Privacy policy for Facility Waste Management

PRIVACY NOTICE

of SENSONEO j. s. a. for Facility Waste Management

(effective as of September 24, 2026)

1. THE PURPOSE OF THIS NOTICE. THE DATA CONTROLLER

What is the purpose of this privacy notice?

This privacy notice (the Notice) is intended to help Facility Operators, their representatives, portal users, and other private individuals to understand how SENSONEO j. s. a., ID 50 746 057 (the Company) processes personal data of private individuals in connection with the Facility Waste Management platform (Facility).

The Notice is addressed to any private individual whose personal data the Company processes through Facility: representatives of Facility Operators, portal users such as organization administrators, building managers, tenants and tenant viewers, holders of weighing cards, and individuals who receive automated reports generated by the platform, whether or not they have their own account or direct relationship with the Company.

The Notice shall be read carefully and in its entirety. The Company strived to ensure that the Notice contains complete and comprehensible information about the processing activities regarding your personal data. However, if you have any questions or if you are not sure about any aspects of processing of your personal data by the Company, please, do not hesitate to contact us at the following email address: security@sensoneo.com or phone number: +421 947 924 767.

Who is the data controller?

The Company’s role differs by category of data. For portal-user account data that the Company creates and manages to operate Facility (login credentials, roles, access logs), the data controller with respect to the personal data is the Company (i.e., SENSONEO j. s. a. with its registered seat at Kollárova 27, 841 06 Bratislava, the Slovak Republic, ID 50 746 057). For data that a Facility Operator uploads or generates about its own tenants, staff or visitors — card holder data, weighing transaction records, and report-recipient email addresses — the Company processes such data as a data processor on behalf of the Facility Operator, who is the controller for that data. The relationship between the Company and each Facility Operator is governed by a data processing agreement.

The Company needs to process your personal data in order to fulfil its contractual and other legal obligations. At the same time, the Company may need to process your personal data to protect its legitimate interests, including operating its business activities in appropriate manner and to protect its legal rights and interests.

It is the objective of the Company to process all personal data in line with the applicable data protection laws, particularly (i) the Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of Personal data and on the free movement of such data, and repealing Directive 95/46/EC, (ii) Slovak Act No: 18/2018 Coll. on Protection of Personal Data and On Amendment and Supplement of Certain Acts (to the extent applicable), and (iii), given that Facility is used internationally, the mandatory data protection law of the country in which the Facility Operator or data subject is located, to the extent applicable. It is also the objective of the Company to ensure that all processing operations are conducted in a secure way only to the extent necessary for achieving purpose of the processing as described below.

What could happen if personal data are not provided to the Company?

The Company has numerous contractual and legal obligations towards Facility Operators, portal users and other individuals connected with Facility, and towards the public authorities or other public bodies. In order to fulfil these obligations, but also in order to ensure protection of the Company’s interests, it is necessary to process your personal data.

If your personal data are not provided to the Company, the Company may not be able to fulfil its obligations, which may result in the Company not being able to grant portal access, issue a weighing card, or deliver an automated report to the intended recipient.

2. PERSONAL DATA. PROCESSING OPERATIONS

Where does your personal data come from?

The Company collects the personal data directly from you or from your employer or the Facility Operator who provided your personal data to the Company during the business relationship (for example, when a Facility Operator assigns you a weighing card, adds you as a report recipient, or registers you as a portal user). The Company may also receive some of the personal data from public authorities in relation to their queries or investigations. It may be also the case that the Company will process personal data which are publicly available, particularly with respect to contact data which include also reference to a particular person. Please, also be aware that the Company may create other data about you, which could qualify as personal data — including weighing transaction records generated automatically when a weighing card is used — and the Company will use and store also such personal data.

What kind of personal data are processed by the Company?

Unless a particular situation requires otherwise, the personal data that the Company will be processing may include:

(a) identification and characteristic information: such as name, surname, details of your employer and your job position; and

(b) contact data: such as (business) address, (business) phone number, (business) e-mail address;

(c) portal account data: such as your role (organization administrator, building manager, tenant, tenant viewer), login credentials and access logs, where you are a registered user of the Facility portal;

(d) card holder data: such as your name and other identifying details linked to a weighing card, where a Facility Operator assigns a card to you as a named individual rather than to a location or bin;

(e) weighing transaction records: such as the date, time, weight and location of a weighing event, where such records are linked to a card assigned to you; and

(f) report-recipient data: such as your email address, where a Facility Operator has configured you to receive automated reports generated by Facility, even if you have no portal account or other direct relationship with the Company.

The Company will not seek any other personal data, but the Company may not exclude that other personal data will become available to the Company in the context of business relationship with its business partner or in the operation of Facility. The Company will adopt measures to prevent processing of such additional personal data.

