Draw Register for the Elections of the Council of Representatives for the Cooperative Arina

DRAW REGISTER FOR THE ELECTIONS OF THE COUNCIL OF REPRESENTATIVES FOR THE COOPERATIVE ARINAPRIVACY NOTICE (from 1 January 2026 onwards)General Data Protection Regulation (EU) 2016/679, Articles 12, 13, 14 and 19Data controllerOsuuskauppa ArinaPostal address: PL 823, 00088 S-RyhmäStreet address: Nuottasaarentie 1, 90400 OuluBusiness ID: 0187614-3Contact details of the data protection officer tietosuojavastaava@sok.fiPerson in charge of registry mattersarina.tietosuoja@sok.fiName of the registerDraw register for the election of the Council of Representatives for Cooperative Arina.Purpose of personal data processingData about voters in the elections of the council for Cooperative Arina 2026 will be used once for arranging a draw among all individual members of Cooperative Arina who used their right to vote. The winners are drawn from the Cooperative Arina election database by Edita Prima Oy, the provider responsible for the election service. The draw is organised by technical means so that election secrecy is maintained, and votes cannot be associated with a specific cast vote.Voters' details will be used to arrange the draw, contact the winner and deliver the prize to the winner.The draw is organised by Cooperative Arina.If the voter does not want his or her details to be used in the draw, the voter can send his or her name and cooperative membership number to vaalit.arina@sok.fi no later than 23th of April 2026. In this case, the voter cannot participate in the draw.The name and municipality of residence of the winner can be published if the winner gives his or her consent, which is requested separately after the draw.Grounds for the processing of personal dataPersonal data is processed based on the following grounds:Article 6.1 (a) ConsentThe publication of the winner's name and municipality of residence is based on the winner's consent. Article 6.1 (f) Legitimate interest The processing of personal data for the purpose of organising the draw, contacting the winner and delivering the prize to the winner is based on a legitimate interest.Description of the data controller’s legitimate interestMembers entitled to vote elect the persons to represent the co-op members and to exercise decision-making power in the Council of Representatives of their cooperative. This reflects the need of the cooperatives and S Group as a whole to encourage eligible members to participate in cooperative activities by voting in the statutory elections of the Council of Representatives. The purpose of the draw is also to attract interest to the elections of the Council of Representatives.The personal data processed

Name and cooperative membership number
Municipality of residence
Phone number, email or postal address

Processed personal data groupsname and contact information Data source and description of data sources if data is collected from public sourcesThe information required for the delivery of the prize and the consent for the publication of the winner is obtained from the winner of the draw.The information required for the announcement of the reward is obtained from the database for the election.Recipients of personal data The personal data is processed in digital systems and services for the purposes specified in this privacy policy. We use external service partners in the provision of system and support services. Personal data can be transferred to the service providers used insofar as the service providers participate in the implementation of measures within the framework of the relevant assignment.We ensure that our partners protect personal data sufficiently as required by law. We do not disclose any data stored in the register to third parties, except for the disclosure of data to the authorities within the limits permitted and obligated by valid legislation, when responding to the authorities’ data requests, for example.Transfer of personal data to third countries or international organisations and data protection safeguards used We do not transfer personal data to third countries outside the European Union or the European Economic Area or to international organisations.Period for storing personal data or criteria for determining the storage periodThe personal data referred to in this privacy policy is only stored for as long as, and to the extent that, it is needed, and the data controller will use it for actions related to the reported purposes of processing. Personal data of the winner that has been collected in the draw register for the elections of the council will be securely destroyed after the prize has been delivered, not later than three months after all prizes have been delivered.Rights of the data subjectIf the voter does not want his or her details to be used for the draw, the voter can send his or her name and cooperative membership number to vaalit.arina@sok.fi no later than 23th of April 2026. In this case, the voter cannot participate in the draw.The data subject also has the following rights:

Right of access to personal data (through a request for information)
Right to rectification of data
Right to erasure
Right to restrict processing
Right to object
Right to withdraw consent
Right to data portability

If a data subject wishes to exercise these rights or to obtain further information about the processing of their personal data, they can contact the controller named in this privacy policy.A data subject also has the right to lodge a complaint with the supervisory authority if they deem that the processing of their personal data violates the applicable data protection regulations.Withdrawing consentData subjects have the right to withdraw the consent they have given to the processing of personal data. The withdrawal of consent has no effect on the lawfulness of the processing of personal data based on consent conducted prior to the withdrawal.Consent can be withdrawn by contacting vaalit.arina@sok.fi.Effects of not providing personal data on an agreementThe processing of personal data is not based on an agreement.Significant information related to automated decision-making or profilingNo automated decision-making or profiling is associated with the personal data processing.Impact of the processing of personal data and a general description of technical and organisational security measuresWe diligently protect personal data throughout its lifecycle by employing the appropriate data protection and information security measures.At S Group, we protect personal data with, among other tools, anticipatory risk management and security planning, means of data communication protection, the continuous maintenance of information systems and backups, and by using secure hardware facilities, access control and security systems. After initial processing, hard copies containing personal data are stored in locked and fire-safe storage facilities. The granting and monitoring of user rights is a well-managed process. We regularly provide training for our personnel who participate in the processing of personal data, and ensure that our partners’ personnel also understand the confidential nature of personal data and the importance of secure processing. We select our subcontractors with care. We continuously update our internal practices and guidelines.If, despite all of our safeguards, personal data falls into the wrong hands, it is possible that the identity will be stolen or that the personal data will be misused. If we notice that such an event has happened, we will immediately begin an investigation and will make efforts to prevent any damage from occurring as a result. We will inform the relevant authorities and data subjects of any information security breaches in accordance with legislative requirements. Updated 01.2026

Draw Register for the Elections of the Council of Representatives for Arina