Data protection description: Safety and Security

1. Data controller

Viking Line Abp ("Viking Line")
Norragatan 4, AX-22101, Mariehamn, Åland, Finland
Corp. identity no.: 0144983-8

Viking Line is the data controller responsible for the use of your personal data and for ensuring that this use is in compliance with relevant laws.

2. When do we collect personal data?

Viking Line collects and processes personal data about you when:

• A person is taken into custody
• Reports are prepared concerning a crime or disorderly conduct that has taken place on board
• Reports are prepared concerning a crime or disorderly conduct that has taken place at the terminal
• You are contacted by or contact Viking Line as a witness or are in some other way a party to an incident that has taken place on board

Viking Line only collects the information that is necessary for Viking Line to process and settle cases concerning safety, security and public order.

3. What data do we process about you?

The personal data Viking Line collects in a case concerning safety, security and/or public order are primarily the following:

• Identifying data, such as name, year of birth and gender
• Personal identification number, collected when there is a suspicion of a crime on board and when the report is being submitted to the authorities
• Contact information, such as address, telephone number and e-mail address
• Information about nationality, such as home country and nationality
• Payment information, such as account number
• Booking information and customer number
• Sensitive data sent to the authorities, such as video surveillance material
• Related travel information and documents, such as information about bookings and trips
• Official government documents, such as preliminary police investigation materials and court rulings
• Invoices related to compensation cases
• Opinions of experts and specialists
• Other information that you may provide in connection with the booking, such as requests for special food or specific information from you about the state of your health before the trip that is relevant to you being able to complete the trip

4. For what purposes do we process data about you?

Viking Line primarily processes data about you in order to:

• Support criminal investigations and to ensure Viking Line's cooperation with the authorities
• Facilitate general customer communication for the processing of different cases

5. From where do we obtain our personal data?

We receive personal data directly from the customer, from the booking system, from the authorities or by requesting it with the customer's authorisation and consent.

6. Where are the data stored?

Reported cases concerning safety, security and public order are managed and saved in Viking Line's reporting register.

7. The bases for processing personal data

Viking Line conducts its processing of your personal data based on various legal grounds.

Viking Line processes your personal data in order to comply with statutory requirements or to establish, enforce or defend a legal claim. Viking Line may also process your personal data to perform a contract between you and Viking Line. In some cases, Viking Line may process personal data based on a legitimate interest that arises for us, such as when there is a significant and lawful relation between you and Viking Line, based on your customer relationship.

8. How long do we retain data about you?

Your personal data are only kept as long as there is a need to retain them in order to fulfil the duties that the data were collected for in accordance with this data protection description. Viking Line may save the data for a longer period, if necessary, in order to comply with legal requirements or to monitor Viking Line's legitimate interests.

The storage period for your personal data depends on the laws that regulate prescriptive periods for the context in which your personal data were collected.

9. To whom do you give the data?

Personal data are only transferred outside of Viking Line with the customer's consent or if the transfer of data has specific lawful grounds.

Viking Line may provide your personal data to a third party, such as authorities including the police, prosecutors, customs, border control, and tax or health authorities, in order to submit claims or for other legal procedures.

Personal data may also be released by Viking Line if this is necessary for compliance with legal or regulatory requirements, for Viking Line to pursue its legitimate interests, or to detect, prevent or draw attention to fraud or other security or technical problems.

10. How do we safeguard the processing of data?

Personal data may only be processed by authorised individuals. We ensure that authorisation is given by the authorisation administration, and only to people whose duties require that they have access to personal data. Viking Line has implemented technical and organisational security measures to safeguard the security of the personal data processed in our operations. The system that stores personal data is password protected.

The Viking Line employees who process data are subject to the conditions of professional secrecy in effect and have signed a confidentiality statement in which it is emphasised that the data are confidential.

11. Changes in the data protection description

Viking Line is entitled to change the data protection description at any time if there are changes in the processing of data.

12. Protection of personal data

Viking Line has implemented the necessary security measures to protect your personal data against unlawful access, changes and deletions.

13. Your rights

Viking Line is responsible for ensuring that your personal data are processed in accordance with the laws in effect. If you believe that any applicable data protection law has not been complied with in the processing of your personal data, you may lodge an appeal with the relevant data protection agency, that is, the Data Protection Ombudsman's Office in Finland.

At your request or at our own initiative, Viking Line will correct, delete or supplement data that is found to be erroneous, incomplete or misleading, or change the data so that you can no longer be identified.

You are entitled to submit a signed request to receive an excerpt from the register concerning what personal data about you have been registered, the purposes for processing these data and to what recipients your data have been or will be released. You are also entitled to obtain information about where your data were collected from, how automated decision-making (including profiling) is carried out and how long your data will be retained. You are furthermore also entitled to obtain information about your rights as a person whose personal data is being processed.

Under certain conditions, you are entitled to have your data transferred to you or, if this is technically possible, to another service provider. This right governs data that you have provided to Viking Line and that has been processed in order for the contract between you and Viking Line to enter into force.

You are entitled to request that your data be deleted if (i) the data are no longer needed for the purpose they were collected for, (ii) you object to the processing of your personal data for direct marketing purposes (including profiling for direct marketing purposes), (iii) the processing was based on your consent and you are revoking your consent or (iv) your data have been processed in a way that is unlawful. Please note that we can nonetheless retain data if this is necessary for Viking Line to comply with its statutory obligations or to establish, enforce or defend a legal claim.

(This is a translation of the Swedish original. In the event of any discrepancies between the Swedish text and the English translation, the Swedish text shall take precedence.)