What are the purposes for processing of your personal data by the Company?

The Company processes personal data of its business partners, representative(s) of business partners, business partner’s contact persons, Facility Operators, and portal users, card holders and report recipients connected with Facility, to fulfil its contractual obligations, to provide and maintain the Facility platform and portal accounts, to issue and manage weighing cards and record weighing transactions, and to generate and deliver automated reports to the recipients configured by the Facility Operator.

Such personal data may also be processed for purposes of legitimate interests of the Company or of the Facility Operator, aimed at ensuring effective and secure conducting of business activities related to Facility and protecting the rights and legal interests of the Company or the Facility Operator.

What is the legal base for the processing operations?

Pursuant to applicable data protection laws, personal data may only be processed based on adequate legal base. The Company processes personal data based on the following legal bases:

(a) performance of a contract

Data processing by the Company is necessary for the Company to be able to fulfil its obligations deriving from the contract concluded with you, with your employer, or with the Facility Operator.

(b) fulfilment of legal obligation

Data processing by the Company is necessary for the Company to be able to comply with its obligations prescribed in law, including the transmission of data to authorities.

(c) legitimate interest of the Company or of the Facility Operator, which includes (i) making of or defending against claims, (ii) proving compliance with applicable laws (such as upon requests of supervisory authorities), and (iii), in particular for report-recipient data, the Facility Operator’s interest in the automated delivery of reports on its waste management activities to individuals it has designated to receive them, even where no direct relationship or contract exists between such individuals and the Company.

In cases where data processing by the Company is based on the legitimate interest of the Company or of the Facility Operator, the Company has, upon thorough deliberation, arrived at the conclusion that your interests or fundamental rights and freedoms that require protection of personal data do not override such legitimate interest.

For how long will your personal data be processed?

The Company will not store or process personal data for a period longer than necessary to fulfil the purpose of the processing or as prescribed or allowed by applicable laws. Accordingly, when the purpose has been fulfilled in relation to a specific type of personal data, the Company will stop using the personal data for that purpose and, if the same data is not relevant for any other purpose, delete the relevant personal data as soon as reasonably possible.

The basic rule is that the Company will store and process your personal data throughout the duration of the contract with the Facility Operator and for a period of ten years after its termination unless the applicable laws or the data processing agreement with the Facility Operator provide for a different period. To the extent possible, the Company will anonymize your personal data for their use for statistical purposes.

3. YOUR RIGHTS

What does the Company do to protect your personal data?

The Company ensures that the principles of protection of personal data laid down by the applicable data protection laws are strictly followed and adhered to. Particularly, the Company ensures that (i) only those personal data are processed which are necessary for the purpose of processing, (ii) personal data are processed only for purpose for which the data were collected or (to the extent permitted by the applicable data protection laws) for purpose, which is compatible with the original purpose, and (iii) the personal data are processed no longer than necessary.

The personal data will be stored and processed manually and also automatically with the help of electronic devices.

The Company has taken appropriate technical, administrative, physical and procedural protection measures for the protection of personal data in their use and possession in order to ensure that such personal data are protected against misuse, unauthorized access, publication, corruption, modification and destruction.

What are your rights regarding processing of your personal data?

The applicable data protection laws confer on you several rights when it comes to processing of your personal data. Details of these rights are outlined below. Be aware that the rights below could be qualified in certain circumstances (e.g., in case of legal proceedings regarding you). Please, do not hesitate to contact the Company, if you have any questions regarding your rights.

Right to be informed

As a data subject you have a right to be informed about all important aspects of the processing operations regarding your personal data unless the applicable data protection laws provide otherwise. The Company fulfils its obligation to inform you, primarily, through this Notice. Though, from time to time, the Company may distribute further information or update this Notice to ensure that you have always correct and up to date information about the processing operations.

Right to access and rectification

You have the right to request access to the personal data relating to you. This includes the right to be informed whether personal data about you are processed, what personal data are processed, and the purpose of the processing. The Company does not have to provide your personal data, if this would adversely affect the rights and freedoms of others. You also have the right to rectify or add personal data if the personal data are inaccurate or incomplete.

Right to erasure (“right to be forgotten”)

You have the right to request that your personal data are erased in certain cases, e.g., if the personal data are no longer necessary for the purposes for which these were collected and no other legal bases exist for continuing to process such data, if the processing is unlawful, or the personal data have to be erased in order to enable the Company to comply with a legal requirement. Please note that the Company may reject your request if the processing is permitted or required according to law or any other relevant legal base.

Right to object and restriction of processing

You are also entitled to object to certain processing or request that the processing of the personal data is restricted such as if you believe the personal data may not be correct, if you believe the processing is unlawful, or if you believe that Company no longer needs the personal data for the purposes stated in this Notice.

