Cooperative Arina Register of The Election of the Council of Representatives

COOPERATIVE ARINA REGISTER OF THE ELECTION OF THE COUNCIL OF REPRESENTATIVES PRIVACY NOTICE (from 1 January 2026 onwards)1. Data controllerOsuuskauppa ArinaPostal address: PL 823, 00088 S-RyhmäStreet address: Nuottasaarentie 1, 90400 OuluBusiness ID: 0187614-32. Contact details of the data protection officer tietosuojavastaava@sok.fi3. Person in charge of registry mattersarina.tietosuoja@sok.fi4. Name of the RegisterCooperative Arina Register of the Election of the Council of Representatives5. Purpose of personal data processingThe purpose of processing personal data is to conduct the election of the Arina Cooperative Society’s Council of Representatives in accordance with the rules of the cooperative and the election procedure.Based on the data in the register, candidate notifications for the election of the Council of Representatives are compiled, an election compass is produced, and the elections are organised. The cooperative may send candidate list / notification review and completion requests to authorised representatives, as well as invitations and reminders to use the election compass to candidates standing in the election of the cooperative’s Council of Representatives. The cooperative determines the information to be entered into the election compass service. Information provided in the candidate lists and notifications, as well as information submitted by the candidates for the election compass, is used to conduct the election of the cooperative’s Council of Representatives election and to present the candidates. Information submitted by the candidate for the election compass will be publicly available in the compass once the compass is published. The list of candidates will be sent to all co-op members who are entitled to vote, and will be published in media outlets to be determined by the cooperative.Members entitled to vote elect the persons to represent the co-op members and to exercise decision-making power in the Council of Representatives of their cooperative. This reflects the need of the cooperatives and S Group as a whole to encourage eligible members to participate in cooperative activities by voting in the statutory elections of the Council of Representatives. The personal data of voters is processed to verify their right to vote and record the votes cast.The election results will be published in accordance with the election rules once the S Election Committee has confirmed the results. To secure the transparency of the cooperative’s administration and the co-op members’ right to obtain information, the cooperative may keep the results of the elections on public display on the cooperative’s website until the results of the next elections are confirmed.The Council of Representatives’ election register includes a contact request register, which is used to manage enquiries from individuals interested in standing as candidates or forming a candidate list, and to support election-related communications.The data in the register will not be used for direct advertising, telemarketing or any other form of direct marketing, market surveys or opinion polls.6. Grounds for the processing of personal dataConsent: The individual has given their consent to the role or to being contacted.Legal obligation: Cooperatives Act, by-laws of the cooperative and election procedure7. The personal data processed We process the following information provided by agents and candidates:

Name
Home address and municipality of residence
Membership area
Membership number
Personal identity code
Preferred language for correspondence

In addition, we process the following information about the candidate:

Preferred name
Phone number
Email address
Candidate number
Candidate photo
Personal postal election ID

Concerning the agent ja deputy, we process the following information:

Preferred name
Phone number
Email address

Information provided by the candidate to the electoral machine:

candidate's electoral district
candidate number
candidate's municipality, village and/or place of residence
age
experience working in the representative body
candidate's motto, election theme or candidate description
other candidate's answers and comments to the electoral machine's questions
candidate's photo
candidate's website or Facebook page address

The following personal data is processed in relation to voters during the elections:

Name and cooperative membership number
Municipality of residence
Phone number, email or postal address
Personal identity code if the person entitled to vote is voting by post

8. Data source and description of data sources if data is collected from public sourcesCandidate notification agent and/or candidate, or voter.9. Recipients of personal data The personal data is processed in digital systems and services for the purposes specified in this privacy policy. We use external service partners in the provision of system and support services. Personal data is processed by our service partner Edita Prima Oy, which manages the election of the Council of Representatives as a whole.We ensure that our partners protect personal data sufficiently as required by law. We disclose data to the authorities within the limits permitted and required by valid legislation when responding to authorities’ requests for information.The candidate list and the information provided by the candidate in the election compass will be published through the communication channels chosen by the cooperative.The overall election results and the number of votes received by each candidate will be published online and through other communication channels determined by the cooperative.10. Transfer of personal data to third countries or international organisations and data protection safeguards usedWe do not transfer personal data to third countries outside the European Union or the European Economic Area or to international organisations.11. Period for storing personal data or criteria for determining the storage periodThe personal data referred to in this privacy policy is only stored for as long as, and to the extent that, it is needed, and the data controller will use it for actions related to the reported purposes of processing. Personal data submitted to the register will be deleted in a secure manner by the end of the cooperative’s election year.The cooperative’s published election result reports will stay publicly accessible until the results of the next election of the Council of Representatives are released. After that, the cooperative may keep the election result reports as historical data in the cooperative’s administrative register.12. Rights of the data subjectThe data subject has the following rights:

Right of access to personal data (through a request for information)
Right to rectification of data
Right to erasure
Right to restrict processing
Right to object
Right to withdraw consent
Right to data portability

If a data subject wishes to exercise their rights or to obtain further information about the processing of their personal data, they can contact the controller named in this privacy policy.A data subject also has the right to lodge a complaint with the supervisory authority if they deem that the processing of their personal data violates the applicable data protection regulations.13. Withdrawing consentThe individual has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out based on consent before its withdrawal.Consent may be withdrawn by contacting the data controller or the cooperative’s S Election Committee. If an individual withdraws their consent for the processing of personal data provided for the candidate notification, they can no longer act as a candidate or as an agent for the candidate notification in the election of the cooperative’s Council of Representatives. If the data subject withdraws their consent for the processing of personal data submitted for the election compass, their information will be removed from the election compass, but they may still stand as a candidate in the election.14. General description of technical and organisational safety measuresWe protect the personal data for the whole duration of its life cycle by using appropriate security measures.At S Group, we protect personal data with, among other tools, anticipatory risk management and security planning, means of data communication protection, the continuous maintenance of information systems and backups, and by using secure hardware facilities, access control and security systems. The granting and monitoring of user rights is a well-managed process. We regularly train our personnel involved in the processing of personal data. We select our subcontractors with care. We continuously update our internal practices and guidelines.If, despite all of our safeguards, we detect a data security breach concerning personal data, we will immediately begin investigating the matter and strive to prevent any damage. We will inform the relevant authorities and data subjects of any data security breaches in accordance with legislative requirements.Updated 01.2026