1 Introduction

We, Bergman & Beving Aktiebolag (“Bergman & Beving” or “we”), process certain personal data regarding the persons who use our digital platforms and services and get in contact with us in other ways. This information policy explains how we process your personal data. The privacy policy also describes your rights towards us and how you can enforce your rights regarding the processing of your personal data.

2 Who is the controller of personal data?

Bergman & Beving is the controller of personal data for the processing of personal data collected.

Set forth below is our contact information.

Bergman & Beving Aktiebolag, reg. no. 556034-8590

Box 10024, 100 55 STOCKHOLM

+46 10 454 77 00

Should you have any questions about the our processing of your personal data, please contact us at personuppgifter@bb.se.

3 Personal data that we process about you

In your contact with Bergman & Beving you will provide us with information such as name and contact information. Your personal data has been collected either directly from you or from your employer in connection with the business relationship between us and your employer.

We may also collect personal data from other sources. For example, we collect registers of shareholders from Euroclear Sweden AB (reg.nr 556112-8074) in connection with annual meetings.

4 Purpose and legal BASIS for the processing of your personal data

4.1 Generally

We process your personal data in order to communicate with you and to send you marketing information. This communication covers information regarding Bergman & Beving (such as press releases, financial reports, newsletters, invitations to various events and lectures) and answering questions from you (for example when you contact us or ask us a question via the forms we provide on our website or email) . The legal basis for the processing is a balance of interests and our legitimate interest of providing the information that you have requested from us, maintaining our business relationship with you or your employer and/or provide any with material and/or communicate with you in your profession regarding information and events that we offer and that we believe may be of interest to you. You are welcome to contact us if you wish to know more about how we have done the balance of interests. If you have given us your consent we will instead process your information for the above purposes with the based on your consent.

According to the Market Abuse Regulation (EU) 596/2014, listed companies must keep a list of persons employed by the company, are contracted by the company or for other reasons (such as counterparty in negotiations) and which have access to insider information relating to the company. In order to fulfill our obligations regarding these so-called logbooks, we will from time to time process personal information for concerned persons.

We offer a so called whistleblower service on our website in accordance with applicable laws. The service enables people to report a suspicion of a serious misconduct. As a reporter you can be completely anonymous when using the service. In case of processing of your personal data, such processing is based on our legitimate interest to enable reports of suspected serious misconducts within Bergman & Beving. The whistleblower service is an important channel in order to maintain good corporate governance and uphold the trust of the public and our customers. Reports containing personal data regarding suspicions of violations of the law are treated solely regarding key personnel or senior executives, in accordance with the guidelines from The Swedish Data Protection Authority.

The processing of your personal data is in some cases a statutory or contractual requirement. To the extent that you do not provide your personal data to us, it may have an effect on our possibility to fulfill our commitments made to you and our obligation to comply with the legal requirements we are subjected to in relation to you.

4.2 Specifically for you as a shareholder or an employee of a shareholder (including representatives of a shareholder such as agents, counsels and trustees)

In addition to the general information set out in section 4.1 we process your personal data as a “person discharging managerial responsibilities” or person closely associated to you (see the market abuse (EU) 596/2014 for definition), shareholder or employee of a shareholder (including representatives of shareholders such as agents, counsels and trustees) if applicable as follows.

We process your personal data for the following purposes, based on a legal obligation:

• Fulfill our obligations to keep an insider list of how you as a shareholder and and persons closely associated trade shares under the Market Abuse Regulation (EU) 596/2014, for instance in case you discharge managerial responsibilies. Insofar as information about closely associated persons is processed, you are responsible to inform them by e-mail with a copy to personuppgifter@bb.se. The information shall include this policy.

• Fulfill the requirements for filing a copy of any reporting to the Financial Supervisory Authority regarding trading in Bergman & Beving shares in accordance with Market Abuse Regulation (EU) 596/2014. Insofar as information about closely associated persons is processed, you are responsible to inform them by e-mail with a copy to personuppgifter@bb.se . The information shall include this policy.

• Fulfill our other obligations as a listed company, for instance to establish share registers, establish protocols, administer calls to annual meeting, manage voting rights and registration.

• Comply with our accounting obligations according to the Accounting Act (1999: 1078).

We process your personal data for the following purposes based on a legitimate interest:

• Publishing information in accordance with regulations and guidelines for listed companies that are not legally binding or decisions based on legislation for the purpose of increasing insight and transparency into our organisation.

• Internal and external publishing of certain shareholders’ names and information about these in news notifications.

