WE CAN HELP YOU OPTIMIZE RELATIONSHIPS WITH YOUR CUSTOMERS

PRIVACY POLICY FOR EFFECTMANAGER AP S This Privacy Policy has been laid down by effectmanager ApS (”effectmanager”, ”we”, ”us” or ”our” in this Privacy Policy) and applies to effectmanager’s business.

1. About effectmanager

effectmanager has been in business since 2010, serving local and global retail suppliers. The effectmanager solution enhances the relationship between the Key Account Manager on the supplier side and the Procurement Officer on the retail chain side. If you have any questions relating to this Privacy Policy or the processing by effectmanager of personal data as part of the operation of our business, please contact us using the following contact details: effectmanager ApS Cedervej 2 DK-8462 Harlev J Danish CVR no. 35055320 Email: gdpr@effectmanager.com

2. We care about privacy and data protection

We consider responsible handling of personal data collected as part of the operation of our business to be essential to our business aim and reputation. This Privacy Policy explains how your personal data are collected and used if you are a customer of effectmanager and how you may obtain access to your own personal data.

3. What are personal data?

Personal data are any information concerning an identified or identifiable natural person. An identifiable natural person means a person who can be identified, directly or indirectly, in particular by reference to an identifier, e.g. a name, an identification number or one or more factors specific to the identity of a given person.

4. What types of personal data do we process about you and why?

The data we collect about you will be used for various purposes in connection with your customer or supplier relationship and the operation of effectmanager’s business. The data collected may vary depending on whether you are a customer, supplier or business partner, but will generally be data relating to customer management and supplier management, information used to improve our website and data relating to effectmanager’s rights and obligations. Any failure by you to provide personal data may mean that we at effectmanager will be unable to fulfil our obligations relating to your customer or supplier relationship. effectmanager collects and processes general personal data only in connection with your customer or supplier relationship with effectmanager. effectmanager does not collect and process any special categories of personal data relating to you. effectmanager will typically collect the following data (the list is not exhaustive):

• Data about our customers: Data that you provide to us when becoming a customer of effectmanager, including contact details (name, email address, job title and address of the enterprise), your marketing or communication preferences, and data that you provide to us when contacting us to ask a question or to report a problem or generally as part of your customer relationship with effectmanager.

• Data about our suppliers and business partners: Data that you provide to us in connection with the conclusion of a supply or cooperation agreement, including contact details (workplace, job title, first name, middle name(s), last name, address, telephone number and email address), data that you provide to us on your marketing or communication preferences, and data that you provide to us when contacting us to ask a question or to report a problem or generally as part of our cooperative relations.

• Data that we collect and process when you visit our website: Data on the way you navigate to and between our websites and the resources you access, information about your computer, device and browser, including in some instances your IP address, browser type, and other hardware and software information. If you access our website from a mobile device, we may also collect the unique identification number of your device.

5. Use of your personal data

effectmanager processes your personal data for the purposes set out below. Please note that not all the specified purposes, categories of data, recipients of data or types of processing of data will in all instances apply to you. effectmanager processes your personal data solely to the extent necessary in connection with your customer or supplier relationship (in each case taking any interests into account) or according to current law.

• Customer relationship management: Creation and management of your customer relationship with effectmanager as part of the operation of the effectmanager business, including the maintenance of our CRM register containing information about our contact persons for our customers, invoicing, debt collection, marketing, statistics, etc.

• Supplier relationship and cooperative relations management: effectmanager processes your personal data as part of the management of supplier relationships and/or cooperative relations where you are a supplier or business partner or a contact person of a supplier or business partner with which effectmanager has business relations as part of the operation of our business, including the maintenance of our CRM register containing information about our contact persons for our suppliers and business partners.

• Operation and maintenance of our websites: The provision of our online services at our websites, including to support the ongoing evaluation and improvement of our websites.

• Compliance with current laws and regulations: The compliance with laws and regulations to which effectmanager is subject in connection with the operation of the business or to fulfil various duties of reporting or disclosure under current laws and regulations imposed on effectmanager. effectmanager does not use your personal data to make decisions based solely on automatic processing, including profiling.

effectmanager endeavours to ensure that all personal data processed by us are accurate and up to date. As a result, we request that you always inform us of any change in your data (e.g. any change of address or payment details) to enable us to ensure that the data are always accurate and up to date.

