contract with us.

Your consent

StrongPoint might process your personal data based on consent. You will always be able to withdraw your consent, after you have given the consent.

Legitimate interest

StrongPoint has a legitimate interest when we process your data for security, support and improvement purposes, or when you act as customer contact/lead for our existing and potential customers, hereunder in customer support. Your personal data is processed from a business perspective in a manner that we believe does not conflict with your privacy rights or freedoms.

Further StrongPoint processes data based on legitimate interest if you are signing up for a webinar, downloading

reports or other content from our web pages, and using our StrongPoint communities. The legitimate interest is to provide you with correct content, hold webinars, do marketing and administrate your requests. Read more about how StrongPoint processes your personal data for marketing purposes based on legitimate interest and your rights when we process your personal data for such purposes under the section called “marketing” in this privacy statement.

6. How is your personal data shared?

Within the StrongPoint Group

As StrongPoint consists of many different subsidiaries, it is important for us that we provide the best possible overall experience for you. In order to maintain an overview and insight, StrongPoint may share your personal data across companies in the StrongPoint Group.

Outside of the StrongPoint Group

StrongPoint may also share your personal data with external third parties in the following contexts:

StrongPoint user communities

If you make a post, comment or similar on StrongPoint user communities or other forums on StrongPoint Sites, such information can be read and used by anyone with access to such forums. StrongPoint is not responsible for any information you submit on such forums or StrongPoint Sites.

Business partners

StrongPoint may share your personal information with our partners in the event this is legitimate from a business perspective and according to applicable privacy legislation.

Public authorities

The police and other authorities may request access to personal information from StrongPoint. In these cases, StrongPoint will only provide the data if there is a court order etc. to do so.

•  7. When do we use processors?
  StrongPoint uses processors to process personal data. These processors are typically vendors of cloud services or other IT hosting services.When using processors, StrongPoint will enter into a data processing agreement in order to safeguard your privacy rights. If processors are located outside the EU/EEA, StrongPoint ensures legal grounds for such international transfers on your behalf, hereunder by using the EU Model Clauses.You are always welcome to request an overview and more detailed information on StrongPoint’s processors. For how to contact StrongPoint, please see the last section of this statement.
•  8. How long is your data stored?
  StrongPoint will only store your personal information as long as required to perform our contractual obligations. When processing your personal data on other legal basis, such as legitimate interest, data is stored as long as necessary to fulfil the purpose of processing.Hence, your personal data may be subject to different retention policies based on the type of data and the purpose of collecting it. Here are some examples:
  •  When recruiting, StrongPoint will delete your personal information such as CV, application and other documents when the recruitment process is closed, typically maximum 6 months after application deadline, unless otherwise agreed upon with you.
  •  Another example is contact information stored for marketing purposes, including leads or prospects. Such personal data will be deleted no later than 24 months after the last registered activity.

For further information regarding deletion, feel free to contact StrongPoint (see contact information in the last section of this statement).

•  9. What are your rights? Basic rightsYou have the right to access your personal data by requesting an overview of the personal data we process about you and you may have a right to data portability. You also have the right to request that StrongPoint corrects inaccuracies in your personal data.Further, you have a right to request deletion of personal data, and to restrict or object to our processing of your personal data according to this Privacy Statement or other service-specific terms.Please use info@StrongPoint.com to file requests as mentioned in this section.Finally, you also have a right to file a complaint to the data protection authorities with regards to our processing of your personal data.
•  10. Marketing and profiling Legitimate interestWhen you interact with StrongPoint e.g. by visiting StrongPoint web pages, downloading content, attending webinars, and as part of using StrongPoint’s services, StrongPoint will be processing your personal data based on legitimate interest. One of StrongPoint’s legitimate interests is the processing of personal data for direct marketing purposes.StrongPoint uses your personal data to provide relevant content to you through direct marketing on social media platforms and emails, webpages or in a StrongPoint service, based on your preferences. The personal data processed are aggregated

details about you such as IP address, interests (where you have clicked, etc.), username and device. This is done through technologies like cookies and is called profiling. StrongPoint will also be able to combine this information with information about the customer relationship we may have with your company.

The purpose of the profiling is to deliver customized marketing to you, improve your user experience with our services / websites and deliver products that our customers are satisfied with. StrongPoint’s services are generally used as tools for work-related purposes, and your behaviour in these tools says little about your personal life. No sensitive data is processed. Your personal data is therefore processed from a business perspective in a way that we believe does not conflict with your freedoms and rights as an individual.

