# Privacy Policy ## 1. General This General Privacy Policy (“**Privacy Policy**”) describes what personal data of the data subject (“**you**” or “**data subject**”) Cactos Oy (3249847–2), Cactos Fleet Management Finland Oy (3296517–3), Cactos Energia Oy (3544975–6), Cactos Fund Management Oy (3544966–8), Cactos B.V (89387228–000055184006) and Cactos Netherlands B.V (89394534–000055190715) (“**Cactos**”, “**we**”, or “**the controller**”) processes as the controller, and how and for what purposes such personal data are processed. This Privacy Policy also describes how personal data is transferred to third parties and how you can exercise your rights related to the processing of personal data. This Privacy Policy applies to the processing of personal data in connection with Cactos’ marketing, sales and provision of services, as well as to personal data collected through online services such as cactos.com website and cookies. Cactos complies with applicable data protection legislation, including the General Data Protection Regulation (EU 2016/679) and the Finnish Data Protection Act (1050/2018). Terms not defined in this Privacy Policy shall be interpreted in accordance with applicable data protection legislation. ## 2. Contact Details for Data Processing Matters Cactos Oy (3249847–2) Satamaradankatu 1, 00510 Helsinki Mikael Lindqvist, General Counsel Email: mikael@cactos.fi ## 3. Groups of Data Subjects The personal data processing described in this Privacy Notice concerns the following groups of data subjects: - Cactos’ customers and partners, as well as their representatives and other contact persons; - Potential customers, their representatives, and other contact persons; - Users of Cactos’ website; ## 4. Types of Personal Data processed ### 4.1. Sales, Marketing and Partner Relations When engaging with partners, and when selling and marketing services to customers or potential customers, Cactos processes the following personal data: - Name; - Contact details (email address, postal address, and phone number); - Employment or service-related information (such as organization, position, and job title); - Other information related to the customer relationship (such as marketing prohibitions); ### 4.2. Provision of Services and Contractual Obligations When providing services to customers and fulfilling contractual obligations, Cactos processes the following personal data of customers or their representatives: - Name; - Contact details (phone number, postal address, email); - Employment or service-related information (such as organization, position, job title); - Information required by law for fulfilling know-your-customer obligations; ### 4.3. Website When using Cactos’ website, the following personal data is processed by Cactos: - Cookie data such as browser type, operating system, device model, IP address, location data, connection time, and duration; - Information provided through contact forms, such as name, email, phone number, company, and any other data you fill in. ## 5. Purpose and Legal Basis of Processing Personal Data ### 5.1. Sales, Marketing, and Partner Relations When Cactos engages with its partners and when selling and marketing its services, Cactos processes the above-specified personal data for the following purposes: - To initiate, enable, maintain, and develop potential customer or partner relationships; - For direct marketing, such as sending newsletters; - To develop the services offered by Cactos; Processing of the personal data for the purposes specified above is based on the data subject’s explicit consent, where specified in connection with the consent or otherwise on Cactos’ legitimate interest. ### 5.2. Provision of Services and Contractual Obligations When providing services to customers and fulfilling contractual obligations, Cactos processes the above-specified personal data for the following purposes: - To maintain, manage, and develop customer and partner relationships; - To process and deliver contract-based orders; - For contract management and invoicing; - To fulfil our legal obligations. ### 5.3. Website When you visit Cactos’ website, Cactos processes the above-specified personal data for the following purposes: - To provide, maintain, and develop the website; - To compile website usage statistics; - For targeted advertising; - To process contact requests submitted through the website. ## 6. Regular Data Sources Cactos collects personal data from the data subject themself as well as through the Cactos services used by the data subject. Cactos can receive personal data also from third parties in relation to the data subject, such as from our customer, from our cooperation partner, or from public sources, for example from the website of the organization you represent. ## 7. Processors and Recipients of Data Cactos uses external service providers in the processing of the personal data it collects, such as companies providing IT, consulting, and marketing services. ## 8. Transfers of Personal Data Outside the EU or EEA Cactos transfers personal data outside the EU or EEA, if it is necessary for the implementation of the purposes of personal data processing or for the technical maintenance of the data. ## 9. Data Retention Policies Cactos stores the personal data it processes only as long as they are necessary for those purposes for which the personal data are processed. ## 10. Policies of Personal Data Protection and Data Security Cactos follows good information management practices, a high duty of care, and effective data security measures in the processing of personal data. ## 11. Data Subject Rights The data subject has the rights described in this section in accordance with applicable data protection legislation. ### 11.1. Right to Access and Receive a Copy of Personal Data The data subject has the right to obtain confirmation as to whether or not personal data concerning them are being processed and the information required under applicable data protection legislation. ### 11.2. Right to Examination and Rectification The data subject shall have the right to access the personal data that is stored in the register. The data subject shall have the right to request the correction of inaccurate or imprecise personal data. ### 11.3. Right to Erasure The data subject has the right, in situations provided for under data protection legislation, to have its personal data erased. ### 11.4. Right to Restriction of Processing The data subject may request the controller to restrict the processing of their personal data. ### 11.5. Right to Object to the Processing The data subject has the right to object, on grounds relating to their particular situation, to the processing of their personal data where such processing is based on the controller’s legitimate interests. ### 11.6. Right to Data Portability The data subject has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used, and machine-readable format. ### 11.7. Right to Withdraw Consent Where the processing of personal data by Cactos is based on the data subject’s explicit consent, the data subject has the right to withdraw their consent. ### 11.8. Right to Lodge a Complaint with a Supervisory Authority The data subject has the right to lodge a complaint with a supervisory authority if they consider that the processing of their personal data infringes applicable data protection regulations. ## 12. Changes to Privacy Policy Cactos may update this Privacy Policy from time to time due to changes in data processing practices or applicable legislation. The most recent version of this Privacy Policy is always available on Cactos’s website.