Data protection description: Feedback and Claims

1. Data controller

Viking Line Abp ("Viking Line")
Norragatan 4, AX-22101, Mariehamn, Åland, Finland
Corp. identity no.: 0144983-8

Viking Line is the data controller responsible for the use of your personal data and for ensuring that this use is in compliance with relevant laws.

2. When do we collect personal data?

Viking Line collects and processes personal data about you when:

• You, as an injured party, contact Viking Line about the settlement of a claim and compensation for a claim
• Viking Line's onboard staff prepare an injury report on the occurrence of an injury
• You are contacted by or contact Viking Line as a witness or are a party to the settlement of a claim in some other way

Viking Line only collects information that is required for Viking Line to be able to process and make payment on an injury claim.

3. What data do we process about you?

The personal data Viking Line collects in a claim settlement case are primarily:

• Identifying data, such as name, year of birth and gender
• Contact information, such as address, telephone number and e-mail address
• Information about nationality, such as home country and nationality
• Payment information, such as account number
• Customer number
• Information about settlement of a claim, information about the injury
• Information about a vehicle, such as licence plate number
• Travel information and documents related to this, such as information about bookings and trips
• Official government documents, such as police preliminary investigation materials and court rulings
• Invoices related to compensation cases
• Opinions of experts and specialists
• Other information that you may provide in connection with the booking, such as requests for special food or specific information from you about the state of your health before the trip that is relevant to you being able to complete the trip

4. For what purposes do we process data about you?

Viking Line primarily processes data about you in order to:

• Administer and determine claims cases
• Facilitate communication with the customer for the processing of compensation claims

5. From where do we obtain our personal data?

We receive personal data directly from you, from the booking system or by requesting it as a result of obtaining your authorisation and consent.

6. Where are the data stored?

Damage claims submitted are managed and saved in Viking Line's claims register. The service is password-protected.

7. The bases for processing personal data

Viking Line conducts its processing of your personal data based on various legal grounds.

Viking Line processes your personal data in order to comply with statutory requirements or to establish, enforce or defend a legal claim. Viking Line may also process your personal data to perform a contract between you and Viking Line. In some cases, Viking Line may process personal data based on a legitimate interest that arises for us, such as when there is a significant and lawful relation between you and Viking Line, based on your customer relationship.

8. How long do we retain data about you?

Your personal data are only kept as long as there is a need to keep them in order to fulfil the duties that the data were collected for in accordance with this data protection description. Viking Line may save the data longer, if necessary, in order to comply with legal requirements or to monitor Viking Line's legitimate interests.

The length of time your personal data is kept depends on laws that affect the presentation of a possible claim for insurance compensation.

9. To whom do you give the data?

Personal data are only transferred outside Viking Line with the customer's consent or if the transfer of data has specific lawful grounds.

Viking Line may provide your data to a third party, such as Viking Line's or the customer's insurance company, which may be necessary in order for the case to be managed.

Personal data may also be released by Viking Line if this is necessary for compliance with legal or regulatory requirements, for Viking Line to pursue its legitimate interests, or to detect, prevent or draw attention to fraud and other security or technical problems.

10. How do we safeguard the processing of data?

Personal data may only be processed by authorised individuals. We make sure that authorisation is given by the authorisation administration, and only to people whose duties require that they have access to personal data. Viking Line has implemented technical and organisational security measures to safeguard the security of personal data processed in our operations.

Viking Line's employees who process data are subject to the conditions of professional secrecy imposed and have signed a confidentiality statement in which it is emphasised that the data are confidential.

11. Changes in the data protection description

Viking Line is entitled to change the data protection description at any time if there are changes in the processing of data. Viking Line will inform you with reasonable notice about changes in the data protection description, in case it affects your rights or freedoms.

12. Protection of personal data

You must always be able to feel safe when you provide your personal data to us. Viking Line has thus implemented security measures that are needed to protect your personal data against unlawful access, changes and deletions.

13. Your rights

Viking Line is responsible for ensuring that your personal data are processed in accordance with the laws in effect. If you believe that any applicable data protection law has not been complied with in the processing of your personal data, you may lodge an appeal with the relevant data protection agency, that is, the Data Protection Ombudsman's Office in Finland.

At your request or at our own initiative, Viking Line will correct, delete or supplement data that is found to be erroneous, incomplete or misleading, or change the data so that you can no longer be identified.

You are entitled to submit a signed request to receive an excerpt from the register concerning what personal data about you have been registered, the purposes for processing these data and to what recipients your data have been or will be released. You are also entitled to obtain information about where your data were collected from, how automated decision-making (including profiling) is carried out and how long your data will be kept. You are furthermore also entitled to obtain information about your rights as a person whose personal data is being processed.

Under certain conditions, you are entitled to have your data transferred to you or, if this is technically possible, to another service provider. This right governs data that you have provided to Viking Line, and that has been processed in order for the contract between you and Viking Line to enter into force.

You are entitled to request that your data be deleted if (i) the data are no longer needed for the purpose they were collected for, (ii) you object to the processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes), (iii) the processing was based on your consent, and you are revoking your consent or (iv) your data have been processed in a way that is unlawful. Please note that we can nonetheless keep data if this is necessary for Viking Line to comply with its statutory obligations or to establish, enforce or defend a legal claim.

(This is a translation of the Swedish original. In the event of any discrepancies between the Swedish text and the English translation, the Swedish text shall take precedence.)