Right to data portability

You are also entitled to request that personal data about you that you yourself have provided, if such personal data are being processed with your consent or in accordance with a contract between you and Company, are provided to you in a structured, commonly-used and machine-readable format and you may also request that such personal data are transmitted to another controller, if this is technically feasible.

What should you do, if you want to exercise your rights or if you have a complaint?

To exercise your rights, you can (i) contact the Company using the above contact details, or (ii) contact the Company’s representative notified to you as the Company’s contact person. Where the Company processes your personal data as a processor on behalf of a Facility Operator, your request may need to be directed to, or will be forwarded to, the Facility Operator as the controller of that data. Be aware that you may be contacted to verify your identity so that your personal data are not disclosed or discussed with another person than you.

If you have a complaint regarding the processing of your personal data by the Company, please, contact the Company at the above contact details and submit to it your complaint. You can also submit your complaint directly to the supervisory authority, which is:

Name: Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic)

Address: Hraničná 12, 820 07, Bratislava 27, Slovak Republic

Phone/Fax: +421 2 323 132 14

E-mail: statny.dozor@pdp.gov.sk

Webpage: https://dataprotection.gov.sk

Given that Facility is used internationally, you may also have the right to submit your complaint to the supervisory authority of your own country of residence.

You have undisputable right to submit your complaint directly to the supervisory authority or to use other remedies available to you under the applicable (data protection) laws. However, the Company believes that any request or complaint you may have may be dealt with between you and the Company, and therefore the Company encourages you to first submit your request or complaint to the Company before approaching the authorities. The Company assures you that any request or complaint will be handled in line with the applicable data protection laws.

4. DATA RECIPIENTS. THIRD PARTIES. TRANSFERS

Who has access to your personal data?

The Company processes your personal data through its employees or through external service providers.

Every employee having access to your personal data has been duly trained and informed about the rules and principles of handing your personal data. These employees only get access to your personal data in accordance with the principle of minimization, meaning that they will only have access to personal data that is strictly necessary for the purpose of the processing to perform their work.

In cases where your personal data are processed by a service provider engaged by the Company, the Company and the service provider concluded a data processing agreement in accordance with the applicable data protection laws. Such service providers may include (without limitation) IT service provider(s). Every person processing your personal data must follow the instructions of the Company.

Depending on the category of your personal data, the relevant Facility Operator also has access to it, for example to view weighing transactions or manage its own portal users.

The Company may also transfer your personal data to third parties, who process them for their own purposes. Such third parties include (without limitation) (i) public authorities or bodies (e.g., tax authority) particularly in connection with fulfilment of the Company’s obligations or in order to respond to queries the public authorities or bodies may have, and (ii) other third parties who may be engaged by the Company to provide specific services to the Company in relation to the relationship with you, but who will not process personal data in the name of and on behalf of the Company.

To what countries will your personal data be transferred?

Facility Waste Management is offered to Facility Operators both within and outside the European Union, European Economic Area and Switzerland. Where your personal data are processed within the European Union, European Economic Area or Switzerland, an adequate level of protection of your personal data is secured.

Where the Company transfers your personal data or other data derived from your personal data (such as statistical data) to recipients located in countries which offer a lower level of protection than applicable in the European Union, European Economic Area or Switzerland — including because a Facility Operator itself is located in such a country — this may occur mainly due to the international use of Facility or the use of standardized products or technological solutions of third party services providers (e.g. Microsoft Azure).

In such cases, the Company ensures that the transfer is made in accordance with the rules laid down by the applicable data protection laws, particularly (but without limitation) based on the Model Contractual Clauses adopted by the European Commission or an applicable adequacy decision. For further details, please, contact the Company.

5. MISCELLANEOUS

5.1. To ensure that the Company complies with the applicable data protection laws or to reflect any changes in the processing operations, this Notice may be changed by the Company at any time. You will be informed of any such changes made via the commonly used means and forms.

5.2. The Company encourages you to report any non-compliance with this Notice to the Company. The Company will thoroughly investigate any such allegations and will take steps and actions necessary to ensure compliance with the applicable data protection laws.

5.3. Please notify the Company of any changes to the personal data relating to you to enable the Company to process personal data accurately and securely.

5.4. Please, if you are a Facility Operator, be sure to notify any of your employees, tenants or other individuals whose personal data will be provided to the Company about this Notice and all relevant aspects of processing of their personal data. If you fail to do that, please inform the Company immediately so that the Company may comply with the information obligation and notify the affected data subjects directly.

Contact

SENSONEO j. s. a., ID 50 746 057, Kollárova 27, 841 06 Bratislava – Záhorská Bystrica, Slovak Republic

Email: security@sensoneo.com

Phone: +421 947 924 767