• Publication of information on the website regarding shareholding.

• Publication of information about members of the nomination committee on the website.

• Dividend.

• Your personal information as an employee of a shareholder of Bergman & Beving will be processed in accordance with the agreement for the purposes administration and fulfilment of our agreement with the shareholder (your employer). The legitimate interest of Bergman & Beving is to be able to administer the agreement and fulfill our obligations towards the shareholder (your employer).

• Publication of information on the website from the register of the Swedish Financial Supervisory Authority regarding insider transactions.

Our legitimate interest is to be able to publish information about Bergman & Beving in accordance with guidelines for listed companies that are not governed by law, for example Swedish Code of Corporate Governance. We also have a legitimate interest of internal and external communication needed in order for Bergman & Beving to provide good service, answer questions or to facilitate external contacts.

What is stated above under section 4.2 shall apply as applicable to shareholders’ representatives, such as agents, counsels or trustees.

4.3 Specifically for you as a customer or an employee of a customer

In addition to the general information set out in section 4.1, we process your personal data as a customer or employee of a customer if applicable as follows.

We process your personal data for the following purposes for the performance of a contract or in order to take steps at your request prior to entering into a contract:

• In your contact with us as a customer as well as when using our services and when purchasing our products, we will process your personal data to administrate and in order to fulfill our agreement with you.

We process your personal data for the following purposes, based on a legal obligation:

• Fulfill our obligations to keep a list of how you and persons closely associated trade shares in accordance with the Market Abuse Regulation (EU) 596/2014. Insofar as information about closely associated persons is processed, you are responsible to inform them by e-mail with a copy to personuppgifter@bb.se. The information shall include this policy.

• Comply with our accounting obligations according to the Accounting Act (1999: 1078).

• We process personal data about you and your purchases according with our obligations according to applicable consumer sales- and sales legislation.

We process your personal data for the following purposes based on our legitimate interest:

• Your personal data as an employee of a customer of Bergman & Beving will be processed in accordance with the agreement between Bergman & Beving and the customer for the purpose of administrating and fulfilling the agreement with our customer (your employer). The legitimate interest of Bergman & Beving is to administer the agreement and fulfill our agreements to our customer (your employer).

4.4 Specifically for you as an employee of a supplier

4.4.1 Generally

In addition to the general information set out in section 4.1, we process your personal data as an employee of a supplier if applicable as follows.

We process your personal data for the following purposes in order to fulfill a legal obligation

• Fulfill our obligations to keep a list of how you and persons closely associated trade shares in accordance with the Market Abuse Regulation (EU) 596/2014. Insofar as information about closely associated persons is processed, you are responsible to inform them by e-mail with a copy to personuppgifter@bb.se. The information shall include this policy.

• Comply with our accounting obligations according to the Accounting Act (1999: 1078).

We process your personal data for the following purposes based on our legitimate interest:

• Your personal data as employee to a supplier to us is processed in accordance with the agreement with the supplier for administration and performance of the contractual relationship. Our legitimate interest is to be able to administer the agreement and fulfill our obligations to our supplier (your employer).

4.4.2 Specifically for you as an employee of our auditing company

In addition to the general information set out in section 4.1 and 4.4.1, we process your personal data as an employees of our auditing company if applicable as follows.

We process your personal data for the following purposes in order to fulfill a legal obligation:

• Fulfill our other obligations as a listed company, for instance to administer accounts, annual reports, audit reports, registering auditors with the authority, protocols or other purposes, as stated in law, inter alia the Companies Act (2005:551).

We process your personal data for the following purposes based on our legitimate interest:

• Internal and external publication of the name of the auditor. Our legitimate interest is to increase the insight and transparency of our business.

4.5 Specifically for you as analysts

In addition to the general information set out in section 4.1, we process your personal data as an analyst if applicable as follows.

We process your personal data for the following purposes based on our legitimate interest:

• Internal and external publication of the names of the analysts. Our legitimate interest in processing your personal data is to publish information about the company in accordance with guidelines for listed companies that follow by law, such as the Swedish Code of Corporate Governance, and provide insight and transparency into our organisation, as well as providing information about the review and analysis that Bergman & Beving is subjected to.

5 Who might we share your personal data with?

The personal data collected may also be transfered to system suppliers, payroll administrators, banks, accountants, insurance brokers, insurance companies and pension managers as well as other suppliers who provide services to the Company. These recipients are data processors and are only entitled to process your personal data on behalf of Bergman & Beving while performing a service for Bergman & Beving, for example delivering a product ordered by the Customer. The Company takes all reasonable legal, technical and organizational measures in order to ensure that your data is handled securely and with an adequate level of protection when transferring to, or sharing with, such selected third parties.

