PRIVACY AND COOKIE POLICY CINNUX BV

This privacy and cookie declaration was most recently updated on 9th April 2020.

We, at Cinnux B.V. (hereinafter referred to as: Cinnux) process personal data. This data is privacy-sensitive and can be linked to you as a person. Your privacy is of great importance to us. We therefore meet the requirements of the privacy and cookie legislation, the General Data Protection Regulation (GDPR) and the Telecommunications Act. This means that your data is safe with us and we handle your data with great care.

In this privacy and cookie policy we explain what we do with the information we collect about you when you use our services or our website.

If you have any questions or want to know exactly what information we collect about you, please contact us via the contact information at the bottom of this policy.

Processing your personal data

Whenever you use our app, website or our services, we collect different types of personal information from you. For each purpose, we indicate what information we collect from you, what the purpose is and the purpose for which it is being used, and what the period of data storage is.

Contact

There are several ways you can get in touch with us and ask questions or make enquiries. In addition, you can always give us your feedback. We will process your personal data so that we can answer your questions or suggest an offer to you, for example. For this purpose, we use your IP address, contact details and the details you enter as the content of a message. We need this information to process your contact request and/or your feedback. We will retain this information for up to three months after we are certain that you are satisfied with our response. This means that we can easily retrieve the information if you have any follow-up questions. It also allows us to train our employees to become even better.

Emailing newsletters

We will only send you a newsletter if we have your permission. We will use your email address if you give us permission to add you to our list of subscribers. We also ask for your name, so we can make our news items a little more personal. The (weekly/monthly) newsletter includes news, tips and information about our products and services. You can unsubscribe from our newsletter at any time. Every newsletter contains an unsubscribe link, so that you can always withdraw your permission in an accessible way. We keep this information until you unsubscribe.

Recruitment and staff selection

If you want, you can apply for a job with us. Whenever you apply for a job with us, we collect your name and address, gender, date and country of birth, contact details, curriculum vitae, the contents of your cover letter and motivation, and other information that is part of your

Page 1 of 5

application, such as your availability or any references. We use this information to process your application and – if you come to work for us – to fulfil your employment contract.

Note: A social media and Google survey may be part of the application procedure. This is necessary to ensure that our image is maintained when hiring new staff. For this purpose, we will search your name on Google and your profile on various social media. This, of course, insofar as these profiles are public. We will not ask you to grant us access to a protected social media page or to make a connection with us. The results of the research will be discussed with you.

In addition to a social media and Google survey, an assessment may also be part of the application process. For certain job functions, it is absolutely essential that we can guarantee that applicants have specific qualities that are important for the relevant position. Should an assessment be necessary, we will inform you prior to the application process about how we will process your information in this respect.

We will keep the application information for a maximum of four weeks after the position has been filled. We will retain this information so that we can contact you in the event that the position becomes vacant again within the probationary period. If we are currently unable to offer you a position, but expect a suitable position to become available to us in the near future, we may – with your permission – retain your application details for a further year. You can withdraw this consent at any time by sending us an email.

If you join us, we will keep your application details in our staff records. These records will be kept as long as they are needed for the employment contract.

Advertising

We would like to send you advertising about special offers and new products or services. We do this by email and/or advertisements placed on Facebook, Google or other platforms. You can object to this advertising at any time. Each statement contains an unsubscribe link.

Processing of personal data for third parties

We offer an app for self-development purposes of employees. In this app, we offer, amongst other things, an information section, a chat solution and a chat environment. We maintain this app and offer technical services for the use of the app in various ways. For example, a management environment which is setup with permission for us to create/add users. This is what we do as an IT service provider/app vendor on behalf of a company/organisation. As Cinnux, we are not (ultimately) responsible for the protection of the personal data that our customers process. That is why we make good and appropriate agreements with the data processor in a processing agreement. In this agreement we set out which data we process on behalf of the controller and how we will protect this data processing.

However, it is possible that we may use your data for the purpose of scientific research or statistical purposes. In that case we always take extra measures to guarantee your privacy as much as possible. For example, it is irrelevant for us to know who is involved if we use your data for statistical purposes. We therefore ensure that personal data is pseudonymised or, if possible, even anonymised.

Page 2 of 5

Forwarding of information to other companies or institutions

It may happen that we provide your personal information to other companies or institutions because:

  • we have asked them to process specific data;
  • the disclosure is essential for the fulfilment of the contractual agreement with you;
  • you give your consent for this;
  • we have a justified right to do so;
  • we are legally required to do so (for example, if the police ask for this in the event of a

    suspicion of a crime).