StrongPoint uses email as a tool to communicate marketing, however only if you have consented in accordance with national marketing legislation (if needed). If you have consented, you will always have the possibility to opt out as described below, or when you receive an email containing marketing.

Right to opt-out of marketing communications

You have the right to opt out of receiving marketing communications from StrongPoint and being subject to profiling. You can do this by either:

1. Following the instructions for opt-out in the relevant marketing communication
2. Changing preferences under the relevant edit account section if you have an account with StrongPoint
3. Contacting us via e-mail at info@StrongPoint.com

You will also always have the option to opt into/out of cookies

on a particular web page, through our cookie banner.

Please note that even if you opt out from receiving marketing communications, you may still receive administrative communications from StrongPoint, such as order confirmations and notifications necessary to manage your account or the services provided to customers.

11. How to contact us

StrongPoint is a European corporation, with legal entities, business processes, management structures and technical systems that cross borders.

All major decisions regarding privacy in StrongPoint are made at a corporate level by the StrongPoint Executive Management supervised by the Data Protection Officer (DPO). The controller responsible for the processing of your personal data is:

StrongPoint Group and its subsidiaries
StrongPoint Head Office: Slynga 10, 2005 Raelingen, Norway Telephone number: +47 934 03 254

We value your opinion. If you have any comments or questions about our Privacy Statement, or any privacy concerns, including regarding a possible breach of your privacy, please send them to info@StrongPoint.com or directly to your local StrongPoint company.

We will handle your requests or complaints confidentially. Our representative will contact you to address your concerns and outline the options regarding how these may be resolved. We aim to ensure that complaints are resolved in a timely and appropriate manner.

Cookie policy

What are cookies?
StrongPoint uses digital tracking technologies to collect information about the movement on our websites and how visitors interact with us. We do this in order to measure the performance of our websites and provide interesting content.

To identify a visitor throughout the visit, and recognizing visitors at consecutive visits, our websites leave a small file called a cookie in the visitor’s internet browser.

Cookies uniquely identify a particular browser or device. By using cookies StrongPoint can distinguish one visitor from another and treat them individually.

Why does StrongPoint use cookies?
o Anonymized statistics
Visiting website generates anonymized data that StrongPoint uses to improve StrongPoint websites. When using cookies in this manner we do not collect or process personal data. Instead, we use anonymized aggregated statistics to make better decisions.

More specific, the anonymized data describes the general activity and performance of StrongPoint websites. For instance, StrongPoint measures how many of our visitors read our cookie policy. If the statistics show that there are few readers, we will use this to assess whether to move the policy elsewhere on the website to make it more visible.

The anonymised data we collect includes:
Information about types of browser and device

•  Geographical information
•  User behaviour on the website, i.e. the journey from referencesite to landing page to exit page, if pages were scrolled and how far, if videos were played and for how long, which links were clicked.
•  Public company information

From this anonymized data we can measure the popularity of our content and decide which direction we should further develop our websites, both in terms of technical evolvement and content.

The anonymous data is not shared with any third party except our subcontractors when placing and managing cookies including Google Analytics. The anonymous data is subject to security and privacy standards according to applicable data protection legislation.

o Personal data
Depending on whether visitors grant us their permission – opt in/opt out according to the preferences on my profile pages – the use of cookies could also include processing of visitors personal data. More specific, with the permission of visitors, we could use visitors email addresses to tie their activities to their identity.

On this basis, StrongPoint could use personal data to register what the individual visitor is pursuing. These preferences are used to ensure that visitors are subject to relevant content on our websites. In short, to let StrongPoint personalise content.

The personal data we process in this regard includes:

o Email address, name and company
o Employers key information
o Likely interests based on registered movement on website and

subscription preferences.
Personal data is not shared with any third party except our subcontractors when placing and managing cookies including Salesforce and LinkedIn. All processing of personal data is subject to security and privacy standards according to applicable data protection legislation.

How can I avoid cookies?
By using the setting functionality in your browser visitors can block cookies. However, this will affect the performance of StrongPoint websites.
Visitors should go to the homepage of Microsoft Internet Explorer Google Chrome, Mozilla, Safari and Firefox to read up on how cookies can be managed in some of the most popular browsers

The most efficient way of managing these cookies is to turn to my profile pages where visitors can opt in and opt out to cookies that involve the processing of personal data.

On my profile pages, visitors may also edit their personal data, request deletion, determine whether they would like to sign up for StrongPoint newsletters or reach out to support or our privacy team with questions. In privacy matters, you can also reach out directly to info@StrongPoint.com.