The Company may also release your personal data to public authorities, such as the Swedish Financial Supervisory Authority, where we are obligated to do so by law. In the event all or part of Bergman & Beving’s operations are sold, Bergman & Beving may transfer your personal data to a potential purchaser of the business. These recipients are data controllers for such processing.

6 Transfers of personal data outside of the EU/EEA

We, our suppliers and partners will as a main principle only process your personal data within the EU/EES. In case personal data processes outside of the EU/EES there is either a decision from the commission ensuring that the third country in question has an adequate level of protection or appropriate safeguards in the form of standard contractual clauses, binding corporate rules or Privacy Shield, which ensures that your rights are protected. Contact us if you wish to have a copy of the protection measures that we have taken or information about where these has been made available at personuppgifter@bb.se.

7 How long we will store your personal data

7.1 Generally

We will never process your personal data for a longer period than permitted by applicable law, regulation, case law or government decision. The personal data that we process in order to fulfill our agreement with you is processed during the time necessary for us to administer the contractual relationship, exercise your rights and fulfill our commitments to you. In order to fulfill legal requirements, because you have given your consent or because we are entitled to process personal data based on a legitimate interest, we may however, save your personal data for a longer period as stated below.

• Processing of personal data in order to comply with the obligations to keep a list of persons employed by the company, are contracted by the company or for other reasons (such as counterparty in negotiations) and which have access to insider information relating to the company, so-called logbooks, according to the Market Abuse Regulation (EU) 596/2014, is processed in accordance with the Market Abuse Regulation and general limitation rules under the Limitations Act (1981:130).

• Your personal data that we process based on your consent will be processed until you withdraw your consent.

• Your personal data that we process based on our legitimate interest with the purpose to communicate with you to answer questions or publish information about Bergman & Beving Group and our business, will be processed as long as the matter is in progress or the purpose remains.

• Personal data that we process based on our legitimate interest for the marketing purposes is processed in accordance with applicable national laws and case law and varies depending on your relationship to Bergman & Beving a) if you subscribe to our newsletters we will process your personal data until you inform us that you no longer wish to receive the information b) if you have a customer relationship with us, and do not subscribe to any of our information, we will process your personal data for a maximum of one (1) year after your customer relationship has ended or until you announce that you no longer wish to receive our newsletters c) if you are not an active customer of ours or a subscriber of our newsletters we will process your personal data for a maximum of three (3) months or until you announce that you no longer wish to receive our newsletters.

• Information, pictures and newsletters that we publish on our website based on our legitimate interest will be processed for as long as there is a news value in the information published and the purpose remains. For example, continued processing may be necessary to inform the public and investors.

7.2 Specifically for you as a shareholder or an employee of a shareholder (including representatives of a shareholder such as agents, counsels and trustees)

In addition to the general retention periods set out in section 7.1, we save your personal data as a shareholder or employee of shareholders (including shareholders' representatives such as agents, counsels and trustees), if applicable, as follows.

• Personal data processed for dividends or other purposes required by the Accounting Act (1999:1078) will be processed for seven (7) years in accordance with the Swedish Accounting Act (1999:1078).

• Processing carried out based on our obligations to keep a list of "person discharging managerial responsibilities" and persons closely associated under the Market Abuse Regulation (EU) 596/2014 will be saved in accordance with the Market Abuse Regulation and general limitation provisions under the Limitations Act (1981:130).

• Information regarding persons closely associated with you that we process to comply with our legal obligations under the Market Abuse Regulation (EU) 596/2014 is retained for five (5) years.

• Your personal data as an employee of a shareholder will be processed for as long as you remain employed by the shareholder and the purpose of the process remains. If you are no longer employed by the shareholder or are no longer a contact person, the processing will stop as soon as we are informed.

7.3 Specifically for you as a customer or an employee of a customer

In addition to the general retention periods set out in section 7.1, we save your personal data as a customer or an employee of a customer, if applicable, as follows.

• Personal data that we process in order to fulfill our agreement with you/ your employer is as a main principle processed for the time that we are required in order to administrate the contractual relationship, exercise our rights and fulfill our commitments to you/ your employer. If your employment ends we will terminate our processing of your personal data as soon as we receive such information from you/the shareholder. Inactive agreements containing your personal data will be stored for ten (10) years due to general limitation rules under the Limitations Act (1981:130).