6. Legal basis for the processing of your personal data

effectmanager generally processes the data about you on one of the following bases: (1) You have given your consent to the processing of your personal data for one or more specific purposes (Article 6(1)(a) of the GDPR), (2) the conclusion or performance of your agreement with effectmanager (Article 6(1)(b) of the GDPR), (3) the legitimate interests pursued by effectmanager, i.e. the purposes described above, (Article 6(1)(f) of the GDPR), and/or (4) compliance with a legal obligation to which effectmanager is subject (Article 6(1)(c) of the GDPR). Moreover, there may be situations in which we process your personal data for the purposes of the legitimate interests pursued by a third party in connection with the purposes described above, except where such interests are overridden by your interests (Article 6(1)(f) of the GDPR).

7. Sharing of personal data

effectmanager will disclose data only to the extent necessary as part of the operation of our business. Furthermore, effectmanager may disclose your personal data and/or make them available to other suppliers and/or service providers in connection with the general operation of our business, e.g. in connection with the external administration of our IT systems, analysis tasks, marketing tasks, debt collection, credit rating, audit, legal assistance, etc. effectmanager endeavours, wherever possible, to restrict the disclosure of personal data in a form enabling them to be attributed to a natural person in order to limit the instances of disclosure of data that could be attributed to you personally. effectmanager does not disclose your personal data unless such disclosure is necessary in order to perform our activities or fulfil your needs. Your personal data may in some cases be transferred to and processed in a country outside the EU/EEA area by our service providers. For the ongoing protection of your personal data, we will take appropriate steps to ensure that transfers of personal data are in accordance with applicable law and carefully managed to protect your privacy rights and interests and that transfers are limited to countries which are recognised as providing an adequate level of legal protection or where we can be satisfied that alternative arrangements are in place to protect your privacy rights (i.e. Privacy Shield Frameworks, EU Commission-approved standard contractual data protection clauses, etc.). Information about the countries to which we will, where appropriate, transfer your personal data and the safeguards implemented can be obtained upon request.

8. Data integrity and data protection

Personal data are retained for no longer than is necessary in relation to the purpose for which they were collected, unless retention is necessary to comply with national statutory requirements, including statutory retention periods relating to EUsubsidy control, bookkeeping, etc. effectmanager’s policy is to protect personal data by taking adequate technical and organisational security measures. Once your personal data are no longer needed, we will ensure that they are erased in a secure manner.

9. Your rights

You are entitled at all times to exercise your rights under the data protection legislation in force at any time. However, please note that we will not always be required to fulfil these rights in whole or in part. For example, you are not entitled to erasure of your personal data retained by effectmanager if the law obliges effectmanager to store such data.

• Your right of access: You may e.g. request access to the personal data held by us and information about e.g. the purpose(s) for which personal data are used and to whom they are disclosed.

• Your right to object: You may object to the processing of your personal data, including object to automated decisions and profiling or to the use of your personal data for direct marketing.

• Your right to rectification: You may request correction of any incorrect information about yourself.

• Your right to restrict processing and erasure: You may request the restriction or erasure of information about yourself if the relevant conditions are met.

• Your right to data portability: Your right to data portability is applicable to information you have provided to us if the processing is based on your consent or a contract, and such portability is technically possible.

In addition, you have the right to withdraw your consent to processing of your personal data in case our processing is based on your consent. If you withdraw your consent or request restriction of our processing of your personal data, it may mean that we will no longer be able to manage our agreement with you. If you wish to exercise one or more of your rights, please contact us at gdpr@effectmanager.com. Your request will be processed in accordance with the data protection legislation in force at any time. Any complaint about the processing by effectmanager of your personal data should be filed with: The Danish Data Protection Agency Borgergade 28, 5th floor DK-1300 Copenhagen K Email: dt@datatilsynet.dk

10. Updates

effectmanager will evaluate and update this Privacy Policy from time to time. We would therefore recommend that you regularly check this Privacy Policy for any changes which may be relevant for the processing of your personal data.