This Privacy Notice describes how Nipromec Oy Ltd (1810009-3,hereinafter “Nipromec”) and its parent company Vulcain Engineering Group(ECG), together with its subsidiaries, process the personal data of jobapplicants in accordance with the EU General Data Protection Regulation (GDPR)and other applicable data protection legislation.

Nipromec Oy Ltd (on behalf of its subsidiaries)

Nortamonkatu 18

26100 Rauma

Tel. +358 10 2193000

info@nipromec.com

Nipromec Oy Ltd

Email: info@nipromec.com

Telephone: +358 10 219 3000

Nipromec processes the personal data of its employees for thefollowing purposes:

• The receipt, processing andstorage of job applications
• The assessment of applicants’suitability
• Communication with applicants
• The allocation of theapplication to other positions corresponding to the applicant’s competencies
• Where the applicant is selectedfor the position, for measures related to the establishment of the employmentrelationship and recruitment

We process personal data on the basis ofour legitimate interests, such as the processing of applications, theassessment of the applicant’s suitability, and the retention of applicationsfor a period of 12 months following the conclusion of the recruitment process.Any contact with a referee is carried out on the basis of your consent..

We process the following categoriesof personal data concerning job applicants:

• Personal data: name, date ofbirth (if provided by the applicant)
• Contact details: telephonenumber, email address, home address (if provided)
• Education and qualificationdata: degrees, courses, certifications, language skills
• Employment history andprofessional competence: work experience, areas of responsibility, professionalskills
• Application documents: CV,cover letter, portfolio, and other attachments provided by the applicant
• Referee information: name,contact details, and relationship to the applicant
• Other information provided bythe applicant during the recruitment process
• Information obtained from security clearance checks, where such checksare necessary in individual cases and within the limits permitted by law

As a rule, personal data are obtaineddirectly from the job applicant. Data is received or requested from otherparties only with the applicant’s consent, unless otherwise provided by law.

Where necessary, from third parties,such as background check service providers (within the limits permitted by lawand in individual cases).

Personal data is not disclosed to third parties unnecessarily.

We disclose personal data to the following recipients:

• Nipromec’s service providers(e.g. IT, recruitment, payroll or cloud service providers)
• public authorities, whererequired by law

Nipromec undertakes to implement appropriate measures with allprocessors, including the conclusion of data processing agreements.

Access to personal data is restricted to those persons who areauthorised to process such data on the basis of their duties.

Transfersoutside the EU/EEA

As a rule, we donot transfer personal data outside the European Union (EU) or the EuropeanEconomic Area (EEA). Where, in an individual case, personal data is transferredoutside the EU or EEA, we ensure that an adequate level of data protection is maintainedby applying appropriate safeguards required under applicable data protectionlegislation (e.g. standard contractual clauses adopted by the EuropeanCommission).

Personal data relating to jobapplicants is retained for a period of 12 months from the conclusion of therecruitment process.

As a rule, Nipromec does not use automated decision-making.

The data subjecthas the right, with respect to their own personal data, to:

• have access the data
• rectification of the data
• erasure of the data
• restriction of processing
• transfer data from one systemto another
• object to processing
• withdraw consent at any time
• lodge a complaint with theOffice of the Data Protection Ombudsman (Finland).

Requestssubmitted by the data subject to Nipromec will be processed within one month.Requests can be sent using the contact details mentioned in section 2.

Nipromec applies the following technical and organisational securitymeasures:

• restriction of access rights sothat personal data are processed only by those persons who require such datafor the performance of their duties
• encrypted connections andpassword policies
• secure server and cloudservices
• logs and monitoring
• staff training
• contractual obligations ofsubcontractors

Nipromec mayupdate this Privacy Notice as its operations and legislation evolve. The latestversion is available on Nipromec’s website or from the person responsible forregister matters.