    We will also pass on your personal data if we believe this is necessary for the preservation of this app/software and/or service. For example, in cases where we suspect violations of our terms and conditions or other illegal activities. It is also possible that we may have to transfer your personal data in connection with a merger, bankruptcy or reorganisation, for example. If this is the case, your personal data will only be passed on to third parties subject to this privacy policy.

    The following third parties will process your personal data:

  • our cookie service providers (see below);
  • our hosting company;
  • our software developers;
  • our IT service providers;
  • our payment service provider
  • our feedback and communication platform.

    Cookies

    We also use cookies and other similar technologies. We only use these technologies if this is necessary for the functioning of our website. We are always transparent about which technologies we use. In the document below we inform you about the use of cookies and other related technologies on our website.

    The use of cookies

    A cookie is a simple small file sent with pages of this website and stored by your browser on your hard drive of your computer or other device. The information stored in this file can be sent back to our servers or those of the relevant third parties on your next visit. We place these cookies ourselves or enable third parties to do so.

    Other technologies that are used are for example scripts. This is a piece of program code that is used to make our website function properly and make it interactive. This code is executed on our server, or on your device. For convenience, all technologies are hereinafter referred to as “cookies”.

    Cookies are also placed by third parties enabled by us.

Page 3 of 5

Permission

When you visit our website for the first time, we show a pop-up with an explanation about cookies. Once you click ‘agree’ you give us permission to use all cookies and plugins as described in the pop-up and this cookie statement. You can deactivate the placing of cookies via your browser; however, you must take into account that our website may no longer function properly.

Third parties

We have made agreements with other companies that place cookies. However, we cannot guarantee that these third parties will handle your personal data in a reliable or secure manner. Parties such as Google can be regarded as independent data controllers as defined by the General Data Protection Regulation (GDPR). We recommend that you read the privacy policies of these companies.

Analytical cookies

We use analytical cookies to ensure that our website meets the wishes of our visitors as closely as possible. We use analytical cookies to gain insight into the use of our website.

• Google Analytics
Purpose
We use Google Analytics cookies on our website. Google helps us gain insight into how our website is used. They provide us with reports about the use of the website and provide us with information about the effectiveness of our campaigns.

page4image970896304

Source and data storage Names

Distributing

Google shares anonymous data with third parties. For more information, please consult Google’s Privacy Policy.

duration

This cookie is set by Google and is stored for a maximum of 2 years.

_gid, _gat, _ga

Google is based in the United States and is Privacy Shield certified, which means that the transfer of personal data to these parties outside the EU is permitted.

Enabling and disabling cookies

You can disable the placement of cookies via your browser, but some options on our website will then no longer work properly. For more information about enabling, disabling and deleting cookies, please refer to the instructions and/or use your browser’s Help function”.

Security

The security of personal data is very important to us. We take appropriate security measures to limit misuse and unauthorised access to personal data. For example, we ensure that only essential individuals have access to your data, that access to the data is protected and that our security measures are checked regularly.

Page 4 of 5

Third party websites

This privacy policy does not apply to websites of third parties that are linked to our website by means of a hyperlink. We cannot guarantee that these third parties will handle your personal data in a confidential or secure manner. We advise you to read the privacy policies of these websites before using them.

Updating this Privacy Policy

We reserve the right to make any modifications to this privacy policy. We recommend that you regularly check this privacy policy so that you are aware of these updates.

Accessing and changing your data

If you have any questions or want to know what personal information, we hold about you, feel free to contact us. You can contact us using the contact information below. You have the following rights:
• receive an explanation of what personal information we have and what we do with it,

• access to the details of the personal information we have, • have errors corrected,
• have your personal data deleted,
• withdraw the consent, and

• object to a particular use.

We may ask you to provide us with some identification when you make your request. For this purpose, we request personal information so that we can ensure that you are the right person to whom the personal information belongs. Depending on the information we have about you, we may ask you to do this by sending us a valid proof of identity. It is important that you protect your BSN and passport photo.

In general, we will respond to your request within 30 days. However, this time frame may be extended for reasons relating to the specific rights of the persons in question or the complexity of the request. If we extend this period, we will inform you in a timely manner.

Submitting a complaint

If you feel that we are not helping you appropriately, you have the right to file a complaint with the competent privacy authority. In the Netherlands, this is referred to as the Personal Data Authority.

Contact details

Cinnux B.V. Boterdiep 69-1 9712 LK Groningen

info@cinnux.com KVK 75979683

Page 5 of 5