• Personal data processed for purposes required by the Accounting Act (1999:1078) will be processed for seven (7) years in accordance with the Accounting Act (1999:1078).

• Your personal data as an employee of a customer will be processed for as long as you remain employed by the customer and the purpose of the process remains. If you are no longer employed by the customer or are no longer a contact person, the processing will stop as soon as we are informed.

• Your personal data which we process based on applicable consumer sales- and sales legislation is processed in accordance with such legislation.

• Processing carried out based on our obligations to keep a insider list under the Market Abuse Regulation (EU) 596/2014 will be saved in accordance with the Market Abuse Regulation and general limitation provisions.

• Information regarding persons closely associated with you that we process to comply with our legal obligations under the Market Abuse Regulation (EU) 596/2014 is retained for five (5) years.

7.4 Specific information for employees of a supplier

7.4.1 Generally

In addition to the general retention periods set out in section 6.1, we save your personal data as an employee of a supplier, if applicable, as follows.

• Personal data that we process in order to fulfill our agreement with you/ your employer is as a main principle processed for the time that we are required in order to administrate the contractual relationship, exercise our rights and fulfill our commitments to you/ your employer. If your employment ends we will terminate our processing of your personal data as soon as we receive such information from you/the supplier. Inactive agreements containing your personal data will be stored for ten (10) years due to general limitation rules under the Limitations Act (1981:130).

• Personal data processed for purposes required by the Accounting Act (1999:1078) will be processed for seven (7) years in accordance with the Accounting Act (1999:1078).

• Processing carried out based on our obligations to keep a insider list under the Market Abuse Regulation (EU) 596/2014 will be saved in accordance with the Market Abuse Regulation and general limitation provisions.

• Information regarding persons closely associated with you that we process to comply with our legal obligations under the Market Abuse Regulation (EU) 596/2014 is retained for five (5) years.

7.4.2 Specifically for you as an employee of our auditing company

In addition to the general retention periods set out in section 7.1 and 7.4.1, we save your personal data as an employee of our auditing company, if applicable, as follows.

• Processing of such information that is necessary for us to fulfill our other obligations as a listed company for example processing of accounts, drawing up annual reports, drawing up audit reports, registering auditors with authority, drafting minutes or other purposes based on the Companies Act (2005:551) will be processed as long as required by law or general limitation rules under the Limitations Act (1981:130).

7.5 Specifically for you as analysts

In addition to the general retention periods set out in section 7.1, we save your personal data as an analyst, if applicable, as follows.

• Your personal data as an analyst will be processed for as long as you are an analyst for Bergman & Beving and the purpose the processing remains.

8 The protection of personal data

We maintain a high level of security for your personal data and have for this purpose taken appropriate technical and organisational security measures to protect your personal data from unauthorised access, modification, dispersion or destruction.

9 Your rights

In accordance with current data protection laws, you have the right to access information about what personal data we are processing about you and the right to request a rectification of your personal information.

Under certain conditions, for example if the processing is no longer necessary for the stated purposes or if you withdraw your consent, you have the right to request that we erase your personal data. In some cases, you also have the right to request that we restrict our processing of your personal data. You have the right to object to our processing of your personal data for example direct marketing purposes or profiling, or if the processing is based on our legitimate interest.

You also have the right, under certain circumstances, to obtain the personal data that relates to you, as provided to us, in a structured, widely used and machine-readable format and may transfer them to another controller (data portability).

You are entitled to revoke all or part of a given consent for processing personal data at any time with effect from the date of withdrawal, unless further processing is required by law. You also have the right to object to processing of personal data for the purposes of profiling and direct marketing.

If you have any complaints regarding our processing of your personal data, you have the right to lodge a complaint with the Swedish Data Protection Authority, www.datainpektionen.se, or other competent supervisory authority that supervises our processing of personal data.

If you would like to submit a request for a extract from the register, data portability, rectification, deletion, objection or restriction, please contact us at personuppgifter@bb.se.

10 Cookies

10.1 Why we use cookies

Cookies are small text files that are placed in your computer or mobile phone when you visit a website. The cookies help our Digital Channels to recognise your device and to remember information about your visit (such as desired language, font size and other settings).

10.2 How you decline the use of cookies

You can deny the use of cookies by adjusting, or by selecting certain settings in your browser. Keep in mind that you may lose some useful features such as personalisation of the Digital Channel and "remember-me features”.